[ GUIDE ]

How AI providers handle student data

When a student hits send, the question travels to an AI provider with its own terms. What OpenAI, Anthropic, Google and routers do with it, and what to put in your contract.

Plan a pilot Watch the demo

Facts as of Oct 18, 2026Last reviewed Oct 19, 20263 min read

[ DATA ]

What happens when a student hits send

In a school AI product, a student's question usually travels from the product to an AI provider, sometimes through a router, and an answer comes back. Each hop has its own terms. Business terms differ from consumer terms, and the difference matters most for training and retention.

Provider terms at a glance

Business and API terms as of Oct 18, 2026. Read each provider's current terms before relying on them.

Provider	Training	Retention
OpenAI	No training on API data by default	Abuse logs kept up to 30 days; zero data retention needs OpenAI's approval
Anthropic	No training on customer content	API data deleted within 30 days; flagged content kept up to 2 years; zero retention by agreement
Google (paid Gemini API, Google Cloud)	No training on customer data	Terms bar services likely to be accessed by people under 18
OpenRouter (router)	Prompt logging is opt-in	A setting excludes providers that store or train on prompts; a separate setting limits routing to zero-retention endpoints

AI provider data terms for business customers

Zero retention is narrower than it sounds

"Zero data retention" usually has exceptions. Flagged content and legal holds can override it, and some features or models need short retention to work: Anthropic, for example, requires 30-day retention for certain models. On OpenRouter, the setting that excludes providers that store or train on prompts is not the same as zero retention, which has its own flag and its own exclusions. Ask a vendor which settings are on for student traffic, in writing.

Retention and training rules for children

For children under 13, COPPA's amended rule bars keeping their data indefinitely, requires a written retention policy, and treats disclosures to train or develop AI as needing separate parental consent. The FTC has said it is unreasonable to keep children's data for speculative future uses. Even for teens, short and stated retention is the better design.

What to put in the contract

No training or fine-tuning on student data, by the vendor or its providers.
A written retention schedule for chats, learning records, logs and backups.
The provider and router settings used for student traffic.
A list of subprocessors, including AI providers, with notice before changes.
What deletion covers, and which copies it cannot reach.

How Nexus handles it

Nexus uses providers' business APIs, so providers do not train on student chats by default, and we never train or fine-tune models on student data. Our model router excludes providers that collect prompt data, and before a pilot we turn on zero-retention routing where it is offered. School builds carry no product analytics or tag managers; error reports are off unless the school turns them on, and they drop message content. Data is hosted on Google Cloud in the United States. Nexus cannot erase copies held by model providers, or rotating logs and backups, and we tell schools so up front.

[ FAQ ]

Questions and answers

Do AI companies train on student chats?

Under business API terms, OpenAI, Anthropic and Google's paid API do not train on customer data by default. Consumer apps have different terms.

How long do AI providers keep student data?

Under business terms, Anthropic deletes API data within 30 days and keeps flagged content up to 2 years; OpenAI keeps abuse logs up to 30 days.

What is zero data retention?

A setting or agreement under which a provider does not store prompts and responses after answering. It usually has exceptions, such as flagged content and legal holds.