GitHub Copilot Business — privacy & data policy

Provider: GitHub/Microsoft. PromptPrivacy score: 42/100. Last verified August 26, 2026.

What happens to your data?

GitHub collects your profile details, usage metadata, and content (such as code, inputs, and AI outputs) to operate, secure, and personalize its services. This data may be shared with vendors, partners, and affiliates like Microsoft, and used to train AI and machine learning models. For enterprise accounts, processing is governed by your organization's Data Protection Agreement.

Does it train on your data?

GitHub states that it uses personal data—including user content, code, inputs, AI outputs, text, and feedback—for product development and improvement, specifically including training artificial intelligence and machine learning models. Data may also be shared with affiliates like Microsoft for training AI/ML technologies.

Can you opt out?

You can opt out of certain tracking mechanisms using browser settings, cookie preference links, or the Global Privacy Control (GPC), and disable telemetry in tools like VS Code. For other data processing or deletion requests, you must submit a request via email to privacy@github.com.

Data retention

Personal data is retained for as long as your account is active and as necessary to fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. The exact duration depends on the processing purpose and applicable legal obligations.

Encryption & security

The policy notes that GitHub applies administrative, technical, and physical security controls to safeguard personal data, but it does not specify technical encryption protocols (such as TLS or AES) or third-party audit certifications.

Is it safe for work?

GitHub Copilot Business operates under an organizational structure where the employer is the Data Controller and GitHub is a Data Processor bound by a Data Protection Agreement. However, because GitHub's general policy permits personal data and inputs to be used for model improvement and shared with affiliates, organizations should ensure their specific enterprise contract and DPA override standard training provisions.

Source policy: https://docs.github.com/site-policy/privacy-policies/github-privacy-statement