Gemini (Google)

Does Google use your Gemini chats to train its models? It depends entirely on whether you are in consumer Gemini or Gemini inside Google Workspace, and the gap between the two is the widest in this database.

Important: there are three different Geminis

Google ships three products under the Gemini name and they have materially different privacy postures. This is the single most common source of confusion in this database.

Consumer Gemini (gemini.google.com, Gemini Apps in Android, the Gemini side panel when you use it from a personal Google account). Training is on by default. Conversations retained for up to 18 months. Samples may be reviewed by human reviewers; reviewed conversations are kept for up to three years.

Workspace Gemini (the Gemini features inside paid Google Workspace plans — Gmail, Docs, Drive, Calendar, Meet when accessed from your work account). Training is contractually excluded by default. No human review. Data stays inside your organisation.

When SMB owners say "I use Gemini at work," they usually mean one of these and often do not know which. The distinction matters because the protection levels are different by an order of magnitude.

Meet the third Gemini: Gemini Enterprise app

Separate again from both of the above is Gemini Enterprise app (cloud.google.com/gemini-enterprise) — a standalone agentic AI platform sold through Google Cloud, not a Workspace feature. It’s a chat interface plus prebuilt and custom AI agents (Workflow Builder, an enterprise version of Gemini Notebook, Deep Research) that connects out to Microsoft 365, Google Workspace, Drive, SharePoint, HubSpot and Jira. Google itself describes it as complementary to Workspace, not part of it — you would buy this in addition to, not instead of, your Workspace plan.

Pricing: Business from US$21/seat/month (up to 300 seats), Standard/Plus from US$30/seat/month (a starting point only — the full price requires contacting sales), and a Pay-as-you-go tier at $0 seat fee billed at standard model API rates (20+ seats, limited rollout). Unlike every other Google surface in this profile, pricing here is USD-only with no NZD conversion published.

Training position: Google’s own FAQ states, unconditionally, across all editions: “You own your data, not Google. Your data — including prompts, outputs, and training — isn’t used to train Google models or models for any other customer.” This is a flatter, less-hedged claim than Workspace Gemini’s own “without your permission” phrasing above.

Security controls differ by edition: Model Armor (prompt-injection and unsafe-content screening) is named for all editions, but VPC Service Controls, customer-managed encryption keys, Access Transparency and data residency — the controls typically needed for HIPAA- or FedRAMP-type compliance — are only available on Standard and Plus, not on Business.

Still not established: a dedicated privacy or data-processing document beyond that single FAQ line; a single headline retention figure comparable to Workspace Gemini’s 90-day-to-indefinite range — though as at 20 September 2026 Google does publish specific per-feature retention periods for this platform: grounding-with-Google-Search logs kept three days and not disableable, grounding-with-Google-Maps thirty days and not disableable, in-memory caching on a 24-hour TTL that can be switched off per project, request-and-response logging off by default, and CodeMender session data up to seven days. Zero data retention is achievable but only by customer configuration, and Google states plainly that it may not be possible when using some Advanced AI features; and whether the third-party connectors (Microsoft 365, HubSpot, Jira, SharePoint) create their own subprocessor exposure — Google’s own subprocessor lists do not name any of those companies, most likely because the connectors work outward under the customer’s existing credentials rather than Google routing data through them, but that is our inference, not a confirmed fact.

This product is now scored. Updated 20 September 2026, against three Google primary documents read that day, two of them last updated 18 September 2026. Gemini Enterprise app is rated as two tier-units on our 1-to-10 safety scale: the Business edition at USD 21 per seat, and Standard/Plus at USD 30. Our ratings are not yet published. It does not inherit either the Consumer or the Workspace Gemini score.

Standard and Plus rate higher than Business, and the reason is controls. Customer-managed encryption keys, VPC Service Controls, Access Transparency, audit logging, data residency and HIPAA are Standard and Plus features, and Google’s documentation for those editions says user-requested data is deleted within 60 days. Business edition’s own help centre says its protections are pre-configured by Google with no administrator settings, and that it cannot restrict where data is stored or processed. Corrected 3 October 2026: this paragraph previously said the two editions scored identically. We had applied documentation for Google’s developer platform to the Business edition.

