You paste three paragraphs into a chat box to tidy the language. This is what happens to them — and the one setting that changes the answer.

Where we've been — Part 1: It predicts the next word. That is the whole machine. A language model produces a guess at the next word, then does it again. There is no step in that loop where it consults a source. → https://buttondown.com/the_desk/archive/

This issue assumes you know nothing about how these systems work. Every term is explained before it is used.

Start here

It is a Tuesday. You are drafting a reply. One paragraph is not coming out cleanly, so you open ChatGPT or Claude in a browser tab, paste three paragraphs of your own draft in, and ask it to tighten the language.

Those three paragraphs contain your client's name. The disputed sum. The argument you intend to run.

Where did they just go?

Almost everything written about AI and privacy is about training — whether these companies were entitled to use the world's books and websites to build their products. That is a real question. It is also not your problem. You were not consulted and you have no exposure from it.

Your problem is the three paragraphs you pasted in on Tuesday.

Why Part 1 had to come first

Part 1 of this series made a single claim: a language model predicts the next word, and that is the whole machine. Given some text, it produces a guess at the next fragment, picks one, adds it on, and repeats. There is no step in that loop where it consults a source, checks a fact, or decides what is true.

In Part 1 that looked like a point about accuracy — why these systems invent citations, and why the verification burden never moves. It is. But it carries a second consequence, and that consequence is the foundation of everything in this issue.

If the model is only a next-word predictor, then it holds nothing. No filing cabinet. No record of your conversation. No memory of you between Tuesday and Wednesday. It reads what it is handed, produces an answer, and retains nothing at all.

Which forces the question this issue exists to answer.

Your conversation history is obviously kept somewhere — you can scroll up and read it tomorrow. The thing you are using does appear to remember your name, your preferences, the document you uploaded last week. If none of that is inside the model, then all of it is somewhere else — somewhere with a different owner, a different physical location, and a different set of legal duties attached to it.

Part 1 emptied the box. Part 2 is about where the contents actually are.

There is a second thing Part 1 gives us. It established that these models are built by being shown enormous quantities of text, and that the building is what produced the behaviour. That is what makes "was my text used to build it?" a sensible question at all — and, as we will see, a question with four different answers depending on which account you happened to be logged into.

So the two parts do different jobs, and they only work in this order. Part 1 told you what the thing is. Part 2 tells you where your words go. You cannot answer the second without the first, because almost every wrong answer in this area starts by imagining that "the AI" is one thing that holds your data — when the one part properly called the model is the one part that holds nothing.

Part 1 — "It predicts the next word. That is the whole machine." Free in the archive: https://buttondown.com/the_desk/archive/

Two nouns, and two events

Most confusion here comes from one habit: using "AI", "the model", "the machine" and "the system" as though they were the same thing. They are not. This issue uses exactly two nouns — and keeps apart two events that are constantly confused.

THE MODEL. The thing Part 1 described. Given some text, it produces a guess at what word comes next, then does that again. That is all it does. It has no memory. It cannot look anything up. It cannot send an email or open a file. On its own it is inert — closer to a very elaborate autocomplete than to an assistant.

THE PRODUCT. The thing you actually log into and pay for: ChatGPT, Claude, Copilot, Gemini. The model is one component inside it. The product is the model plus the screen, plus the memory, plus the search and file tools, plus the filters — built and run by a company, often with the help of other companies. When someone says "we use ChatGPT", they are describing the product.

And two events, constantly mistaken for each other:

TRAINING — how the product was built. Text is used to build the model, before you ever see it. This happened in the past, at the vendor, at enormous scale.

USE — what happens when you type. You send text to a product that already exists. It travels through that product, is worked on, and an answer comes back. Every time you press enter.

A vendor who tells you "we do not train on your data" has made a statement about the first event and said nothing at all about the second. Both can be true at once: your paragraphs were never used to build anything, and your paragraphs passed through several companies in several countries on Tuesday afternoon.

Why training is hard to undo — plainly

A model is, physically, a very long list of numbers. Billions of them, usually called parameters or weights. Training is the process of nudging those numbers up and down until the model's guesses about the next word get good.

Nothing is stored as text. There is no folder inside the model containing your sentences. There is only the effect your sentences had on the numbers, mixed in with the effect of everything else it ever saw.

What that means for a deletion request. In an ordinary database you delete a record — there is a row, you find it, it goes. Here there is no row. Your sentence is not sitting in the model as a sentence, so there is nothing to locate and nothing to strike out. You cannot subtract one book from a person's education. Removing the influence generally means rebuilding the model — which is why vendors resist it, and why "just delete it" is a harder instruction than it sounds.

This is also why the tier you are on matters so much: if your text never enters training in the first place, this problem never arises for you.

European regulators have looked at this. In Opinion 28/2024, adopted 17 December 2024, the European Data Protection Board held that a model trained on personal data cannot simply be assumed anonymous — it must be assessed case by case, because personal data may remain embedded in the parameters. Source: https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en · full text (PDF): https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf

What you type, and who keeps it

Will your three paragraphs be used to build the next version of the product? It depends entirely on which account you were logged into. Same company, same product name, same screen — opposite answer.

