All engagements conducted under NDA·Evidence preserved to technical chain-of-custody standards·Engagements limited to qualified organizations

Free scanThe studyForensic TriageForensic AuditAI VendorsResearch
Free scan · no install

Does Google Gemini train on your data — and what survives when you delete a chat?

Gemini app (Free, AI Plus, Pro & Ultra): No BAA · Used to develop Google products and machine-learning technologies · Human-reviewed chats retained up to three years and not deleted when you delete your activity

Gemini API: BAA not addressed in these terms · Unpaid tier used for product improvement, with human reviewers; paid tier not used · Paid logs kept a limited period

Gemini app - Free, Google AI Plus, Pro & UltraGemini API - unpaid vs paid tier
HIPAA BAANoGoogle's BAA covers Google Workspace and Cloud Identity services and must be accepted by an admin; the consumer Gemini app tiers are not Workspace servicesNot publicly stated in the Gemini API termsGoogle's BAA is offered through Google Workspace and Cloud Identity, not addressed in these terms
Trains on your dataYes"Google uses this data to provide, improve, and develop Google products, services, and machine-learning technologies"; a subset of chats is also read by human reviewersDepends on tierunpaid: yes, "Google uses the content you submit... to provide, improve, and develop Google products and services", with human reviewers who "may read, annotate, and process your API input and output". Paid: no, "Google doesn't use your prompts... or responses to improve our products"
Survives deletionYesexplicitly - "Chats reviewed by human reviewers... are not deleted when you delete your activity. Instead, they are retained for up to three years." Default activity auto-deletes at 18 months (changeable to 3 or 36 months or off); temporary chats 72 hoursPaid - "Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy"; period not stated. Unpaid - no retention period stated
Deployer / admin log accessNodocumented deployer access - consumer accounts are individual, not admin-managed; no employer audit or eDiscovery path is published for these tiersNot publicly stated in the API terms
Third-party attestationNot publicly stated for the consumer Gemini app tiersNot publicly stated in the API terms
Commonly mistaken for — Gemini app - Free, Google AI Plus, Pro & Ultra

Gemini for Google Workspace, which is admin-managed and BAA-covered; paying for Google AI Pro or Ultra does not convert a consumer account into a Workspace service

Commonly mistaken for — Gemini API - unpaid vs paid tier

The paid tier - they are the same API and the same endpoint, but the unpaid tier permits training and human review while the paid tier does not. Prototyping on a free key is the exposure

Source: https://support.google.com/gemini/answer/13594961Document: Google Support - Gemini Apps Privacy HubVerified: September 1, 2026Verified by: Adil — Shadow AI Forensics
Source: https://ai.google.dev/gemini-api/termsDocument: Google - Gemini API Additional Terms of ServiceVerified: September 1, 2026Verified by: Adil — Shadow AI Forensics

Vendor terms change without notice. This page reflects what Google Gemini published as of September 1, 2026. Re-verified quarterly.

This page states what the vendor published. It does not score them.

If you need a scored Go / Conditional Go / No-Go verdict for a vendor decision — including a vendor not listed here — that's an AI Vendor Risk Assessment: three binary industry gates, nine scored criteria, four provenance fields on every finding. $997, delivered in 48 hours.

See how AVRA works →

Want all 13 tools in one file?

AI Vendor Compliance Quick-Reference

Covers 22 tiers across 13 tools — same sourcing, side by side, printable for a vendor file.