And neither edition can reach the top of our scale, because our training criterion asks whether the vendor trains on customer content on any tier, and consumer Gemini trains by default. That is a judgement about Google as an organisation rather than about this product. A buyer on Gemini Enterprise app is genuinely not trained on: the Training Restriction in Google’s Service Specific Terms states that Google will not use your data to train or fine-tune any AI or ML models without your prior permission or instruction, and that is a contractual term rather than a support-page policy.

Plain-English risk rating: 3 of 5 (consumer Gemini) / 1 of 5 (Workspace Gemini)

We have split this into two ratings because the products are genuinely different.

Consumer Gemini sits at 3, similar to ChatGPT consumer and Claude consumer — training is on by default, opt-out exists but is buried, and the retention window is longer than competitors. Workspace Gemini sits at 1 (lowest risk) because the contractual no-training default, no-human-review default, and integration with existing Workspace access controls are genuinely the most privacy-protective configuration of any consumer-grade AI in this database.

Recommended for

  • Sole proprietor on a personal Google account: Turn off Keep Activity in Gemini. Use Temporary Chat for anything sensitive. Or upgrade to a Workspace Individual plan
  • Small team (2-10 people): Workspace Business Standard or higher includes Gemini at no extra per-seat cost as of 2025. This is the best privacy-to-cost ratio in this database for SMB owners
  • Regulated industry: Vertex AI through Google Cloud, with Zero Data Retention enabled on eligible endpoints. The Workspace tier is also acceptable for most regulated SMB use
  • The honest answer for most 1-10 employee businesses already using Google Workspace: You are probably underusing the Gemini features inside Workspace. They are private by default, included in your existing plan, and respect your existing file permissions. The thing to avoid is letting employees use the consumer Gemini app for work tasks

Data retention default

Consumer Gemini:

  • Conversations retained for up to 18 months by default
  • Samples reviewed by human reviewers
  • Conversations reviewed by humans retained for up to three years
  • Setting: the Keep Activity control on your Gemini Apps Activity page (myactivity.google.com/product/gemini). Auto-delete can be set to 3, 18 or 36 months, or Keep Activity turned off. With it off, chats are still kept for 72 hours so Gemini can respond and protect the service.
  • Temporary Chat: not saved to your history, kept for 72 hours, not used to train Google's models

Workspace Gemini (Business, Enterprise, Education, Public Sector):

  • Prompts and responses: 90 days to indefinite, set by your admin. Google publishes this range in the Privacy Hub retention table – it is an administrator decision, not a fixed Google default, so the honest answer for any given business is whatever its own admin chose. Options include automated deletion of inactive conversations at 3 months, 18 months or 3 years, or indefinite retention.
  • The Gemini app used with a qualifying Workspace edition is a separate setting: admins choose auto-deletion at 3, 18 or 36 months, default 18. With conversation history off, chats are kept about 72 hours so the service can run.
  • Gemini Notebook (formerly NotebookLM): prompts and responses not retained after the session ends; uploaded files and notebooks follow the Cloud Data Processing Addendum.
  • Not retained for training
  • Not reviewed by humans
  • Respects existing Workspace data lifecycle controls

API / Vertex AI:

  • 30 days standard
  • Zero Data Retention available on eligible Vertex AI endpoints for qualifying customers

What actually decides which rules apply

The dividing line is the account you are signed in with, not the web address. Google’s Privacy Hub now expressly covers the Gemini app – gemini.google.com, the mobile apps and Gemini in Chrome – and Gemini Notebook, whenever they are used with a qualifying Google Workspace edition. So the same gemini.google.com that is a consumer product on a personal login is a core Workspace service, under the Cloud Data Processing Addendum, on a work login. For an SMB this is the practical control: it is not about telling staff to avoid a website, it is about making sure they are signed in with the work account when they use it.

Two carve-outs inside Workspace worth knowing

Not every Gemini surface inside Workspace sits inside the same compliance envelope, and Google says so plainly:

  • Gemini Notebook does not support ISO, SOC or FedRAMP compliance and is not covered by Google’s Business Associate Agreement for HIPAA. It is also not integrated with Workspace DLP, and your organisation’s file-sharing and data-region settings do not apply to data inside it – uploading a Drive file creates a separate copy stored outside Drive.
  • Gemini in Chrome likewise does not support ISO, SOC or FedRAMP and is not covered by the HIPAA BAA. When tab sharing is on, the tab being viewed is shared by default and Google collects the URLs and page content of selected tabs.

The no-training commitment still applies to both. The gap is certification and data-handling controls, not training. If you are in a regulated corner of your business, that distinction is the one that matters.

