OpenAI Data Retention Policy (2026): What They Keep, and For How Long

Short answer — which OpenAI are you actually using?

• ChatGPT Free / Plus / Pro → your conversations may be used to train models unless you opt out. Deleted chats leave within 30 days.
• ChatGPT Business / Enterprise / Edu → no training by default, admin-controlled retention, deleted conversations gone within 30 days.
• The API with your own key → no training since March 2023, up to 30 days of abuse logs, several endpoints with zero retention, and Zero Data Retention available if OpenAI approves you.
• Nothing at all → possible for meeting notes specifically, because transcription and summarisation both run fine on-device.

I make Humla, a Mac meeting notetaker that can use an OpenAI key or no cloud at all, so I have an obvious interest in this topic. Everything below is quoted or paraphrased from OpenAI's own documentation, checked 28 July 2026, with links so you can verify it yourself rather than take my word for it.

The three products people mix up

Almost every confused argument about "OpenAI keeping your data" comes from treating ChatGPT and the API as one thing. They aren't, and the difference is the whole answer.

Source: OpenAI's Enterprise privacy page (updated 8 January 2026), the data controls guide, and the ChatGPT help centre articles on chat retention and training. Checked July 2026.

Two consequences worth internalising:

Pasting a client transcript into ChatGPT is not the same as sending it through your API key. In the consumer app, the help centre is blunt: "ChatGPT, for instance, improves by further training on the conversations people have with it, unless you opt out." Through the API, the platform docs are equally blunt in the other direction: as of 1 March 2023, data sent to the API is not used to train or improve OpenAI models unless you explicitly opt in.

"Deleted" has an asterisk. A deleted ChatGPT chat is removed from your account immediately and scheduled for permanent deletion within 30 days — unless it has already been de-identified and disassociated from you, or OpenAI must keep it for security or legal reasons. The de-identification carve-out is the one people miss. Temporary Chat is cleaner: those are deleted within 30 days automatically and aren't used for training.

The API retention table, endpoint by endpoint

This is the part that actually answers "what happens to my data," and it's more granular than the summaries floating around. OpenAI publishes a per-endpoint table in its data controls guide. The rows that matter if you're building or using anything that handles speech and text:

From OpenAI's data controls guide, read 28 July 2026. Verify before relying on it — this table changes.

Three things jump out.

Whisper-style transcription is the least-retained thing OpenAI offers. Audio sent to /v1/audio/transcriptions generates no abuse-monitoring logs and no stored application state. Not thirty days — none. That is a stronger commitment than the one covering the text you send to a chat model, and it's the opposite of what most people assume about uploading a recording of a private conversation.

The Responses API is the trap. Unlike /v1/chat/completions, /v1/responses retains application state for 30 days by default — the store parameter is on unless you turn it off. If you built something on the newer API without thinking about it, your prompts and completions are sitting in OpenAI's storage for a month, on top of the abuse logs. Set store: false.

Conversations and vector stores are "until deleted." Anything stateful — the Conversations API, Assistants threads, uploaded files, vector stores — is retained until you delete it, and Assistants objects are purged 30 days after you delete them. Objects you never delete are kept indefinitely. If you're indexing meeting transcripts into a hosted vector store, that's your retention policy, not OpenAI's.

Zero Data Retention is real, but it's not for you

ZDR excludes your content from abuse-monitoring logs entirely, and forces store to false on chat completions and responses. Its sibling, Modified Abuse Monitoring, does the log exclusion across all endpoints without the behaviour change.

The catch, in OpenAI's words: both are "subject to prior approval by OpenAI and acceptance of additional requirements," arranged through their sales team. This is an enterprise agreement, not a checkbox. If you're a solo consultant or a five-person agency wondering whether to tick the ZDR box — there isn't one.

Two more limits worth knowing. Even under ZDR, the stateful endpoints (Conversations, Assistants, vector stores, fine-tuning, batches, evals) still store application state. And image and file inputs are scanned for CSAM on submission; a positive classifier hit means the image is retained for manual review regardless of ZDR.

Data residency is a separate control: OpenAI offers regional endpoints including eu.api.openai.com for the EEA and Switzerland, with both storage and processing in-region. Using any non-US region requires approval for abuse-monitoring controls and a Modified Retention amendment, and endpoints in a data-residency region carry a 10% price uplift for models released on or after 5 March 2026. Useful for GDPR posture — again, only if you can get through the approval.

