OpenAI Enterprise Privacy

This document is OpenAI's Enterprise Privacy page, governing data handling practices for ChatGPT Enterprise, ChatGPT Business (Team), and the API Platform, framed as a disclosure of privacy commitments rather than a binding contractual agreement in the traditional sense. The terms state that API and ChatGPT Enterprise/Team customers' inputs and outputs are not used to train OpenAI models by default, that data submitted via the API is retained for up to 30 days for abuse monitoring before deletion unless the customer has opted into longer storage, and that enterprise customers retain ownership of their inputs and outputs. The document asserts a Data Processing Addendum (DPA) is available for enterprise customers and references SOC 2 Type 2 compliance, GDPR compliance mechanisms, and HIPAA-eligible services under a Business Associate Agreement (BAA), though the page functions as a marketing and disclosure page rather than a full contractual instrument, meaning the precise enforceability of individual commitments depends on the operative terms of service and any executed DPA or BAA. The document engages GDPR, CCPA, HIPAA, and the EU AI Act regulatory landscape; GDPR applicability is acknowledged through references to Standard Contractual Clauses (SCCs) and a DPA, while HIPAA applicability is noted as available to qualifying customers via BAA. Compliance teams should note that the privacy protections described (no training on enterprise data, 30-day retention limits) are operationally conditional on the product tier used and may not apply to free or consumer-tier users, creating a tiered data governance structure with materially different implications depending on the customer relationship.