Microsoft Copilot — privacy & data policy

Provider: Microsoft. PromptPrivacy score: 44/100. Last verified November 01, 2026.

What happens to your data?

When you use Microsoft Copilot, Microsoft collects your prompts, uploaded images, commands, and interactions to deliver responses and personalize features. Microsoft may also use this content to develop and train its AI models, and shares data with affiliates and operational vendors. You can manage, export, or delete your Copilot history through your Microsoft account privacy dashboard.

Does it train on your data?

Trains on your content by default. Microsoft explicitly states that it may use your data to develop, train, and fine-tune AI models, including large language models (LLMs). In addition, Microsoft notes that it uses manual human review on some results against underlying data to build and improve automated systems.

Can you opt out?

Not specified. While Microsoft explicitly states that customer data may be used to develop and train AI models, the policy text does not provide instructions or a direct mechanism for opting out of AI model training.

Data retention

Microsoft retains personal data for as long as necessary to deliver products, complete transactions, resolve disputes, and fulfill legal obligations. The policy does not provide a fixed retention window for Microsoft Copilot data, though users can manually view and delete their Copilot activity history via the privacy dashboard.

Encryption & security

Microsoft states that it uses encryption when transmitting highly confidential data (such as passwords or credit card numbers) over the internet, and stores data in computer systems with limited access in controlled facilities. Specific standards such as encryption at rest, TLS specifications, or certifications like SOC 2 and ISO 27001 are not specified in this text.

Is it safe for work?

Consumer Copilot used with personal accounts is not recommended for confidential business data, as inputs and uploaded images may be used for AI model training and reviewed by humans. Organizations should use managed work or school accounts (Microsoft Entra ID), where organizational administration and enterprise controls apply.

Source policy: https://privacy.microsoft.com/en-us/privacystatement