Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that API inputs and outputs may be retained for up to 30 days for service provision and abuse identification, after which they are deleted unless legal retention obligations apply, and that zero data retention is available for eligible endpoints upon request for qualifying use cases.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the default data retention period for API data, the legal retention carve-out, and the availability of a zero data retention option that is conditional on endpoint eligibility and use case qualification, requiring proactive engagement by API customers to activate.
Interpretive note: Eligibility criteria for zero data retention and the definition of qualifying use cases are contained in external platform documentation referenced but not reproduced in this document, creating dependency on documentation that may change independently.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This new provision establishes specific retention timelines (30 days), purposes for retention, automatic deletion practices, and introduces a zero data retention option for qualifying use cases.
View full change record →Under this provision, API inputs and outputs are retained by default for up to 30 days. The zero data retention option is not automatic and requires the customer to request it for eligible endpoints with a qualifying use case, with the eligibility criteria and qualification standards referenced in platform documentation rather than specified in this document.
Cross-platform context
See how other platforms handle API Data Retention and Zero Data Retention Option and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Except for certain endpoints and features listed in our platform documentation, OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them. You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision engages GDPR storage limitation principles and HIPAA data minimization standards for API customers processing personal data or PHI. The 30-day default retention period and legal retention carve-out require evaluation under applicable data protection frameworks to confirm alignment with the principle of storage limitation. The FTC has general authority over representations about data retention and deletion practices. (2) GOVERNANCE EXPOSURE: Medium. The provision references endpoint-specific exceptions and eligibility criteria contained in external platform documentation rather than this document, requiring compliance teams to maintain current awareness of platform documentation changes that could affect retention practices applicable to their specific API usage. (3) JURISDICTION FLAGS: EU and EEA API customers should assess whether 30-day default retention is consistent with the storage limitation principle under GDPR for their specific processing purposes. Healthcare API customers operating under BAAs should assess whether the 30-day default retention and the legal retention carve-out are consistent with their HIPAA obligations. California API customers should assess CPRA service provider obligations relative to default retention periods. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm whether the zero data retention option is addressed in executed agreements and whether eligibility for ZDR has been assessed for all relevant API endpoint categories in use. Vendor assessments should request clarification on which endpoints are eligible for ZDR and the process for establishing qualifying use case status. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should document the default 30-day retention period and any ZDR configurations in their data processing records. Organizations processing personal data or PHI through the API should ensure that retention periods are disclosed in their own privacy notices to data subjects. Legal holds and litigation readiness procedures should account for the 30-day deletion cycle and any legal retention carve-outs that may preserve data beyond that period.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the default data retention period for API data, the legal retention carve-out, and the availability of a zero data retention option that is conditional on endpoint eligibility and use case qualification, requiring proactive engagement by API customers to activate.
Under this provision, API inputs and outputs are retained by default for up to 30 days. The zero data retention option is not automatic and requires the customer to request it for eligible endpoints with a qualifying use case, with the eligibility criteria and qualification standards referenced in platform documentation rather than specified in this document.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.