Lesson 2: Choosing Approved Tools and Following Policy

Why the tool choice matters

In Level 1 you saw what AI can and cannot do in marketing. The next question is practical: which tool are you allowed to use, and under what rules?

The same brand name can sit on top of very different terms. ChatGPT Free and ChatGPT Enterprise share a name, but they handle your data differently. An analogy may help. A personal Gmail inbox and your company's email system both send email, but only one is covered by your employer's contract, security settings and IT oversight. AI tools work the same way.

This lesson covers three things:

1. How to tell consumer accounts from business accounts.
2. How to find the rules in your AI policy that apply to you.
3. How to check a tool's current settings before you use it for work.

Task 1: Tell consumer and business accounts apart

The biggest difference between the two is whether your conversations can be used to train the vendor's models, and who controls that setting.

Consumer accounts (personal sign-up, free or paid):

• ChatGPT Free, Plus and Pro: chats can be used to improve OpenAI's models by default. You can switch this off under Settings > Data Controls > "Improve the model for everyone".
• Gemini app (personal Google account): while Keep Activity is on, conversations are saved and used to improve Google's services, and some are read by trained human reviewers. Google's own privacy hub warns users not to enter confidential information. Even with Keep Activity off, chats are kept for up to 72 hours.
• Claude Free, Pro and Max: since Anthropic's consumer terms update in 2025, each user chooses whether their chats are used for model training. If you allow it, Anthropic keeps the data for up to five years. If you don't, the standard retention is 30 days.

Business and enterprise accounts (contracted and managed by your organisation):

• ChatGPT Business and Enterprise: inputs and outputs are not used for training by default.
• Gemini in Google Workspace: content is not reviewed by humans or used to train models without permission. Admins set how long chats are kept.
• Claude Team and Enterprise: these run under commercial terms, and customer content is not used for training.
• Microsoft 365 Copilot (signed in with a work Entra ID account): enterprise data protection applies. Prompts and responses are not used to train foundation models, and they get the same contractual protections as your Exchange email and SharePoint files.

What to do: Open the AI tool you use most. Check which account you are signed in with: personal email or work email. Find the plan name in the settings. Write both down.

Rule of thumb: paying for a tool does not make it a business tool. A personal Plus or Pro subscription is still a consumer account.

Task 2: Find and apply your AI policy

Your organisation's AI policy decides what you may use. Vendor terms only describe what a tool does. Follow these steps:

1. Locate the policy. Look on the intranet, in the staff handbook, or ask IT, Legal or your line manager. If no policy exists, ask in writing which tools are approved, and keep the reply.
2. List the approved tools and account types. For example: "Microsoft 365 Copilot with work login: approved. Personal ChatGPT: not approved."
3. Note the permitted uses. Some policies allow drafting and research but ban final copy, image generation or uploading files.
4. Find the approval and review steps. Who signs off AI-assisted work before it is published?
5. Check client-specific restrictions (agencies especially). A client contract or brief may ban AI completely, allow only certain tools, or require you to disclose AI use. These rules override your agency's general policy for that account.
6. Record it. Keep a one-page summary next to your desk or in your notes.

Example: your agency approves ChatGPT Business. One pharmaceutical client's contract says no client materials may go into any AI tool. For that client, you do not use AI with their materials, even in the approved tool.

Task 3: Check current features and data settings

AI products change often. Plans get renamed, settings move and terms are updated. Don't rely on memory, a colleague's tip or an old blog post.

1. Go to the vendor's official help or privacy page. Examples: OpenAI Help Center, the Gemini Apps Privacy Hub, the Generative AI in Google Workspace Privacy Hub, Anthropic's Privacy Center and Microsoft Learn.
2. Confirm the plan. Make sure the page describes your account type.
3. Check the training and retention settings. Look at whether your data is used for training, how long it is kept, and whether humans review it.
4. Check that a feature is covered. New features, such as connectors, agents or image tools, may have their own terms or may be switched off by your admin.
5. Note the date you checked, and check again every few months or whenever the vendor announces a change.

Key takeaways

• The account type matters more than the brand name. Consumer and business versions of the same tool handle data differently.
• Business and enterprise plans from OpenAI, Google, Anthropic and Microsoft do not train models on your work content by default. Consumer plans may, unless you change the setting.
• A paid personal subscription is still a consumer account.
• Your workplace policy decides which tools you may use, and client restrictions override general agency rules.
• Check features and data settings against official help pages, and record the date you checked.

Try it now: Fill in one line for each tool you use: tool / account type / approved? / training setting / date checked.