Copilot privacy: what Microsoft publishes, consumer Copilot and Microsoft 365 Copilot kept apart

There is no single Copilot, so there is no single answer. Signed in with a work account you are under Microsoft's commercial terms and your IT administrator's settings; signed in with a personal account you are under its consumer Privacy Statement. Below: what Microsoft publishes on training, what Enterprise Data Protection does and doesn't cover, what is kept and who can open it, how to tell which Copilot you have, and what people at work commonly keep out. Every Microsoft statement is quoted from its own pages, read on 27 October 2026.

Short answer: it depends on the account you sign in with, the licence your organisation holds, and what your administrator has switched on. This guide won't call Copilot, or any other tool, private or not. It sets out what Microsoft publishes on training, retention and access for each Copilot, so you can decide what to paste in under your firm's policy and your clients' terms.

Everything below comes from Microsoft Learn, Microsoft Support and the Microsoft Privacy Statement, read on 27 October 2026, with the dates Microsoft shows; sources are listed at the end. One naming note first, in Microsoft's words: "Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat." Its licence labels and pricing pages still say Microsoft 365 Copilot, so this page uses the name each Microsoft page uses, and says "the paid add-on" where it helps. If your question is about using Copilot in a law practice, that is a separate page: Copilot for lawyers.

Start with the sign-in: two sets of terms

Microsoft's consumer pages open with the sentence "This article applies only when you sign in with a Microsoft account," and its commercial pages describe what happens "when you sign in with Microsoft Entra accounts." The same Copilot app can land you on either side; Microsoft's own advice to administrators is to "instruct them to sign in with their Microsoft Entra account before accessing Copilot via the Microsoft Copilot app, copilot.cloud.microsoft, Copilot Chat in Edge, or productivity apps." As of 27 October 2026:

The third row is the one most people mean by "Microsoft 365 Copilot," and the second is what most people with a work account have without knowing it. The difference between them is not the privacy terms, which Microsoft places under the same enterprise data protection, but reach: Copilot Chat "is not grounded in organizational content like files, emails, or chats as part of the chat experience—it is grounded in data from the web only," unless you paste, upload, or use it inside Outlook or Teams, while the add-on "pulls information automatically" from your organisation's Microsoft 365.

Does Copilot train on your prompts? Microsoft's published answer

Work or school account

Microsoft's enterprise data protection page (dated 29 May 2026) lists it as a commitment: "Your data isn't used to train foundation models," expanded as "Consistent with our other Copilot offers, the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models." The Copilot Chat page (dated 18 August 2026) repeats it for the no-add-on version: "Prompts and responses aren't used to train the underlying foundation models." Two qualifications sit on the same pages. Feedback is separate from prompts: "We may use customer feedback, which is optional, to improve Microsoft Copilot," though "We don't use this feedback to train the foundation LLMs used by Microsoft Copilot," and "Customers can manage feedback through admin controls." And web search queries are handled by Bing, not by Microsoft 365: they are "generated from the prompt into a few words," sent "with user and tenant identifiers removed," and "aren't shared with advertisers and aren't used to train our foundation large language models (LLMs)."

Personal Microsoft account

Here the answer changed with the app. Microsoft's current page on activity history for the Copilot app, which notes that "An updated version of the Microsoft Copilot app for web, desktop, and mobile devices is available as of August 18, 2026," says: "Prompts, responses, and your file contents when using the Microsoft Copilot app aren't used to train foundation models." The page for Copilot in the Microsoft 365 apps on a Personal, Family, Premium or Pro plan says the same of those apps. Microsoft's Privacy FAQ for the older version of the app, which now opens with "The information in this article applies only to the older version of the Microsoft Copilot app," described the previous position: "Microsoft uses data from Bing, MSN, Copilot, and interactions with ads on Microsoft for AI training," with a setting to opt out, and a list of people it never applied to, including "Users signed into Copilot with an organizational Entra ID account," "Users under the age of 18 who are signed in to Copilot," "Users of Copilot within Microsoft 365 apps with Personal or Family subscriptions," and "Users in Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea, and Vietnam." If you still run an un-updated install of the older app, that older page, and its "Settings > Privacy > Training on conversation activity" switch, are the ones that describe it.

One document sits above both product pages. Microsoft's Privacy Statement (Last Updated September 2026), under "How we use personal data," says "we may use your data to develop, train, and fine-tune our AI models," and in its Copilot section: "Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising." It adds that "You can manage your prompt history in product and on the Microsoft Privacy Dashboard." The support pages are the narrower, product-specific statements; the Privacy Statement is the general one. This page doesn't reconcile them for you; where they read differently, Microsoft's own pages are the authority, and your firm's policy is the rule you work under.

