Does Grok train on your data? Grok app vs Grok Business & API
Grok has different data terms on personal and business plans. Personal: Free, SuperGrok. Business: Grok Business / Enterprise & xAI API. Every value links to xAI's own page. Last verified .
Grok (grok.com / Grok app)
Trains by default
Trains on business data unless you opt out.
Full personal-plan page →Grok Business / Enterprise & xAI API
Doesn't train
Doesn't train on business data by default.
Full business-plan page →Side by side
| What we checked | Personal Grok (grok.com / Grok app) | Business Grok Business / Enterprise & xAI API |
|---|---|---|
| Trains on your data by default | Yes, opt-out xAI says it may use your prompts and Grok's replies to train its models and that you control this with the "Improve the model" setting; once you deselect it, new conversations are not used. The FAQ does not literally say "on by default", but it describes training as the normal case until you opt out. Logged-out users in some regions (not EU/UK) cannot opt out. Grok inside the X app is covered by X's own settings, not checked here. Source: x.ai/legal/faq (checked Oct 18, 2026) | No Enterprise terms cover Grok Business/Enterprise and the API. xAI may still create de-identified aggregated data unless you use ZDR. x.ai pages now name the operating company "SpaceXSI"; quotes keep that wording. Source: x.ai/legal/terms-of-service-enterprise (checked Oct 18, 2026), x.ai/legal/faq (checked Oct 18, 2026), x.ai/grok/business (checked Oct 18, 2026) |
| Can you turn training off? | Yes Deselect "Improve the model" (app: Settings > Data Controls; grok.com: Settings > Data). Feedback you send may still be used for training. Source: x.ai/legal/faq (checked Oct 18, 2026) | Not tracked for business plans |
| Data retention | Kept until you delete it You keep conversations as long as you want; retention otherwise follows the privacy policy's 'ongoing legitimate business need'. Source: x.ai/legal/faq (checked Oct 18, 2026), x.ai/legal/privacy-policy (checked Oct 18, 2026) | Deleted within 30 days of the session (custom retention available) Longer retention possible if agreed, legally required, or needed for safety/abuse investigation. Source: x.ai/legal/terms-of-service-enterprise (checked Oct 18, 2026), x.ai/grok/business (checked Oct 18, 2026) |
| Retention after you delete | Within 30 days (longer for legal, compliance or safety; de-identified data may stay) Source: x.ai/legal/faq (checked Oct 18, 2026) | Not tracked for business plans |
| Human review of chats | Yes, limited authorized staff may review Including for improving model performance. Source: x.ai/legal/faq (checked Oct 18, 2026) | Not tracked for business plans |
| Temporary / incognito chat | Yes: Private Chat Ghost icon, top right. Not in history, not used for training, deleted within 30 days. Source: x.ai/legal/faq (checked Oct 18, 2026) | Not tracked for business plans |
| Data location / residency | Unknown The consumer privacy policy checked does not state where Grok data is stored. x.ai pages now name the operating company "SpaceXSI"; quotes keep that wording. | Unknown No customer region choice found. The DPA says data may be processed in the US and other countries. Pages checked: x.ai/legal/data-processing-addendum (checked Oct 18, 2026) |
| SOC 2 Type II | Not checked yet Not checked in this personal-plan research pass (consumer/business compliance docs not reviewed). | Yes Source: x.ai/grok/business (checked Oct 18, 2026) |
| ISO/IEC 42001 | Not checked yet Not checked in this personal-plan research pass (consumer/business compliance docs not reviewed). | Unknown No ISO/IEC 42001 claim found on the x.ai pages checked. |
| DPA available | Not checked yet Not checked in this personal-plan research pass (consumer/business compliance docs not reviewed). | Yes DPA is incorporated into the enterprise terms. It asks customers to send personal data only through the ZDR-enabled API. Source: x.ai/legal/terms-of-service-enterprise (checked Oct 18, 2026) |
| BAA / HIPAA | Not checked yet Not checked in this personal-plan research pass (consumer/business compliance docs not reviewed). | Yes PHI requires a signed BAA and use of the ZDR-enabled API. Source: x.ai/legal/terms-of-service-enterprise (checked Oct 18, 2026) |
| Zero-retention option | Not checked yet Not checked in this personal-plan research pass (consumer/business compliance docs not reviewed). | Yes ZDR-enabled API: content deleted within an hour of the request or on delivery, with no logs or backups. Source: x.ai/legal/terms-of-service-enterprise (checked Oct 18, 2026), x.ai/legal/data-processing-addendum (checked Oct 18, 2026) |
Verbatim quotes from each source are on the personal and business pages.
How to turn off training on a personal Grok account
Deselect "Improve the model" in Grok's data settings, or use Private Chat. Step-by-step instructions →
See also: Why AI training on your data matters · How we source and verify this