Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that fine-tuned models created using customer data are exclusive to the customer and are not shared or used to train other models, and that fine-tuning data is retained until the customer actively deletes the files.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that fine-tuning data has an indefinite retention period by default, persisting until the customer deletes the files, which differs from the 30-day default retention period applicable to standard API inputs and outputs.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This new provision addresses a specific use case with distinct data handling practices, guaranteeing model exclusivity and customer-controlled data retention for fine-tuned models.
View full change record →Under this provision, data submitted for model fine-tuning is retained on OpenAI systems indefinitely until the customer takes affirmative action to delete the files. Customers intending to limit fine-tuning data retention must actively manage and delete files through the platform.
Cross-platform context
See how other platforms handle Fine-Tuning Data Retention and Model Exclusivity and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Yes, you can adapt certain models to specific tasks by fine-tuning them with your own prompt-completion pairs. Your fine-tuned models are for your use alone and never served to or shared with other customers or used to train other models. Data submitted to fine-tune a model is retained until the customer deletes the files.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision engages GDPR storage limitation principles under Article 5(1)(e), which requires that personal data be retained no longer than necessary for the stated processing purpose. Indefinite retention until customer-initiated deletion may require justification under the storage limitation principle if the fine-tuning data contains personal data. HIPAA minimum necessary and retention standards apply to API customers processing PHI through fine-tuning. The FTC has general authority over data retention representations. (2) GOVERNANCE EXPOSURE: Medium. The indefinite retention default creates a data governance obligation for organizations to track and manage fine-tuning file deletion as part of their data lifecycle management processes. Organizations that have submitted personal data through fine-tuning without a deletion workflow may have retention periods inconsistent with their stated data minimization policies. (3) JURISDICTION FLAGS: EU and EEA customers face heightened exposure if fine-tuning data contains personal data, as indefinite retention without a defined necessity period may not satisfy GDPR Article 5(1)(e). California customers should assess CPRA service provider obligations relative to fine-tuning data retention. Healthcare API customers should assess HIPAA retention standards applicable to PHI submitted through fine-tuning. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should ensure that executed DPAs or BAAs address fine-tuning data retention and deletion obligations, including whether OpenAI will delete fine-tuning data upon contract termination or account closure. Vendor assessments should include confirmation of the deletion process and timeline for fine-tuning files. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should establish a data lifecycle management procedure for fine-tuning files, including periodic review and deletion of files no longer needed for active model maintenance. Data processing records should document fine-tuning data as a distinct retention category with an active deletion obligation. Organizations should assess whether fine-tuning data submitted to date is consistent with their stated data minimization and retention policies.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that fine-tuning data has an indefinite retention period by default, persisting until the customer deletes the files, which differs from the 30-day default retention period applicable to standard API inputs and outputs.
Under this provision, data submitted for model fine-tuning is retained on OpenAI systems indefinitely until the customer takes affirmative action to delete the files. Customers intending to limit fine-tuning data retention must actively manage and delete files through the platform.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.