Short answer: sometimes — but only on a paid business tier with training switched off, and never for documents containing trade secrets, regulated personal data, or anything covered by an NDA that forbids third-party processing. On the free and consumer Plus tiers, your uploads may be used to improve the model unless you actively turn training off, and even then the file sits on OpenAI's servers for a retention window you don't control.
The safe rule is simple: the sensitivity of the document must match the contractual and technical protections of the account you're using. If those two don't line up, don't paste.
## Why the tier matters more than the model
The mechanism here is data retention and training consent, not whether the AI "remembers" your file. When you upload a PDF to ChatGPT, the file is transmitted to OpenAI's servers, parsed, and stored so the conversation can reference it. Two separate questions follow: (1) will this content be used to train future models, and (2) how long is it kept?
OpenAI offers a setting that excludes your conversations from training, but that toggle is a policy control, not a technical guarantee of deletion — the data still exists on their infrastructure for abuse-monitoring purposes. According to our AI tool database, ChatGPT's consumer tiers run from a free plan on GPT-4o mini up to Plus at $20/mo and Pro at $200/mo, while business-oriented plans add administrative controls, higher retention guarantees, and a no-training default.
The consumer tiers are built for individuals; the business tiers are built for exactly this use case. That distinction is the whole ballgame.
## What actually changes on a business account
On an enterprise or team plan, the default flips: your data is not used for training, retention is contractually bounded, and an admin can enforce these settings across every seat so a single careless employee can't opt everyone into training. On a personal Plus account, the training toggle is per-user and easy to leave on.
Here's a concrete example. Say you work at a 40-person marketing agency and you want ChatGPT to summarize a 30-page client contract before a renewal meeting. On a personal Plus account ($20/mo), that contract — which almost certainly contains confidentiality terms — is uploaded under consumer terms of service, and if the training toggle is on, it may inform future model behavior.
On a ChatGPT Business seat, the same upload happens under a data processing agreement, with training off by default and an admin audit trail. Same model, same summary quality, completely different legal exposure. The summary isn't the risk; the transmission and storage are.
## Documents you should never paste, regardless of tier
Some categories are off-limits even on the best business plan, because the problem isn't OpenAI's policy — it's your own obligations. Never paste: documents containing personal data regulated by GDPR, HIPAA, or similar regimes unless your organization has a signed data processing agreement and a lawful basis; trade secrets or source code your employment contract protects; anything covered by a client NDA that prohibits disclosure to third parties without written consent; and credentials, API keys, or security configurations.
If you genuinely need a summary of a sensitive document, the workaround is to redact first — strip names, account numbers, and identifying clauses — then ask for a structural summary of the redacted version. You lose some nuance, but you keep the document on the right side of your legal obligations.
A useful tip: ask the model to summarize sections you paste individually rather than uploading the whole file, so you control exactly what leaves your machine.
## The limits of this advice
This guidance has a shelf life. Vendor policies, retention windows, and training defaults change frequently — sometimes with only an email notice — so the vendor's own documentation and your organization's legal team are the authoritative sources, not a blog post. Two other limits matter.
First, "training off" does not mean "deleted immediately"; abuse-monitoring retention still applies, so don't treat the toggle as a shredder. Second, business-tier protections only help if your company actually buys them — many small teams assume their personal accounts are covered when they aren't.
If you're unsure whether your account qualifies, the honest answer is to treat the upload as public until someone with authority confirms otherwise. For a broader walkthrough of keeping AI use private, see How to Use AI With Your Privacy Intact.