Training means using your data to change a model, so that what it learned can shape answers for other customers. Inference is a model processing your data to answer your own request, which every AI tool does. Retention is how long prompts, outputs and copies of your data are kept afterwards. Zero data retention means the model provider stores nothing once the answer is returned.

Check your CRM's own AI first. HubSpot's documentation says it "may use customer data" to "train and improve HubSpot's own AI models", with the setting on by default (HubSpot, updated 8 September 2026). Salesforce, Pipedrive and Attio say they don't. OpenAI, Anthropic and Google don't train on business data by default, but their free plans can. Training is also only one of five questions to ask before you connect an AI tool to your CRM.

Does the AI built into your CRM train on your data?

HubSpot's documentation says it may use customer data to train its own AI models, such as those behind deduplication and search, with the setting on by default. Opting out only applies going forward. Salesforce, Pipedrive and Attio say they do not train on customer data, though each words it slightly differently. None of the four lets its AI providers train on the data.

Checked against each vendor's own pages on 6 October 2026:

CRMTrains its own AI on your data?Lets its AI providers train on it?
HubSpotYes, by default. A Super Admin can turn off "AI Model Training", but opt-outs only apply going forwardNo
SalesforceDoes "not currently" use customer data to train generative AINo
PipedriveNot "without your permission"No
AttioNo, in a policy Attio says is "not intended to be contractual"No

HubSpot is the outlier. Its documentation, updated 8 September 2026, names models such as CRM deduplication, search and the business card scanner. It says some models "are trained on data across many customer accounts", while your contacts, deals and communications are not shared with other customers.

Attio's wording is a reminder to check where a promise lives. A policy page explains intent, and only the contract binds the vendor.

The AI rarely decides what happens to your data. The contract does.

How do I turn off HubSpot AI model training?

A Super Admin turns off the AI Model Training switch in HubSpot's AI settings. The opt-out only applies going forward. HubSpot says "It is not possible to delete previously used data from trained models." Accounts with HubSpot's Sensitive Data setting turned on are already opted out and can't opt in.

  1. Sign in as a Super Admin. Only Super Admins can change AI settings.
  2. Open the settings. Click the settings icon in the top navigation bar.
  3. Go to the AI settings. In the left sidebar, open Account Management, then AI.
  4. Open the Access tab.
  5. Turn off AI Model Training. Your team keeps access to HubSpot's AI features, and the change is recorded in the account's audit log.

Steps from HubSpot's AI settings guide, updated 8 September 2026.

Do ChatGPT, Claude and Gemini train on your data?

Not on their business and API plans, by default. OpenAI, Anthropic and Google all say they do not train on business customers' data unless the customer agrees. Their free and consumer plans are different: chats can be used for training, depending on the user's settings. The protection comes from the plan your team is on, not from the model.

Checked against each provider's own pages on 6 October 2026:

ProviderBusiness and API plansFree and consumer plansRetention on the API
OpenAINo training by defaultChatGPT may train on chats unless you turn off "Improve the model for everyone"Up to 30 days; zero retention for eligible use cases
AnthropicNo training by default, except conversations you rate with feedback buttonsFree, Pro and Max users choose; opting in means chats are kept for up to five yearsDeleted within 30 days; zero retention available
GooglePaid Gemini API: prompts and responses not used to improve productsUnpaid Gemini API may use content and allow human review, but in the EEA, Switzerland and the UK the paid terms apply anywayKept "for a limited period" to detect abuse

All three providers protect business data by default, and the gaps sit in the free plans. Microsoft says the same of Microsoft Copilot and Azure OpenAI: prompts and responses are not used to train foundation models without permission.

The practical risk is the free column. When a rep pastes deal notes into a personal ChatGPT account to draft a follow-up, the business-plan promises don't apply. In Cisco's 2024 Data Privacy Benchmark, 48% of 2,600 privacy and security professionals said they had entered non-public company information into generative AI tools.

Why isn't training the only question?

