Does Gemini train on your data?
Gemini by GoogleAI assistantsVendor's pages read on
It depends on the plan and on a setting.
The vendor states that inputs are not used for training unless the customer opts in on Gemini in Google Workspace (work or school account). On Gemini app with a personal Google account, a setting controls whether inputs are used for training; the pages read do not state its default in a sentence that could be quoted. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
A summary of what the vendor publishes, not legal advice, not an assessment of the vendor and not an endorsement. How this page was made.
What the vendor states, plan by plan
| Plan | Trains on your data | Default retention | Human review of inputs | Single sign-on |
|---|---|---|---|---|
| Gemini app with a personal Google accountConsumer / free | Depends on a setting | With Keep Activity off: 72 hours. Reviewed chats: up to three years | Yes | Unknown |
| Gemini in Google Workspace (work or school account)Enterprise | Only if the customer opts in | Set by the Workspace admin | No | Unknown |
“Unknown” means the vendor's page that would answer this was not read, or could not be opened. It does not mean “no”.
Gemini app with a personal Google account
On Gemini app with a personal Google account, the vendor states that a setting controls whether inputs are used for training. Retention: with Keep Activity off: 72 hours. Reviewed chats: up to three years. The vendor states that people may review inputs.
- Trains on customer data
- Depends on a setting
Controlled by the Keep Activity setting. The page states that, depending on settings, data is used to improve Google services including machine-learning technologies.
“To stop your future chats from being reviewed to improve Google services, turn off your Keep Activity setting.”
The vendor states this on support.google.com, read on 12 Nov 2026
- Default retention
- With Keep Activity off: 72 hours. Reviewed chats: up to three years
With Keep Activity on, activity is kept for the auto-delete period the user chooses.
“Temporary chats and chats you have when Keep Activity is off are retained with your account for 72 hours”
The vendor states this on support.google.com, read on 12 Nov 2026
- Deletion on request
- Yes
“Visit Gemini Apps Activity to review and delete your activity (including imported chats), change your auto-delete period”
The vendor states this on support.google.com, read on 12 Nov 2026
- Human review of inputs
- Yes
The page states reviewed chats are retained for up to three years.
“Human reviewers (including trained reviewers from our service providers) review some of the data we collect for these purposes.”
The vendor states this on support.google.com, read on 12 Nov 2026
Unknown for this plan: Zero-retention option; Single sign-on (SSO); SCIM provisioning; Audit logs; Admin console; Data residency options; Customer-managed keys.
Gemini in Google Workspace (work or school account)
On Gemini in Google Workspace (work or school account), the vendor states that inputs are not used for training unless the customer opts in. Retention: set by the Workspace admin. The vendor states that inputs are not reviewed by people.
- Trains on customer data
- Only if the customer opts in
“Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission.”
The vendor states this on knowledge.workspace.google.com, read on 12 Nov 2026
- Default retention
- Set by the Workspace admin
“Admins can control whether conversations with Gemini are saved and for how long before they are automatically deleted”
The vendor states this on knowledge.workspace.google.com, read on 12 Nov 2026
- Deletion on request
- Yes
“Admins can manage retention for Workspace data using Vault.”
The vendor states this on knowledge.workspace.google.com, read on 12 Nov 2026
- Human review of inputs
- No
“Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission.”
The vendor states this on knowledge.workspace.google.com, read on 12 Nov 2026
Unknown for this plan: Zero-retention option; Single sign-on (SSO); SCIM provisioning; Audit logs; Admin console; Data residency options; Customer-managed keys.
Attestations and company facts the vendor states
- ISO/IEC 42001
- Yes
“Gemini has received security and privacy certifications, including ISO 42001, BSI C5 and FedRAMP High, and can help meet HIPAA requirements.”
The vendor states this on workspace.google.com, read on 12 Nov 2026
- FedRAMP
- Yes
Stated for Gemini in Google Workspace: FedRAMP High.
“Gemini has received security and privacy certifications, including ISO 42001, BSI C5 and FedRAMP High, and can help meet HIPAA requirements.”
The vendor states this on workspace.google.com, read on 12 Nov 2026
“Yes” means the vendor's page says so, with the page linked. GhostAudit has not audited the vendor. Scope by product is on the vendor's page.
What remains unknown
- Zero-retention option
- Single sign-on (SSO)
- SCIM provisioning
- Audit logs
- Admin console
- Data residency options
- Customer-managed keys
- SOC 2 Type II
- ISO/IEC 27001
- HIPAA BAA available
- GDPR DPA available
- Company headquarters
- Data processing location
- Model providers used
None of these was guessed, inferred from another vendor or filled from memory. Ask the vendor, using the list below.