Training opt-out

Consumer Gemini — TRAINING IS ON BY DEFAULT. This is the same pattern as ChatGPT and Claude consumer tiers. The Google-specific quirk is that opting out requires turning off Keep Activity, which also loses you the conversation history and personalisation. For text chats you cannot opt out of training while keeping your chat history: one setting controls both. (A separate setting covers audio, Gemini Live video and screen sharing.) Even with Keep Activity off, chats you send feedback on can be used for training. ChatGPT and Claude allow you to retain history while opting out; Gemini does not.

The setting is Keep Activity, on the Gemini Apps Activity page. Google renamed it from “Gemini Apps Activity”; the activity log keeps the old name (Gemini Apps Privacy Hub, privacy questions updated 23 October 2026).

Workspace Gemini — TRAINING IS OFF BY DEFAULT. No user-side toggle needed. The contractual exclusion is automatic for Workspace Business and Enterprise plans. Admins can further restrict Gemini access per organisational unit through admin.google.com → Apps → Google Workspace → Gemini.

Important quirk: If a Workspace user manually grants the consumer Gemini Apps access to their Workspace content from a personal Google account, that pulls the data into the consumer training pool. Workspace admins should disable cross-account integration to prevent this.

Zero Data Retention (ZDR) availability

  • Vertex AI only (Gemini accessed through Google Cloud Platform)
  • Available on certain endpoints, by request, for qualifying enterprise customers
  • Not available for consumer Gemini or Workspace Gemini features (Workspace Gemini's defaults already exclude training, but the data is still retained per standard Workspace retention)

Plan tiers and pricing (read 24 October 2026)

TierPriceTraining on your data?Suitable for
Gemini (free)$0Yes, unless opted outPersonal experimentation only
Google AI Plus, Pro and Ultra (formerly Gemini Advanced / Google One AI Premium)US$4.99, US$19.99 and from US$99.99 a month (US prices; Google's subscriptions page)Yes, unless opted outPersonal use; not appropriate for client work without opt-out
Workspace Business StarterNZ$10.50 a user a month on an annual plan, NZ$12.60 flexibleNo, contractually excludedVery small teams; Gemini in Gmail and a limited assistant only
Workspace Business StandardNZ$21 annual, NZ$25.20 flexibleNo, contractually excludedSmall teams (best value for most SMBs); Gemini in Docs, Sheets, Drive and Meet
Workspace Business PlusNZ$33 annual, NZ$39.60 flexibleNo, contractually excludedSmall teams needing eDiscovery, advanced security
Workspace EnterpriseContact salesNo, contractually excludedLarger organisations
Vertex AIPay-per-tokenNo, by defaultDevelopers, custom applications

Note: Google bundled Gemini into Workspace plans during 2024-2025, eliminating the previous separate Duet AI / Gemini for Workspace add-on. Pricing above reflects the bundled state.

Jurisdiction

  • Primary processor: Google LLC, Mountain View, California, USA
  • Cloud infrastructure: Google Cloud Platform
  • Workspace data regions: Business Standard and Plus, Enterprise Standard and Plus, and some Education and Frontline editions can keep covered data in the United States or Europe. There is no Australian or New Zealand option (Google admin help, updated 22 October 2026). Corrected 24 October 2026: we previously said this was an Enterprise-only option with a choice of specific regions.
  • For Vertex AI, data processing region is configurable when the project is created

Breach history (public incidents)

February 2024 — Gemini chats indexed in Google Search Shortly after Gemini's public release, Google's own web crawler indexed publicly-shared Gemini conversations. The cause was a missing robots.txt file in the root directory of the gemini.google.com subdomain. Users who had created shareable links to their conversations (a feature Gemini provides) had those conversations appear in Google search results until Google added the robots.txt directive. Conversations contained personal information, work content, and in some cases sensitive material that users had not intended to be publicly searchable. Source: The Cyber Express; New Design Group analysis, February 2024

August 2025 — SafeBreach Calendar prompt injection demo SafeBreach researchers demonstrated a prompt injection attack where a malicious Google Calendar invite could be used to hijack Gemini's agentic capabilities and exfiltrate sensitive data. The malicious instructions were embedded in calendar event titles or descriptions; Gemini, when summarising the user's calendar or processing event content, would execute the embedded instructions as if they were from the user. Source: SafeBreach research, August 2025