What Enterprise Data Protection covers, as Microsoft documents it

Microsoft's definition: "Enterprise data protection (EDP) refers to controls and commitments, under the Data Protection Addendum (DPA) and Product Terms, that apply to customer data for users of Microsoft Copilot and Microsoft Copilot Chat." The framing sentence is the one professionals tend to want: "With EDP, prompts and responses are protected by the same contractual terms and commitments widely trusted by our customers for their emails in Exchange and their files in SharePoint." The page lists five commitments, each a heading of Microsoft's:

• "We secure your data": encryption at rest and in transit, physical security, "data isolation between tenants."
• "Your data is private": "We won't use your data except as you instruct," with references to GDPR, the EU Data Boundary, ISO/IEC 27018 and the DPA.
• "Your access controls and policies apply to Copilot": it "inherits your sensitivity labels, applies your retention policies, supports audit of interactions, and follows your administrative settings." Then the caveat that runs through every Microsoft page here: "The specific controls and policies will vary depending on the underlying subscription plan."
• "You're protected against AI security and copyright risks": harmful-content and prompt-injection safeguards, and the Customer Copyright Commitment.
• "Your data isn't used to train foundation models": quoted above.

What the same page places outside EDP matters as much. Web queries: "The Bing search service operates separately from Microsoft 365 and has different data-handling practices covered by the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement," so for those few words "Microsoft acts as an independent data controller"; a footnote adds that "HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA)," and that "The EU Data Boundary doesn't apply to web search queries." Third-party models: Microsoft now offers Anthropic and OpenAI models inside Microsoft Copilot, "As an admin, you can decide whether to use these models," and "Anthropic models are currently excluded from the EU Data Boundary and when applicable, in-country processing commitments." Agents: "check the privacy statement and terms of use of the agents to determine how they'll handle your organization's data." And one sentence on human review that people searching "is Copilot private" usually want: "While abuse monitoring, which includes human review of content, is available in Azure OpenAI, Microsoft Copilot services have opted out of it."

EDP also says nothing about what the add-on may read. That is a permissions question: "Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions." A folder shared with the whole company is readable by everyone's Copilot. Whether your organisation has tightened that is for its administrator, not for Microsoft's terms.

What is kept, for how long, and who can open it

At work: a logged copy in your tenant

Microsoft is specific. "The stored data includes the user's prompt and Copilot's response, including citations to any information used to ground Copilot's response," stored "in alignment with contractual commitments with your organization's other content in Microsoft 365," encrypted. Files you upload to Copilot Chat "are stored in a user's OneDrive for Business as part of enterprise data protection." Where the copy lives, from Microsoft Purview's retention page: "Data from generative AI messages is stored in a hidden folder in the mailbox of the user who runs the AI app. This hidden folder isn't designed to be directly accessible to users or administrators, but instead, store data that compliance administrators can search with eDiscovery tools."

Who can open it: "To view and manage this stored data, admins can use Content search or Microsoft Purview. Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot." Microsoft's plainer page for employees says the same: "Your IT admin can use search and audit tools from Microsoft to view this logged information." How long: your organisation's retention policy decides, and Microsoft warns that what you see in the app is not the record: "In most scenarios, these messages aren't removed. For example, they remain but are hidden when users close a chat window or close the app," and "Messages visible in your AI apps are not an accurate reflection of whether they are retained or permanently deleted for compliance requirements." Leaving doesn't end it: "If a user leaves your organization and their Microsoft 365 account is deleted, their Copilot and other AI app messages that are subject to retention are stored in an inactive mailbox."

You can ask for your own history to go: "Your users can delete their Copilot activity history, which includes their prompts and the responses Copilot returns, by going to the My Account portal." Microsoft's steps and their limits ("Any content that Copilot helped you with, and that you've saved in your file, won't be removed") are walked through, with a diagram, on our Copilot for lawyers page. Note what the Purview page adds: permanent deletion "is always suspended if the mailbox is affected by another retention policy for the same location, Litigation Hold, delay hold, or if an eDiscovery hold is applied."

One more item from the Purview page, for anyone using the consumer Copilot on a work laptop: its retention locations now include "Other AI apps," listing "ChatGPT," "Google Gemini," "Microsoft Copilot (consumer version)" and "DeepSeek," whose prompts and responses can be captured "when they have a collection policy with the setting to capture content." Microsoft documents that as a control available to your organisation; whether yours uses it is a question for your administrator.