Because your data can leave your control without ever training a model. Providers that never train can still keep prompts and outputs for weeks, and terms can change after you sign. A connected tool can also read whatever its permissions allow. Retention, change and access matter as much as training.

What is kept, and for how long. A provider that never trains can still keep your prompts. OpenAI holds API abuse-monitoring logs for up to 30 days, "unless longer retention is required by law" (OpenAI). Zero data retention is something you ask for and get in writing.

What can change. Slack still analyzes customer messages and files to build non-generative models, such as emoji and channel suggestions, and a workspace opts out by emailing Slack.

HubSpot's terms take effect the next business day after a revised version is posted. On 1 July 2026, a revision let enrichment data, such as business contact details and employer information, be shared with other customers unless an admin opted out. After a customer backlash, HubSpot withdrew it on 5 July. "We will not move forward with the terms of service changes," its chief product and technology officer wrote (CMSWire, 6 July 2026). A good answer today lasts only as long as the notice period.

What the tool can touch. An AI tool connected to your CRM reads what its permissions allow, and agentic tools write as well. Check which objects and fields it can reach before you approve the connection.

Is it legal under GDPR to connect AI to your CRM?

Yes, with the right contract. CRM contacts are personal data even when they are work contacts, so any AI tool that processes them needs a data processing agreement. Training a model on that data is a separate purpose, which has to be stated and justified. For a European team, a vendor's answer on training is a compliance question.

The UK regulator says a work contact "will constitute personal data even if they are acting in their business capacity" (ICO). The European Data Protection Board published Opinion 28/2024 in December 2024. It warned that a model developed with unlawfully processed personal data could affect the lawfulness of how it is used.

What should you ask before you connect an AI tool to your CRM?

Ask five questions and get the answers in the contract or data processing agreement, not on a web page. Does anyone in the chain train on our data? What is kept, and for how long? Where is it processed, and by whom? What can the tool read and write? How much notice do we get before the terms change?

  1. Training. Do you, or any model provider you use, train or fine-tune on our data? Does that include feedback ratings and beta features?
  2. Retention. What do you and your providers keep, for how long, and do you have zero data retention with every model provider?
  3. Location. Where is our data stored and processed, and which subprocessors touch it?
  4. Access. What can the tool read and write in our CRM, and can we limit it by object and field?
  5. Change. How much notice do we get before these terms change, and what happens to our data if we leave?
This weekIf you run HubSpot, have a Super Admin decide on AI Model Training in the AI settings.
This monthFind out which reps paste CRM notes into personal AI accounts, and give them a business-plan alternative they will use.
Every new toolSend the five questions, and file the answers with the data processing agreement.

Start with the tools already connected to your CRM, not the next one you buy.

Frequently asked questions

On ChatGPT's consumer plans, OpenAI may use your conversations to train its models unless you turn off "Improve the model for everyone" in settings. On ChatGPT business plans and the API, OpenAI says it does not train on your data by default. API inputs and outputs can still be kept for up to 30 days unless zero data retention has been agreed.
On Anthropic's commercial products, including the API and Claude for Work, inputs and outputs are not used for training by default, except conversations you rate with the feedback buttons. Consumer users on Free, Pro and Max choose whether their chats are used for training. For how a general assistant like Claude compares with a sales tool on data, see Spiich vs Claude.
Yes, unless a Super Admin turns it off. HubSpot's documentation says it may use customer data to train its own AI models, such as those behind deduplication and search, and that the "AI Model Training" setting is on by default. Opting out only applies going forward, because previously used data cannot be deleted from trained models. HubSpot says the data is not shared with other customers, and it does not let third-party AI providers train on it.
It can be. CRM contacts are personal data even when they are work contacts, so the AI tool needs a data processing agreement, and training a model is a separate purpose that must be stated and justified. Check where the data is processed, which subprocessors are involved, and whether the vendor or its model providers train on it.
No. Spiich never uses customer content to train or fine-tune AI models, and its terms say so. Every model provider Spiich uses contractually commits to zero data retention and to never training on customer data. Spiich is ISO 27001 certified and offers optional EU data residency, as set out in the Trust Center.