The answer depends on the service and configuration you plan to use. Get clear terms for that specific product, account tier, feature and use, then compare them with the settings available to you. If you cannot establish what happens to the data, pause before using client information and ask the vendor to clarify.
Check each data flow, not just the headline
Ask whether prompts, uploaded files, outputs, logs and feedback can be used to train or fine-tune a model, evaluate it, or otherwise improve a service. These may be treated differently, and the answer could vary by feature or account tier.
Check both the contract and the product settings. Look for exceptions, such as particular features or support processes, and whether an opt-out is available, applies by default, or must be enabled. A marketing phrase or a general statement that data is “not used for training” may not explain every data flow or service tier.
Ask for terms you can verify
Ask the vendor to confirm in writing, for the exact product and configuration:
- Which of your prompts, files, outputs, logs and feedback may be collected or used, and for what purposes.
- Whether any data may be used for training, fine-tuning, evaluation or service improvement, including exceptions and opt-out conditions.
- How long each data type is retained, what deletion covers, and whether deletion applies to copies or derived data.
- Which subprocessors or vendor personnel may access or process the data, and under what circumstances.
- Which account settings control these uses, who can change them, and how the vendor will confirm the settings remain in effect.
Do not rely on a sales summary if it leaves these points unclear. Ask for the relevant contractual terms and a written explanation tied to your account and intended use.
Record the decision and a route to pause
Keep the vendor’s written answers, the relevant contract terms and a record of the settings in force. Note the decision owner, the product, tier, feature and intended use covered by the approval, and what would trigger a review, such as a contract, feature or settings change.
Agree what staff should do if an answer is missing or unclear: do not upload the affected client data, restrict or pause the use, and escalate the question to the appropriate internal owner. These steps help make the decision traceable; they do not determine whether a particular use is legally permissible or resolve confidentiality or privilege questions.
Source and scope
The vendor-question structure here is informed by Nexairi’s commercial vendor due-diligence guidance, dated 13 May 2026 and written for CPA firms. It is practical commercial guidance, not UK legal or regulatory authority. The checks above are recommendations for UK professional-services and regulated-SME buyers, not a statement of legal duties.
Discuss the decision
If you are weighing a specific AI use, you can book a 30-minute AI Automation Discovery Call with Rohit to discuss whether there is a useful, safe opportunity, what next step makes sense, and what may not be worth doing yet.