On a personal account: your history, your dashboard

Microsoft defines the record: "Your 'activity history' or 'chat history' is the record of those prompts and responses." The Privacy Statement adds memory: "For users in some markets, Microsoft Copilot can use your conversation history (including any memories you save) to personalize your experience." And: "You can manage your memories and control personalization features using the settings in Microsoft Copilot at any time." On retention it gives only its general rule, "Microsoft retains personal data for as long as necessary to provide the products and services you use"; the consumer Copilot pages read on 27 October 2026 publish no fixed period. The controls are the app's Settings and the Microsoft privacy dashboard, below. There is no administrator, and nothing is logged into anyone's tenant; the trade is that there are also no Purview holds, labels or audit on your side of the line.

How to tell which Copilot you have, and check its settings

Microsoft's administrator guidance (dated 23 October 2026) says the apps show "a different background color for each account type, 'Work' label under the user profile in the navigation pane, and the green data protection shield in their Microsoft Entra ID experience," and that "In-product labels are displayed in Microsoft 365 apps like Word, Excel, PowerPoint, and OneNote, and in the Microsoft Copilot app, to help users identify their Copilot experience." The three labels are "Copilot Chat (Basic)," "Microsoft 365 Copilot (Basic)" and "Microsoft 365 Copilot (Premium)"; only the last is the paid add-on. So:

1. Look for the shield and the "Work" label. Green shield next to New Chat and "Work" under your profile: a work or school account, enterprise data protection, your organisation's terms. Neither: a personal account.
2. Read the licence label in Word or the Copilot app. "(Premium)" means the add-on that reads your mail and files through Microsoft Graph; "(Basic)" means it reads what you give it.
3. On a work account, your controls are few. Delete your activity history at My Account > Data and Privacy > Data options > Copilot activity history (steps and diagram on the lawyers page). Everything else, from web search to which agents exist, is in your administrator's hands; the add-on's Work IQ grounding has a switch ("You can turn Work IQ on or off"), and Microsoft's page does not say who holds it.
4. On a personal account, two places. In the updated Copilot app: "Open Settings, and then select Personalization"; the "Saved memories" toggle stops new memories, and "Select Manage next to the Saved memories toggle" leads to "Delete all memories." Microsoft's caution: "Turning off Copilot Memory doesn't automatically delete already saved memories." A single chat goes from the Chats list via "...More" then "Delete." Also under Personalization: the "Allow ads personalization" toggle ("Regardless of your settings, Copilot doesn't show personalized advertising to users under the age of 18"). For everything at once, the Microsoft privacy dashboard, below.

The whole record, export or delete, is on the Microsoft privacy dashboard at account.microsoft.com/privacy. Microsoft's page, which "only applies to when you're signed in with your Microsoft account," gives the path Privacy > Empower your productivity > Copilot > Your Copilot app activity history > Copilot apps, then "Export all activity history" (it says "a comma-separated values (CSV) file is downloaded to your device") or "Delete all activity history," confirmed in a dialog headed "Are you sure you want to clear your Copilot activity history?" with "Clear." Copilot in the Microsoft 365 apps for home has its own export and delete entries on the same dashboard. For a work or school account the page sends you to "Delete your Microsoft Copilot activity history" instead.

What people at work commonly keep out

Microsoft's pages describe controls; they don't tell you what to paste. Your firm may already have decided, and its policy and your engagement terms outrank anything here. These are choices professionals commonly make, not rules:

• The account follows the work. Client material in the work-account Copilot, under the organisation's terms and the administrator's settings; the personal-account app for personal questions. Mixing them means mixing two sets of terms, and on a work laptop the consumer app may be inside a Purview collection policy anyway.
• Names come out, the question stays. "A client in logistics wants to reopen a fixed fee after a scope change" carries most of the value of the real paragraph without the client. Remember that at work the prompt is logged either way.
• Material under someone else's terms gets its own decision. Documents received under an NDA, a data-room agreement or an engagement letter that limits third-party services: those terms decide, before any Copilot sees them, including the add-on that would read them where they sit.
• Check who can open the folder. With the add-on, Copilot reads what you have "at least view permissions" to. A matter folder open to the company is a matter folder every colleague's Copilot can answer from.
• Web search is a different pipe. The few words Copilot sends to Bing sit outside EDP, HIPAA and the EU Data Boundary on Microsoft's own page. If that matters for a client, the administrator's "Allow web search in Copilot" policy is where it is decided.

Weighing the same question for the other assistants on your phone? The parallel pages are ChatGPT privacy and Claude data privacy, and for Google's research tool, is NotebookLM private?

