Privacy and Data Controls in Claude: Model Training, Retention, KVKK and Organization Settings

Version note: This post covers privacy settings, retention periods and organization data controls in Claude as of 15 November 2026; the information was checked the same day in the Anthropic Privacy Center (privacy.claude.com) and the Claude Help Center (support.claude.com). This post is based on the official documentation. This post is not legal advice; decisions about KVKK belong to your company's legal team and data controller.

Guess First

Gül from customer support wants to group the complaint e-mails coming in for Bookstore, the online bookstore used as the shared example across this site's series, by topic. She did it with her own personal Pro account; the e-mails contained customer names, addresses and phone numbers. The "Help improve our AI models" setting was on in her account. A week later she noticed, turned the setting off and deleted those conversations. In one of the conversations she had also pressed the thumbs-up button because she liked the answer.

Three questions: does turning the setting off and deleting the conversations undo the use of this data in model training? Is the conversation where she pressed the thumbs-up button any different? What would have changed if Gül had done the same job from the company's Team account? The answers are in four Privacy Center articles.

Consumer and Commercial: Two Separate Rule Sets

Claude's data rules split into two groups. The consumer plans are Free, Pro, Max and Ultra; the Privacy Center's model training and retention articles list Free, Pro and Max, and the Covered Models article also lists Ultra among the consumer plans. Claude Code used with accounts on these plans follows the same rules. Commercial products, in the Privacy Center's words, are products such as Claude for Work (Team and Enterprise), the Anthropic API and Claude Gov.

This split is the most important sentence in this post: which group an account belongs to decides, by default, whether its data is used for model training. Gül's personal Pro account is a consumer account, whoever pays the bill. A team that works with company data first has to answer this question: which account are we doing the job in?

The Model Training Setting on Consumer Plans

According to the Privacy Center article "How do I change my model improvement privacy settings?" (https://privacy.claude.com/en/articles/12109829, last updated 3 August 2026), the setting sits under Settings > Privacy on the web and Desktop, named "Help improve our AI models"; on mobile you tap your name and go to Settings > Privacy. With the setting off, Anthropic does not use your new conversations and coding sessions for future model training. Conversations flagged by safety classifiers, however, can still be used for trust and safety work, policy enforcement and safety research even with the setting off.

The answer to the first Guess First question is in this article too: turning the setting off does not undo the past. Data in a training run that has already started and in models already trained stays where it is. The article "How long do you store my data?" (https://privacy.claude.com/en/articles/10023548, last updated 1 July 2026) also says what is kept while the setting is on: conversations and coding sessions can be kept in de-identified form in training pipelines for up to 5 years; this applies only to conversations started or resumed after the setting was turned on.

Deleting is a separate action. A deleted conversation disappears from your history immediately and is deleted from Anthropic's back-end storage within 30 days. But in Gül's case, deleting does not bring back data that may have entered the training pipeline while the setting was on; that is why the right order is to choose the account and the setting first, then work with the data.

Retention Periods

Let's put the periods from the Privacy Center's consumer and commercial retention articles (https://privacy.claude.com/en/articles/10023548 and https://privacy.claude.com/en/articles/7996866) and the incognito article into one table:

The exceptions in the table hold for both groups: data can be kept longer where the law requires it, for disputes and to fight Usage Policy violations; anonymized or de-identified data can be kept longer for research and statistics. One more note: according to the article "Data retention practices for Covered Models" (https://privacy.claude.com/en/articles/15425996), since 9 June 2026 prompts and outputs of Mythos-class models are kept for 30 days on every platform. This rule affects organizations with a zero data retention agreement; according to the article, consumer plans are not affected because data on those surfaces is already retained.

Incognito, Feedback and Connector Data

In the fifth post we looked at incognito from the memory side; from the privacy side it has three properties as well. Incognito conversations are not used for training even when Model Improvement is on, are kept for 30 days by default and cannot be opened inside a project. In the unified experience, incognito opens in the previous experience, so Claude cannot create files or run code there. On Team and Enterprise, incognito conversations are included in the data exports the organization owner takes; incognito is not a space hidden from the company.