January 2026, Gemini Calendar data leak (research demonstration) Researchers at Miggo Security showed that a malicious Calendar invite could make Gemini leak a user's private Calendar data, a pattern close to the August 2025 SafeBreach demo. BleepingComputer (20 January 2026) reported no sign it had been exploited in real attacks. Corrected 24 October 2026: we previously said it was observed in the wild. Google added mitigations after the report; the broader architectural challenge of trusted-content boundaries in AI agents that read user data remains open. Source: BleepingComputer, January 2026

Ongoing 2025-2026 — Indirect prompt injection in Workspace features A broader pattern across Gmail summarisation, Docs analysis, and Drive search features has been the subject of multiple security research disclosures. The shared vulnerability: when Gemini reads user data (emails, documents) that contains content from external senders, the external content can include instructions that Gemini will follow. Google has implemented several rounds of mitigation. The fundamental problem — that LLMs cannot reliably distinguish "this is data I should summarise" from "this is an instruction I should follow" — is an industry-wide architectural challenge, not Google-specific.

Note on infrastructure: No public confirmed breach of Google's core Gemini infrastructure (the model serving infrastructure or training pipeline) has been reported as of May 2026. The incidents above are application-layer issues (search indexing, prompt injection in features) rather than core platform breaches.

What this means in plain English for SMB owners

Three honest takeaways:

  1. If you use Google Workspace for your business and you are not yet using the Gemini features inside it, you are probably leaving a privacy advantage on the table. Workspace Gemini is the most privacy-protective AI option in this database that is also genuinely productive for everyday SMB work. It costs nothing extra on most Workspace plans.
  1. If your employees use the consumer Gemini app for work tasks while logged into a personal Google account, you have an undocumented data exposure. Their work prompts are being retained for up to 18 months, are subject to human review, and are training Google's consumer model unless each employee has individually opted out. This is the Workspace-equivalent of the ChatGPT Plus / Claude Pro trap.
  1. Gemini's agentic features (reading your calendar, summarising your inbox, taking actions on your behalf) are where the interesting new attack surface lives. Three public research demonstrations have shown that Gemini will follow instructions hidden inside data it is asked to read; none has been reported exploited in real attacks. Until this category of vulnerability is structurally solved, treat any AI agent with access to your inbox as a potential exfiltration vector. Restrict agentic features to trusted contexts.

Sources

  • Generative AI in Google Workspace Privacy Hub: https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub (page last updated 26 May 2026; verified 2026-08-11). Note the canonical URL moved from /admin/gemini/ to /admin/generative-ai/.
  • Google Workspace Service Specific Terms, Training Restriction section: https://workspace.google.com/terms/service-terms/ – the contractual basis for the no-training position (verified 2026-08-11).
  • Google Workspace blog: Gemini for Workspace announcement (verified 2026-05-22)
  • Google Cloud, Gemini Enterprise app product and pricing page: https://cloud.google.com/gemini-enterprise (verified 2026-09-11/12)
  • Terms.Law: Google Gemini Output Ownership 2026 (March 2026)
  • Anarlog.so: Google Gemini data retention policy (March 2026)
  • i10x.ai: Gemini Training Data Consumer vs Enterprise (November 2025)
  • Technerdo: How to Stop Gemini Training (2026)
  • mePrism: Gemini opt-out guide (2026)
  • The Cyber Express: Google Gemini AI data leak (February 2024)
  • New Design Group: Why did Google Gemini leak chat data (February 2024)
  • BleepingComputer: Gemini tricked into leaking Google Calendar data (January 2026)
  • LayerX Security: Gemini Data Breach analysis (December 2025)
  • Fello AI: How to Stop AI from Training (2026)
  • Gemini Apps Privacy Hub: https://support.google.com/gemini/answer/13594961 (privacy questions updated 23 October 2026; read 24 October 2026)
  • Google AI subscriptions: https://gemini.google/subscriptions/ (read 24 October 2026)
  • Google Workspace pricing, New Zealand: https://workspace.google.com/intl/en_nz/pricing.html (read 24 October 2026 from New Zealand)
  • Google Workspace admin help, Choose a geographic location for your data (updated 22 October 2026; read 24 October 2026)
  • BleepingComputer: Gemini AI assistant tricked into leaking Google Calendar data (20 January 2026; read 24 October 2026)

Related on AI Leakage

Compare similar tools: Gemini (Google) is one of 6 tools in AI chat assistants compared, which sets out each one’s rating and what it does with your data, side by side.