What this page doesn't cover

No legal or compliance conclusion: nothing here says whether a use of Copilot meets a professional rule, privilege, HIPAA, GDPR or a client contract, and Microsoft's own compliance pages are its claims, not an audit by us. Nor GitHub Copilot, Security Copilot, Copilot Studio, Copilot in Edge or Windows, Copilot Cowork, or the Microsoft 365 US Government clouds, each of which Microsoft documents separately. Microsoft changes names and pages often; where its current page disagrees with this one, Microsoft's page is right.

Where Equerry fits: it reads only what you send it

Equerry is a personal assistant who helps you get things done. The privacy question you have just read about, who can reach what, is answered differently by its design: it reads only what you send it. An email thread you CC or forward to your own Equerry address; a PDF, an image, a link or text shared from your iPhone's share sheet; a note you type; a voice note you record in Equerry. If you allow it, it also reads your calendar, read-only. It never asks for your inbox, it has no connection to your organisation's Microsoft 365, and the original stays where it was. What your firm weighs is each item you chose to send, not a tenant, and that choice is still yours under your policy.

Here is one exchange, on this page's question:

A thread you CC keeps itself current: replies that keep the Equerry address on the thread keep arriving, so the client's Thursday reply is there before Friday's call. Anyone on a CC'd thread can see the Equerry address, so forward where that would be awkward.

What you send is processed to make it searchable and answerable, including by the outside providers named on our AI disclosure page, which says what each one receives and states that we never train AI models on what you save. No ads. Equerry sends nothing, books nothing and buys nothing on your behalf. It makes no claim about any professional rule, or about whether what you send it is confidential: whether client material goes into Equerry, Copilot or anything else is your decision under your firm's policy and your client's terms. What changes is the scope, one thread or one file at a time, and a list you can read and delete.

Sources, all read 2026-10-27. Microsoft Learn: Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat (dated 29 May 2026: the definition, the five commitments, web queries, the HIPAA and EU Data Boundary footnotes, agents); Microsoft Copilot Chat Privacy and Protections (dated 18 August 2026: the rename sentence, the training sentence, logging to Exchange, the green shield, uploaded files in OneDrive for Business, web-only grounding, Copilot Chat in Outlook, EU Data Boundary); Data, Privacy, and Security for Microsoft Copilot (dated 9 July 2026: Microsoft Graph and view permissions, the training sentence, stored interactions, Content search and Purview, My Account deletion, feedback, third-party models, abuse-monitoring opt-out); What is Microsoft Copilot? (dated 23 October 2026: the three licence labels, the "Work" label and shield, EDP by licence, Work IQ, "pulls information automatically," the web-search policy); Learn about retention for Copilot and AI apps (dated 23 September 2025: the hidden mailbox folder, eDiscovery, holds, inactive mailboxes, the "Other AI apps" locations). Microsoft: Microsoft Privacy Statement (Last Updated September 2026: "How we use personal data," the Copilot section, retention, the privacy dashboard). Microsoft Support, consumer pages (no visible article dates; the dates given are page metadata; the three Copilot-app pages carry the 18 August 2026 updated-app notice): Microsoft Copilot for individuals: your data, privacy, and responsible AI; your activity history (metadata 2026-08-18: the training sentence, the definition of activity history); your privacy controls and choices (metadata 2026-09-17: Settings, Personalization, Saved memories, Manage, Delete all memories, ...More, Delete, Allow ads personalization); Manage your Copilot activity history in the privacy dashboard (metadata 2026-08-21: the dashboard path, export and delete labels, the CSV sentence, the dialog); Copilot in Microsoft 365 apps for home: your data and privacy (metadata 2026-08-27); Privacy FAQ for Microsoft Copilot (metadata 2026-08-31) and Microsoft Copilot privacy controls (both state they apply "only to the older version of the Microsoft Copilot app": the older training line, the exclusion list, the "Training on conversation activity" switch). Microsoft Support, work or school: Data protection when using Microsoft Copilot Chat for work or school (logging, the IT admin sentence, encryption during the session); Delete your Microsoft Copilot activity history (the My Account path and the saved-content limit). Microsoft's pages describe the consumer Copilot (a personal Microsoft account) or Microsoft Copilot and Copilot Chat for organisations (a Microsoft Entra account) as each page states; where Microsoft's current page disagrees with this one, Microsoft's page is right. This guide is general information, not legal advice.

Last updated 2026-10-28.

All product names, logos, and brands are property of their respective owners. Equerry is not affiliated with, endorsed by, or sponsored by any other product mentioned; comparisons are provided for informational purposes.