The answer to the second Guess First question is in feedback. According to the Privacy Center's consumer training article (https://privacy.claude.com/en/articles/10023580), pressing the thumbs-up or thumbs-down button stores the entire related conversation for up to 5 years; Anthropic de-links it from the user ID before using it, and this data can be used for training. The same exception holds for commercial products. So the conversation Gül gave a thumbs-up stays as a feedback record even if the setting is turned off and the conversation deleted. Not pressing the feedback button in a conversation with customer data is the easiest rule in this post to follow.

The rule for connector data is more positive: according to the same article, training data does not include raw content from connectors, remote and local MCP servers included. But content read from a connector and copied into the conversation becomes part of the conversation and can be included if the setting is on. The article also states that, with the setting on, data collected through Claude in Chrome is included.

Organization Plans: Defaults and Admin Controls

If Gül had done the same job from the company's Team account, the biggest difference would have been on the training side. According to the Privacy Center article "Is my data used for model training?" for commercial products (https://privacy.claude.com/en/articles/7996868, last updated 18 August 2026), inputs and outputs in commercial products are not used for model training by default; the exceptions are feedback and the user explicitly allowing it. On Team and Enterprise, the Owner or Primary Owner can turn off members sending feedback with the "Rate chats" setting under Organization settings > Data and Privacy.

On Enterprise, retention can be set too. According to the article "Configure custom data retention controls for Enterprise plans" (https://privacy.claude.com/en/articles/10440198), the Owner or Primary Owner can set a period of at least 30 days under Organization settings > Data and Privacy; the period applies to conversations, projects and artifacts. Artifacts published with a public link are not deleted by this period, and deleted data cannot be recovered. The Enterprise article on the unified experience fills in the details: account memory follows the retention period for conversations, project memory is deleted when the project is deleted, and cloud sessions started in a conversation are deleted with the conversation; Cowork cloud sessions a member starts directly stay until the member deletes them.

Some configurations are not yet compatible with the unified experience. According to the Enterprise article, organizations using zero data retention, the HIPAA-ready configuration or customer-managed encryption keys cannot turn on the unified experience; the Team article also leaves out organizations with zero data retention. Network egress, which we saw in the sixth post, is off by default on Enterprise. A reminder from the eighth post: third-party services connected through connectors process data under their own terms; settings on the Claude side do not change where those services run.

Where the Data Is, and KVKK

According to the Privacy Center article "Where are your servers located?" (https://privacy.claude.com/en/articles/7996890, last updated 15 June 2026), data is stored in the US. By default, customer traffic can be routed to selected countries in the US, Europe, Asia and Australia; internal processes such as safety review, product support or incident response can take place in countries where Anthropic or its affiliates operate. Anthropic uses several cloud providers to process customer data; the full list is in the subprocessor list in the Privacy Center.

From the point of view of KVKK, Turkey's Law No. 6698 on the Protection of Personal Data, this information is the start of a question. Giving a customer's name, address or order history to Claude means transferring personal data to a service provider abroad, and transfer abroad is a topic the law regulates separately. Whether there is a legal basis for it, whether the privacy notice covers it and which Claude plan fits the company's policy are questions for the company's legal team and data controller, not for a developer. What the developer can do is not send personal data to Claude at all until that answer comes.

Bookstore: A Masking Checklist for Complaint E-mails

What Gül actually needs is not personal data; it is the topics and counts of the complaints. That is why the e-mails are masked before they go to Claude. The checklist for the team:

• Replace first and last names in every e-mail with a numbered placeholder: [CUSTOMER_1], [CUSTOMER_2].
• E-mail address, phone number and full address: [EMAIL_n], [PHONE_n], [ADDRESS_n]; keep only the province if the analysis needs it.
• Order number: [ORDER_n]; the table that maps it to the real number stays only in Bookstore's own system.
• Card details, national ID number and passwords: not masked, removed from the text entirely.
• Sentences with sensitive information such as health conditions: removed, with only [REMOVED] in their place.
• Signature block and e-mail thread: quotes other than the latest message are deleted.

