GUIDES / AI TOOLS

Privacy Checklist Before You Upload a PDF to an AI Tool

Author: AI Tools Editorial Team

AI disclosure: this article was drafted with AI assistance. No human review has taken place yet. Last updated: October 29, 2026

Uploading a PDF to a cloud-based AI tool sends its contents to the service provider, and possibly to subprocessors the provider uses, under the terms the provider sets. This checklist helps you decide whether to upload, what to change first, and what to check afterward. It does not establish that any tool is safe, and it is not legal advice.

Step 1: Decide whether the document should go at all

Do not upload a document if an applicable rule forbids it. Check your employer’s or school’s policy, any client or contract terms, and your own authority to share the content. Do not upload information about other people unless you have a right to share it.

For confidential, regulated, or sensitive documents, such as medical records, identity documents, account numbers, or unpublished business plans, ask your privacy or IT contact before uploading. A checklist cannot decide for you whether you have the right to share a document.

If you decide to upload, use a redacted copy prepared as described in Step 5.

Step 2: Identify the product tier

Privacy terms often differ between free, personal paid, and business or API plans. For ChatGPT, OpenAI’s help center describes different defaults for business and API content than for personal accounts. Find the terms for the plan you will actually use, not the company’s general page, and check the date shown on them.

Step 3: Answer six questions from the policy

Find the privacy policy and the terms for your plan. Note the date. Look for these answers:

What is kept? Does the policy cover uploaded files, extracted text, chat history, and the tool’s output?
How long is it kept? Look for a specific period. “As long as necessary” does not give one.
How is it deleted? Check whether deleting a chat also deletes the uploaded file. Some tools keep files apart from chats. For example, in ChatGPT, OpenAI’s help center describes files saved to the Library or Space as separate from chats, and deleting a chat does not delete them. Confirm this for the tool you use.
Is it used for training? Check the default, and how to change it.
Who receives it? Look for service providers, subprocessors, and hosting locations.
Can others see it? Some tools create shareable links. Check whether a link is private by default, and who can open it.

For ChatGPT consumer accounts, OpenAI’s help center states that deleted chats are scheduled for permanent deletion from its systems within 30 days, unless they were already de-identified and disassociated from the account or must be kept for security or legal reasons. Business or workspace accounts can follow different retention rules, so check the terms that apply to your workspace.

Step 4: Change the settings before you upload

Turn off training or model-improvement options if the tool offers them and you do not want your content used for training.
Turn off chat history if you do not need it. This changes how the product stores and shows your conversations under its own terms. It does not guarantee immediate deletion, and it does not change how uploaded files or third parties are handled.
Temporary chat modes differ by product. In ChatGPT, OpenAI’s help center describes Temporary Chat as not used to improve its models while it remains temporary, and says OpenAI may keep a safety copy for up to 30 days. If you save a temporary chat, your normal settings apply. Read each product’s own description before relying on a temporary mode.
Do not create or share a link to the document unless you intend others to open it. Check the default setting.
Sign in with the account you intend to use, and avoid uploading from a shared device.

Step 5: Reduce what you send, and verify the reduction

Covering text with a black box does not remove it. Use redaction that removes the underlying text.

Work on a copy. Keep the original unchanged.
Remove the parts you do not need, using your PDF tool’s redaction feature.
Save the redacted copy, then reopen it.
Search the file for a word or number you removed. Try to select and copy the area where it was. If the removed text can still be found, the redaction did not work.
Check the document’s properties (metadata), such as author and title fields, and clear them with your PDF tool. Check again after saving.
Upload only the redacted copy, and only the pages you need for the task.

Step 6: Delete after use

Delete the chat in the tool.
Check whether the uploaded file is stored separately, such as in a library or file list, and delete it there too.
Deleting in the app is not proof that a provider has removed its copies. Check the period the policy gives. Some policies describe a deletion window rather than immediate removal.

Step 7: Keep a record

Write down the date, the tool, the plan you used, the policy URL, and the date you checked it. Policies may change, so a record shows which version you relied on.

What this checklist cannot tell you

It cannot tell you whether a tool’s security measures are adequate for your document.
It cannot tell you whether a company will follow its policy in every case.
It cannot replace advice from a lawyer, a privacy officer, or your organization’s IT team when a document is confidential or regulated.
It does not cover rules that apply to you because of your sector or location.

Sources

OpenAI Help Center, How OpenAI handles data in consumer services. Checked October 29, 2026. Source for the difference in training defaults between business or API content and personal accounts.
OpenAI Help Center, Chat and file retention in ChatGPT. Checked October 29, 2026. Source for the 30-day deletion window for deleted chats, its exceptions, and the separate handling of files saved to the Library or Space.
OpenAI Help Center, Temporary chat in ChatGPT. Checked October 29, 2026. Source for the description of Temporary Chat and its safety copy of up to 30 days.