The court order: the premise most posts are still running on

Through most of 2025, the honest answer to "does OpenAI delete my data?" was "no, a judge won't let them." In May 2025, a preservation order in the New York Times copyright case required OpenAI to retain consumer ChatGPT and API content indefinitely, overriding the 30-day deletion policy.

That order ended. OpenAI's own statement, updated 22 October 2025: "we are no longer under a legal order to retain consumer ChatGPT and API content indefinitely. Our obligations under the earlier order ended on September 26, 2025." Deleted chats and Temporary Chats are back to 30-day deletion, and API data is deleted after 30 days.

One caveat, stated by OpenAI in the same update: a limited set of April–September 2025 user data is still stored under legal hold, accessible only to a small audited legal and security team. Conversations originating from the EEA, Switzerland and the UK are not covered going forward. ChatGPT Enterprise and Edu were excluded from the preservation order throughout, as were API customers under a ZDR amendment.

If you read an article claiming OpenAI is forced to keep your deleted chats forever, check its date. It was true; it stopped being true on 26 September 2025.

But note what the whole episode demonstrated, and this is the part that doesn't expire: a retention policy is a promise a company makes, and a court can overrule it overnight without asking either of you. That's not a knock on OpenAI — they fought it, publicly, and largely won. It's a structural fact about any data you hand to a third party.

What this means if you record meetings

Say you record a client call, transcribe it, and summarise it, all through your own OpenAI key. Here's where each artefact lands, per the table above:

1. The audio → /v1/audio/transcriptions. No logs, no stored state. The most sensitive-feeling artefact is the least retained.
2. The transcript → /v1/chat/completions to generate the summary. Up to 30 days in abuse-monitoring logs. This is your real exposure: the full verbatim text of the conversation, in a log, for a month.
3. The embeddings, if you index notes for search → /v1/embeddings. Also 30 days of abuse logs; the chunk text goes in the request.

None of it trains a model. All of it crosses a network boundary you don't control, and step two keeps a copy for a month. Whether that's acceptable depends entirely on what was said in the meeting — perfectly fine for a standup, a harder conversation if you're a therapist or a lawyer with a duty of confidentiality that no vendor policy discharges on your behalf.

There are three honest ways to reduce it:

• Use your own key rather than a vendor's cloud. Bring-your-own-key puts you on the API's terms — no training, 30-day logs — instead of whatever your notetaking vendor negotiated, and the data is under your account rather than pooled in theirs.
• Get a ZDR or Modified Abuse Monitoring agreement, if you're big enough for OpenAI's sales team to say yes.
• Don't send it. For transcription and summarisation specifically, this is genuinely practical now — not a purist's compromise.

The option of not sending it at all

This is the part where I'm biased, so treat it accordingly.

Humla is my open-source Mac notetaker. It records your mic and the call's system audio with no bot in the meeting, and it talks to exactly three OpenAI endpoints when you point it at OpenAI: /v1/audio/transcriptions for speech, /v1/chat/completions for summaries, /v1/embeddings for chat over your note history. You supply the key; it lives in your macOS Keychain; the bill is yours. So the retention analysis above is the analysis for Humla-with-an-OpenAI-key. No extra middleman, but no magic either.

The alternative is to configure it the other way: Whisper running on your Mac's GPU, offline speaker labels on the Neural Engine, and summaries and chat against a local model through Ollama. Then the retention question dissolves, because there is no request. You can also mix — per-language routing means Norwegian can go to a local model while English goes to a cloud provider, or vice versa. If you want to see how the local retrieval side works rather than trust it, I wrote up the whole FTS5 + embeddings + RRF pipeline.

The honest tradeoffs: on-device Whisper is slower than the API on a long meeting and needs a few gigabytes of model download, local summaries from a 12B model are a step below GPT-5-class output, and Humla is Apple Silicon only. And if you use a shared team workspace rather than the personal app, chat turns run server-side on Humla's EU infrastructure instead of on your Mac — a different trade, covered on the Teams page. Local isn't strictly better. It's a different set of costs, and for confidential conversations it's often the right one.

The short version

OpenAI's API retention story in 2026 is better than its reputation: no training, 30-day abuse logs, zero retention on audio transcription, and the indefinite-preservation order lifted in September 2025. ChatGPT consumer is the one to watch, because training is on by default there.

But every one of those is a policy, revisable by OpenAI or by a court. The only retention policy that can't change under you is the one where the data never left the machine. For meeting notes, that option now exists — see what runs locally and what "private" actually means here.

All facts above verified against OpenAI's published documentation on 28 July 2026. These pages change; re-check before making a compliance decision on them.