Masking is done in Bookstore's own environment; the text that goes to Claude looks like this:

From: [EMAIL_1]
Hello, I am [CUSTOMER_1]. My order [ORDER_1] arrived on Monday and the
cover of "The Hobbit" was torn. I would like a replacement, not a refund.
You can call me at [PHONE_1].

The brief that works with the masked e-mails is written so that it also catches what the masking missed:

You will get 40 customer complaint e-mails from Bookstore. Personal data is
already masked as [CUSTOMER_n], [EMAIL_n], [PHONE_n], [ADDRESS_n], [ORDER_n].
Do not try to guess or restore masked values.

Group the complaints by topic (shipping, damaged book, refund, payment, other),
count each group and quote one short masked example per group.
Output a table. If an e-mail still contains a name, an e-mail address,
a phone number or an address, list its number under "Masking missed"
and do not quote it.

The "Masking missed" list is a safety net: if an e-mail shows up on it, the data has already gone to Claude, so the real job is to fix the masking step. The expected answer is a table that gives the five topic groups with their counts and one masked example each, and ideally an empty "Masking missed" list. To check, see that the group counts add up to 40, that the examples contain no personal data other than placeholders and that Claude did not try to guess the value behind a placeholder. Doing this job in the company account, in incognito and without pressing the feedback button means choosing the shortest retention periods in the table.

In Production

Write down which job is done in which account. A one-sentence rule such as "company data only in the company's Team or Enterprise account" prevents most of the situation in Guess First. Review the settings of personal accounts once as a team, too.

Do not share secrets. Do not put API keys, passwords or connection strings into a prompt, project knowledge or a skill file. The general risks of data sent to an LLM, such as the system prompt and context added through RAG, are covered in the LLM Application Security series post "Sensitive Data and Hidden Context Exposure: System Prompts, RAG Context and Data Sent to Providers".

Track settings with dates. Many of the dates in this post changed during 2026; look at the update dates of the Privacy Center articles and compare the team policy with these articles at least once a year.

Common Pitfalls

Using a personal Pro account for company data. Pro is a consumer plan; the training setting and the retention rules are the consumer rules. Company data belongs in the company's commercial account.

Assuming turning the setting off deletes the past. Turning it off affects only new conversations; data already in a started training run and in trained models is not taken back.

Pressing the feedback button in a sensitive conversation. The entire conversation can be kept for up to 5 years, on commercial plans too.

Assuming deleting a conversation deletes everything. As we saw in the fifth post, memory entries are deleted separately; artifacts shared with a public link are not deleted by Enterprise's retention period either.

Taking incognito for a space hidden from the company. On Team and Enterprise, incognito conversations are included in the organization's data exports.

A Small Experiment

★☆☆ Open Settings > Privacy and check what the "Help improve our AI models" setting is in your account. Write down whether your account is consumer or commercial.

★★☆ For a type of data your team gives Claude (support e-mail, order report, log), prepare a masking checklist like the one in this post. Mask five sample texts, run them with the brief from this post and see whether the "Masking missed" list comes back empty.

★★★ Write a one-page Claude data policy for your team: which jobs are done in which account, which data is never sent, when feedback and incognito are used and, if you are on Enterprise, what the retention period should be. Take the draft to your legal team and data controller.

With this post the Working with Claude series ends. We started with plans and usage limits; after model and effort choice, task briefs, Projects, memory, artifacts, Research, connectors, skills and agentic tasks, we finished with where the data goes. From here you can go in two directions. If you want Claude to work on code, the upcoming Claude Code series; if you want to connect Claude to your own application, the upcoming Building Applications with the Claude API series. The provider-independent foundation that helps in both directions is in the LLM Fundamentals and Prompt Engineering in Practice series.