AI Data Retention Policy

A retention policy for the data that a SaaS product's AI features create and process: prompts, inputs, outputs, AI-derived values and AI system logs. Each policy item is paired with what peer software vendors publish, and the document closes with the legal and audit basis.

01Background

The company is a B2B SaaS platform. For customer data it acts as a processor, and its customers are the controllers. AI features run on commercial models reached through Microsoft Azure OpenAI, Google Vertex AI and Databricks, and through embedded analytics and text-analytics vendors.

Customer AI questionnaires now ask how long each category of AI data is kept and whether it is deleted with the customer's other data. With no single published answer, each request is answered one email at a time. A defined policy lets Compliance answer these requests without Product involvement.

02Proposed policy

Six items, each with published peer practice.

1. AI results are kept with the customer record they belong to

AI-generated content, AI-assisted edits, and AI-derived values such as sentiment and theme scores are stored as customer data. They follow the customer's data retention policy and are deleted 30 days after contract end, and from backups after 60 days.

• Medallia: "client data is never retained beyond the contractual limitation period" [1]
• Microsoft Copilot: prompts and responses "are processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365" [2]. Admins set retention or deletion through Purview [3].
• Slack: workflow summaries "will be retained in Slack according to your organization's data retention settings" [4]
• Gong: "retains customer data for up to three years or the duration of your contract — whichever is shorter" [5]
• Notion: "AI embeddings are deleted within 60 days of page or workspace deletion" [6]

2. AI system logs are kept 90 days and deleted by date

Operational AI logs are deleted automatically on a fixed period of 90 days, matching the platform log standard. Retention is set by date, not by a count of entries.

• Salesforce (Tableau AI): "stores the prompt and response for every LLM API call along with other audit data for a maximum of 30 days" [7]
• OpenAI: "abuse monitoring logs are generated for all API feature usage and retained for up to 30 days" [8]
• Anthropic: "we automatically delete inputs and outputs on our backend within 30 days of receipt or generation" [9]
• Slack: "Recap data is stored for 90 days" [4]

3. LLM providers retain nothing

Every model provider operates under zero data retention. Where a provider cannot offer it, the company discloses that provider's retention window.

• Databricks (an exception to disclose): inputs and outputs are "stored in the same region as your workspace for up to thirty (30) days" for abuse and security detection [10]
• Qualtrics: "zero data retention so customer data is used only for processing the request" [11]
• Zendesk: "'zero data retention' endpoints, meaning request and response bodies are not persisted" [12]
• Atlassian: "operate under strict zero data retention (ZDR) agreements" [14]
• Intercom: "zero data retention once an output is generated" [15]
• ThoughtSpot: "strict zero-retention and no-training contracts with LLM providers" [16]
• Sprinklr: "with zero data retention" [17]
• Notion: "For Enterprise workspaces, LLM providers use zero data retention after processing" [6]

4. Fine-tuning uses de-identified, aggregated data only

Product may retain data for as long as it is needed to improve features, provided the data is de-identified and aggregated as the customer agreement and DPA allow. Raw prompts and responses are not retained for tuning.

• Qualtrics: "Qualtrics anonymizes and aggregates customer data before it is used in any AI training." [11]
• SurveyMonkey: "we use de-identified customer data or synthetically-generated data to train and build our proprietary AI models", and that data is "deleted within a set time period after use" [18]
• Atlassian: "de-identifying and aggregating all contributed metadata before use" [14]
• Zendesk: "All data fields specific to identifiers (e.g., fields for username and email address) are excluded from the training dataset" [13]
• Google Workspace: "We do not use your Workspace data to train or improve the underlying generative AI and large language models" [19]

5. Termination deletes all AI data

On contract end, AI inputs, outputs, logs and any of that customer's tuning sets not yet aggregated are deleted on the same schedule as other customer data.

• Gong: "all data is permanently deleted 30 days after contract termination" [5]
• Intercom: "you can opt out at any time, with data deleted within 30 days" [15]
• Counter-example, HubSpot: "It is not possible to delete previously used data", and "By default, the setting will be turned on." [20] Aggregating before tuning (item 4) keeps the company out of this position.

6. Retention periods are published on the Trust Center

The periods in items 1 to 5 are published, so Compliance can answer AI retention questions directly.

• Gong [5] and Notion [6] publish their AI retention periods.
• California law requires a business to disclose "the length of time the business intends to retain each category of personal information" [23]

03Legal and audit basis

04Inputs needed to adopt

05References

Rich Sadowski · richsadowski.com
A proposal for discussion. Peer vendor statements are quoted from public pages as they read in October 2026 and may change.