How to Read an AI Tool's Privacy Policy in 5 Minutes (A Guide for Small Business Owners)

To read an AI tool's privacy policy in five minutes, skip the legal text and search the page for six words: training, retention, human review, service provider, delete, and business. Every answer an owner needs about their documents sits near one of those words.

TL;DR: Open the privacy policy, press Ctrl+F (Cmd+F on a Mac), and search the six words in the order below. Each word answers one question: does the tool learn from my files, how long does it keep them, can a person read them, who else touches them, can I remove them, and does my plan have different rules. Two sentences per word are enough to decide. For the documents you send to clients, a narrow tool like DocsAura, an AI document design tool, works on one finished file at a time, so there is very little policy to read in the first place.

Most owners never open these policies, and the reason is fair. The documents run to thousands of words, they are written by lawyers for lawyers, and the AI tool you want to try is already open in the next tab. This guide gives you a short route through the text so the check takes less time than the tool's sign-up form.

How to Read an AI Tool's Privacy Policy: The Six-Word Test

Policies bury their real commitments in a small number of sentences. Marketing pages describe the product, and the policy describes what the company is allowed to do with your files. Privacy reviewers who compare AI providers recommend the same shortcut: look for the words training, retention, human review, service provider and delete, because these terms reveal much more about a tool than its product banner does.

Open the policy, search for each word, read the two or three sentences around the match, and write down a one-line answer. The sections below show what to look for.

1. "Training": does the tool learn from my files?

This is the question most owners care about. You want a sentence that says your content is not used to train the provider's models, or a setting that turns training off.

The answer often depends on the plan. Anthropic's consumer terms, for example, let free, Pro and Max accounts opt in or out of training, and the company says business products such as Claude for Work and the API fall under separate commercial terms. OpenAI states that business data from ChatGPT Enterprise, ChatGPT Team and the API is not used for training by default.

Good answer: "We do not train on your content" or "training is off unless you turn it on." Red flag: Training is on by default and the opt-out is buried in a settings menu you have to find yourself.

2. "Retention": how long do they keep it?

Retention is the period a provider stores your files after you finish with them. A short period (30 days or fewer) is common for abuse monitoring. A long one is common when you agree to training. Anthropic's consumer policy shows the spread clearly: 30 days if you decline training and up to five years if you allow it.

Good answer: A stated number of days, ideally 30 or fewer, with a way to shorten it. Red flag: "As long as reasonably necessary" with no number and no deletion control.

3. "Human review": can a person read my files?

Look for sentences about who can access your content. Many providers allow staff to read a flagged sample for safety or support. That is normal. What matters is whether the policy says when, and whether you can restrict it.

Good answer: Access limited to named purposes such as security or support, with a statement that staff access is logged or restricted. Red flag: Broad wording like "to improve our services" with no limit on who sees the content.

4. "Service provider" or "subprocessor": who else touches it?

Most AI tools run on another company's model. When you upload a document to a design tool, it may pass to a model provider and a cloud host as well. The policy names these under "service providers," "subprocessors" or "third parties."

Good answer: A named list or a plain statement that providers are bound by the same no-training terms. Red flag: "We may share your information with partners" with no description of what partners do.

5. "Delete": can I remove my files?

Search for the words delete, deletion and "your rights." You want a sentence that says you can delete your content and a timeframe for when it leaves their systems. A common pattern is removal from your account at once and permanent deletion within 30 days.

Good answer: A delete button plus a stated purge window. Red flag: Deletion only on request by email, with no timeframe.

6. "Business" or "enterprise": do paying plans change the rules?

The same company often runs two sets of rules, one for free personal accounts and another for paid business plans. Search for "business," "team" or "commercial terms" and read what changes. Owners who test a tool on a free personal account and then run client work through it have often tested the wrong set of rules.

Good answer: A clear statement of which plan carries which promise. Red flag: No mention of plans at all, which usually means one policy covers everything, including the weakest case.

What we found: the DocsAura Six-Word Policy Scorecard

We built a simple 0-6 scorecard from the test above. Give a tool one point for each word where the policy gives a good answer in plain language, and zero where the answer is missing or a red flag.

Scoring takes about five minutes per tool. A tool with a missing answer on retention or training scores low whatever its design looks like, because those two words carry the most risk. You can run the scorecard on any tool you are weighing, and keep the result in a one-line note beside the tool's name.

Three Things the Policy Cannot Tell You

A privacy policy states what a company promises. It leaves a few questions for you to settle.

What you upload. The policy covers how the tool treats your file. The contents of the file are your decision. Names, home addresses, payment details and ID numbers stay out of general AI tools on every plan. The guide on what to redact before uploading a document to AI lists the exact fields.

What your clients expect. Some client contracts and NDAs restrict where documents can go. Read those terms before the tool's terms. The articles on using AI on documents covered by an NDA and whether AI trains on your business documents cover the most common cases.

Who else on your team uses it. The policy applies to every account. If three people use three different free accounts, you have three different sets of rules. A short written rule fixes this, and the AI policy template for small business shows what to put in it.

How to Shortcut the Whole Check

The six words take five minutes once. The check gets shorter every time you can narrow what the tool does.

A broad AI assistant accepts anything you type, so its policy has to cover every kind of content. A tool built for one task covers one kind of content. DocsAura, an AI document design tool, takes one finished document (a DOCX or PDF you already wrote) and returns a designed web page in about two minutes. It has no chat history to review, no connected inbox and no workspace to configure. The data in play is the file you hand it, and you choose which fields stay in that file before you upload.

That narrow scope turns the policy check into a short one: read the training, retention and delete answers, confirm they match what you need, and go.

Your Next Five Minutes

Pick the AI tool you use most, open its privacy policy, and run the six words. Write a one-line answer for each and add up the score. If it lands at five or six, you have your answer. If it lands lower, you have a specific reason to change plans or tools, and a short list of questions to put to the vendor.

Then take the lowest-stakes client document you have, last month's project update or a quote that already went out, and drop that one file into DocsAura, the AI document design tool built for single documents. You choose what goes in, nothing needs setting up, and you can see what comes back in about two minutes.