- Training depends on a setting. Applies to: Gemini app with a personal Google account. Check how the setting is configured for your accounts.
- Enterprise controls not verified. SSO, SCIM and audit logs have not been checked for this tool yet.
How to check Gemini in your own company
- 01Find out which plan each account is on. The vendor's terms differ between Gemini app with a personal Google account and Gemini in Google Workspace (work or school account). People who signed up with a personal address are on the personal terms, whatever the company bought.
- 02Open the account or administrator settings and look for the data-controls or model-training setting the vendor's page describes. Note what it is set to today and who is able to change it.
- 03Read the vendor's own page, linked under each fact below, and check that the sentence quoted here is still there. Pages change; the date shows when this one was read.
- 04Compare with your contract or order form. Where a data processing agreement or negotiated terms exist, they take precedence over the public pages.
- 05Record the plan, the setting and the date in your AI inventory, so that the answer exists the next time a customer or auditor asks.
What to ask the vendor
Neutral questions for the points the vendor's public pages left open. Ask for the answer in writing.
- 01Is a zero-retention option available on our plan, and what does it exclude (for example abuse monitoring logs)?
- 02Is single sign-on available on our plan, and can sign-in with personal accounts be blocked for our domain?
- 03Is SCIM provisioning available, so that leavers lose access automatically?
- 04Are audit logs available to administrators, and can they be exported to our security tooling?
- 05Is there an administrator console where data controls can be set for every account in our organisation?
- 06Where is our data processed and stored, and can a region be chosen?
- 07Can we hold the encryption keys for our data?
- 08Do you hold a current SOC 2 Type II report covering this product, and can we have it under NDA?
- 09Is this product in the scope of an ISO/IEC 27001 certificate? Please share the certificate and scope statement.
- 10Do the statements on your public pages apply to our contract as written, or do negotiated terms override them?
Questions about Gemini
- Does Gemini train on your data?
- It depends on the plan and on a setting. The vendor states that inputs are not used for training unless the customer opts in on Gemini in Google Workspace (work or school account). On Gemini app with a personal Google account, a setting controls whether inputs are used for training; the pages read do not state its default in a sentence that could be quoted. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
- Is Gemini safe to use at work?
- GhostAudit does not rate tools. Whether Gemini is acceptable for your company depends on the plan you hold, the data people put into it and your own policy. This page records what the vendor states, with the wording and the source, so that decision can be made on facts: Gemini app with a personal Google account: depends on a setting and Gemini in Google Workspace (work or school account): only if the customer opts in (training on customer data).
- How long does Gemini keep data?
- The vendor states: With Keep Activity off: 72 hours. Reviewed chats: up to three years. This is the default the vendor's page describes for one plan; other plans may differ, and the table on this page shows each.
- Which attestations does the vendor of Gemini state?
- The vendor's pages state: ISO/IEC 42001 and FedRAMP. This is the vendor's statement, with the page linked; GhostAudit has not audited the vendor, and the scope by product is on the vendor's page.
- When were these facts checked, and how do I report an error?
- The vendor's pages were read on 12 Nov 2026. Every quotation was checked against the stored text of its source page on that date. To report an inaccuracy, email [email protected] with the page that shows the current wording.
How this page was made, and how to correct it
Every fact above is a statement found on a page Google itself publishes. The page was fetched and reduced to text, the statement was recorded with its exact wording, and the quotation was checked against the stored text of the page. Quotations are at most 25 words. Search results, blogs and third-party summaries were not used.
These are summaries of statements the vendor publishes, as read on the date shown. They are not legal advice, not an assessment of the vendor and not an endorsement. Vendors change their terms: open the linked source and check your own contract before you rely on a statement.
Found an error, or are you the vendor? Report an inaccuracy with the page that shows the current wording. The page is re-read; the fact, its quotation and its date are corrected, or the fact is set to unknown if the page cannot be opened. The full method.
The vendor's official pages
- Privacy policypolicies.google.com
- Data processing agreementcloud.google.com
- Subprocessorsworkspace.google.com
- Trust centrecloud.google.com
Gemini is a product of Google. GhostAudit is not affiliated with, endorsed by or sponsored by Google.
Is Gemini in use at your company, and on which plan?
GhostAudit shows which AI tools your people use, from Google Workspace or Microsoft 365 and from the browser, and sets each one beside the terms on this page. It records tool names and time, never prompts.