Where Does My Data Go When a Chatbot Reads My Files?
Your file gets copied, chopped into passages, stored in a searchable index, and then relevant passages get sent to a language model every time you ask a question. So the honest answer to “where does my data go” is: to at least two places, possibly run by two different companies, and it stays in the index until someone deletes it. Whether that’s fine depends entirely on whose servers those are and what their terms say — which is a question you have to ask, because the interface won’t tell you.
This post is about understanding the data flow well enough to ask the right questions. It isn’t legal or security advice, and specific products’ policies change, so verify the current terms of anything you actually use.
The journey your document takes
Six stops, in order:
1. Upload. The file leaves your device for the service’s servers. Unless the tool explicitly runs on your own machine, this has already happened by the time you see a progress bar.
2. Text extraction. The file is read and converted to plain text. A copy of that text now exists separately from your original file.
3. Splitting. The text is cut into passage-sized pieces.
4. Indexing. Each piece is converted into a numeric representation — an embedding — by an embedding model, and stored alongside the text in a searchable index. Two things to notice: that conversion often happens on a third party’s servers if the tool uses someone else’s embedding model, and the index stores the original text too, not just numbers.
5. Retrieval, per question. Your question is matched against the index and a few passages come back.
6. Generation. Those passages, plus your question, are sent to a language model — again, frequently a third party’s, accessed over the internet.
So a single question can involve your text traveling to the tool’s servers, an embedding provider, and a model provider. Sometimes all three are one company. Often they’re not.
The four questions worth asking
Any vendor should be able to answer these plainly. Vagueness is itself informative.
Is my data used to train their models? The important one, and the answer varies. Business and enterprise tiers commonly say no by default; consumer free tiers sometimes reserve the right, occasionally with an opt-out buried in settings. This matters because training is the one step that’s effectively irreversible — information absorbed into a model’s weights can’t be neatly removed later.
Where is it stored, and for how long? Both the index and your conversation logs. Retention periods differ wildly, and “for as long as your account is active” is a common answer that surprises people.
Who can see it? Their staff, for support or abuse review? Other users, if permissions are misconfigured? Subprocessors?
What happens when I delete? Does deleting a document remove it from the index immediately, at the next re-index, or only from the interface? Are conversation logs deleted too? Backups?
The genuinely good news about RAG and privacy
There’s a real structural advantage worth understanding, because it’s often lost in the anxiety.
Retrieval doesn’t change the model. When a system retrieves your document and shows it to a model, the model reads it and forgets it. Nothing about the model is modified. That’s fundamentally different from fine-tuning, which bakes information into the model itself. See Is RAG machine learning?
Consequences that follow:
- Deletion can actually work. Remove the document from the index and it stops appearing in answers. Information trained into a model is notoriously hard to remove.
- Permissions remain enforceable. Documents live in a store with access controls. Trained-in knowledge has no permissions — anyone who can ask can potentially surface it.
- Data doesn’t leak between customers via the model, because it was never in the model.
This is precisely why organizations with real confidentiality requirements prefer retrieval over training on their data. It keeps the sensitive material in a place they can control, audit, and empty.
The cases where care is warranted
Being honest about the risks that remain:
Free consumer tools with vague terms. If a product doesn’t clearly state its training and retention practices, assume the least favorable reading for anything confidential.
Documents that aren’t yours to upload. Client material, patient records, other people’s personal data, material under a non-disclosure agreement. The constraint here is often contractual or legal rather than technical, and it’s the most commonly overlooked one — uploading someone else’s confidential document to a tool you like can breach an agreement regardless of how careful the vendor is.
Shared knowledge bases without permission controls. If your team indexes everything into one collection and retrieval doesn’t filter by who’s asking, salary reviews can surface in answers to interns. This is a real and frequent misconfiguration.
Conversation logs. People focus on documents and forget that what you typed is also stored, often for longer.
Third parties you didn’t choose. A tool may route your text through several providers. Any evaluation should ask which ones.
Ways to reduce exposure
Roughly by effort:
Read the terms for the tier you’re on. Free and paid tiers of the same product frequently differ on training and retention. This is a five-minute task most people skip.
Use business or enterprise tiers for work documents. They usually carry stronger commitments, contractual data-processing terms, and admin controls.
Redact before uploading. Names, account numbers, identifiers. Often the document is just as useful without them.
Ask whether the collection is per-user or shared, and whether retrieval filters by permissions.
Delete when finished — and confirm what deletion actually removes.
For the strictest cases, keep it local. Tools exist that run the model and index on your own hardware, so nothing leaves the machine. That path trades capability and convenience for containment, and for some material it’s the only acceptable option.
Check your organization’s policy before uploading anything work-related. Most now have one, and “I didn’t know” is a poor position.
The takeaway
When a chatbot reads your files, your text is copied, split, stored in a searchable index, and sent to a language model on every question — potentially crossing several companies’ servers along the way. Retrieval is structurally friendlier to privacy than training on your data, because deletion and permissions actually work. But that only holds if you know whose servers hold the index, whether your text trains anything, and how long it’s kept. Ask those four questions before uploading anything you’d mind seeing elsewhere.