Read first-hand on 13 September 2026 from: OpenAI Help Centre, "How your data is used to improve model performance" (updated 11 September 2026); OpenAI, "Enterprise privacy" (updated 8 January 2026); Anthropic Privacy Centre, "Is my data used for model training?" and "Does Anthropic Act as a Data Processor or Controller?" (both 17 March 2026). These pages change. Check them; do not quote this table back at anyone in six months.

The two holes in the opt-out

Suppose you have switched training off on your personal account. There are two ways your conversation can still be used.

Hole one — the thumbs-down button is a consent event

"Even if you have opted out of training, you can still choose to provide feedback… If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models." — OpenAI Help Centre

The other vendor is the same in substance, and adds a retention period:

"When you provide us feedback via our thumbs up/down button, we will store the entire related conversation… in our secured back-end for up to 5 years." — Anthropic Privacy Centre

So the sequence that catches a careful person: you switch training off; you paste in a draft containing your client's name and the disputed sum; the answer is poor; you click thumbs-down to be helpful — and you have just submitted the whole exchange, with a five-year retention attached, by pressing the button that looked like quality control.

Hole two — flagged conversations, which you did not choose

"Your conversations are flagged for safety review (in which case we may use or analyze them to improve our ability to detect and enforce our Usage Policy, including training models for use by our Safeguards team…)" — Anthropic Privacy Centre, listed as a circumstance in which chats are used

Think about which of your work is most likely to be flagged. A criminal brief. An allegation of fraud. A sexual-offence matter. A medical record in a compensation claim. The material a filter treats as sensitive is very often the material a lawyer handles.

The practical rule: on a personal account, treat the thumbs-up / thumbs-down buttons as a submission, not as feedback. If a conversation contains anything you would not put in an email to a stranger, do not rate it.

The part most lawyers get backwards

When lawyers think about a vendor holding client information, they reach for the familiar apparatus — we are the controller, they are the processor, there will be a data processing agreement. Under Indian law the equivalent instinct is s.8(2) of the DPDP Act, 2023: engage a processor "only under a valid contract".

On a personal account, none of that apparatus is in place.

"When a commercial customer creates a Claude for Work account (Team or Enterprise plan)… the customer is the 'Controller' of the data submitted by its Users… Anthropic acts as a 'Processor' of the data on behalf of the customer." — Anthropic Privacy Centre, Does Anthropic Act as a Data Processor or Controller?, 17 March 2026

Consumer plans are dealt with in an entirely separate document, which says no such thing. The other vendor draws the same line from the other side: a data processing agreement is offered for Business, Enterprise and the API. Not for the personal plan.

The personal subscription sitting open in your browser is not a processor arrangement. There is no data processing agreement. There is no set of instructions the vendor is bound to follow. You are a consumer on standard consumer terms — the same footing as someone asking it for a recipe.

Moving from a personal plan to a business plan is not an IT upgrade. It is the step that creates the legal relationship you already believed you had.

What the product is made of

Your paragraphs did not go to "the AI". They went into a product with four separate parts.

One — the model. The weights. Reads what it is given, produces an answer, retains nothing.

Two — the wrapper. Everything between you and the model: the screen, the hidden block of standing instructions the vendor adds to every request, the filters, and the routing that decides which version answers you today. When someone says "we use ChatGPT", this is the part they are describing.

Three — memory. The model forgets everything between conversations. Every feature that appears to remember is built around it: conversation history re-sent with each message; the stored profile; the index that searches your uploaded documents and pastes extracts in before the model sees them. "It remembered our contract terms" is never a statement about the model.

Four — tools. Web search, file upload, code execution, connectors into a mailbox or a drive. This is the part that reaches outward.

Training touched only the first part. What you type goes through all four.

The list nobody reads

Processor / sub-processor, in plain terms. If you decide what happens to information, you are responsible for it. A company handling it on your instructions is a processor. If that company hands it to another company — a hosting firm, a support desk — that one is a sub-processor. The chain does not stop at the company on your invoice.

OpenAI's list, last updated 9 July 2026, names nineteen outside companies and five of its own group entities. Hosting with Microsoft, Oracle, Google, Amazon, CoreWeave and Cerebras across more than two dozen named countries, India among them. Support with Intercom, Salesforce, Accenture and TaskUs. Anthropic's names twenty — support with Intercom in the US, Nutun in South Africa and Boldr in Canada; identity checks with Yoti in the United Kingdom.

Four things worth two minutes:

• Ticking a box adds a company. Merge API is "only used when the Customer chooses to enable Connectors in ChatGPT" — a setting any user can change, adding a firm processing across eleven countries.
• A contract setting removes one. Snowflake is in the chain "except where Zero Data Retention is used".
• Real people in other countries may read flagged material — sampled to TaskUs (Philippines), Accenture (US, Canada, Philippines), Cinder (US).
• One feature can be two firms. Anthropic's web search runs on Brave Search and TurboPuffer.

Both lists rendered first-hand on 13 September 2026: https://openai.com/policies/sub-processor-list/ · https://trust.anthropic.com/subprocessors

Where the law grips — and where it does not

Europe built a gate.

"The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes." — Article 28(2), GDPR

That is not a rule about who pays when something goes wrong. It is a rule about who is allowed to join the chain, and your right to be told before they do. It is also the only reason those public lists exist: a vendor cannot notify customers of changes without keeping a current published list. Both offer a subscription to it. Almost nobody has subscribed — so a real contractual right expires unread.

India built no gate at all. The expression "Data Processor" appears eight times in the whole of the DPDP Act, 2023 — once in the definition at s.2(k), once in an illustration, four times in s.8, once in s.6(6), once in s.11(1)(b). Not one of those eight is a rule about a processor engaging someone else. No authorisation requirement, no duty to notify, no right to object.

But no gate is not the same as no grip — and the provision that does the work is a right given to the individual:

"the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared" — Section 11(1)(b), DPDP Act, 2023

Read that against a list of nineteen or twenty companies. A person in India can require you to name every company that has held their information. Not a category — identities. The only carve-out, in s.11(2), concerns sharing with another Data Fiduciary authorised by law in connection with offences or cyber incidents.

And the Act does not stop at telling. On withdrawal of consent you must "cease and cause its Data Processors to cease" (s.6(6)). You must "cause its Data Processor to erase" what you gave them (s.8(7)(b)).

Cease. Erase. Name. Three instructions pointing down a chain, given to someone the Act hands no lever to pull.

What to do on Monday

1. Check which account you are actually logged into. Personal or business. This single fact decides whether your text is used for training, and whether any processor relationship exists at all.
2. Stop rating conversations on a personal account. Thumbs-up and thumbs-down submit the whole exchange, opt-out or not, with retention of up to five years at one vendor.
3. Open your vendor's sub-processor page and read it once. Two minutes.
4. Check which features are switched on — connectors, web search, file upload. Several add a named company.
5. Subscribe to changes in the list. The right to object runs from the date of notice.
6. If client material is going in, move to a business plan — not for the features, but because that is where the data processing agreement and the processor relationship actually begin.

India Desk

Every duty in the Act that touches a processor is a duty to make someone else do something — and there are only three. Make them cease on withdrawal of consent (s.6(6)). Make them erase (s.8(7)(b)). Name them to the individual on request (s.11(1)(b)). All three point down a chain the Act gives the Data Fiduciary no statutory power to control. Since the statute supplies no reach-down mechanism, the contract has to build one — a right to direct deletion, a right to a current sub-processor list, and a notification term — or all three duties are undischargeable by design.

There is still nothing in the public record creating a transfer or sub-processing mechanism. Section 16 remains a power to restrict transfers to notified countries, and no country has been notified. Rule 15 of the DPDP Rules, 2025 reserves a power concerning personal data made available to a foreign State or its agencies, and no such order is in the public domain. Neither touches ordinary commercial sub-contracting. Stated as an absence of record as at the date of this issue, not as a prediction.

RUNNING CLOCK — computed 13 September 2026

The distances below are as at the date of this line and nowhere else in this issue.

• 13 November 2025 — DPDP Rules, 2025 notified. 304 days ago.
• 20 February 2026 — IT Amendment Rules, 2026 in force. 205 days ago — in force.
• 9 July 2026 — OpenAI sub-processor list last updated, as displayed. 66 days ago.
• 13 November 2026 — Consent-Manager registration commences. 61 days.
• 13 May 2027 — s.16 and Rule 15, and the substantive package including s.8 and s.11. 242 days.

PRACTITIONER'S VERDICT

What to tell a colleague this week. The question is not whether the tool is safe. It is which account you were logged into when you pasted the draft in. On a personal plan your text may be used for training unless you turned it off; the thumbs-down button puts the whole conversation back in whether you turned it off or not; and there is no processor relationship and no data processing agreement of any kind — you are on consumer terms, the same as someone asking for a recipe. On a business plan those three things change together. It is the cheapest compliance step available in this area and most of the profession has not taken it, because it looks like a billing decision and is actually a legal one.

WHERE WE ARE GOING

Next — Part 3: the memory layer. The model forgets everything between conversations, so every feature that appears to remember is built around it. That design is the reason deletion is contested rather than simple — and the reason "delete my chat" and "delete my data" are not the same request.

This issue is written for lawyers and is general in nature. It is not legal advice and no lawyer-client relationship arises from reading it.

Every statutory reference and every date in this issue was checked against at least two independent sources before it went out. Vendor terms were read first-hand on the dates stated. Where a claim could not be verified to that standard it does not appear, or it is stated as an absence of record rather than as a fact. The archive, and everything else I have been building, is at wolfgangrush.github.io

This issue as a PDF (12 pages, 2 figures, page-numbered) https://wolfgangrush.github.io/assets/The-Primer-Part-02-2026-09-13.pdf

Every free document — no email wall https://wolfgangrush.github.io/resources/