Ask a supplier in this category whether your clients’ mail will train its AI. A careful one answers with two sentences instead of one word, and an adjective in the middle carries most of the load. That’s the right answer, and you were right to ask the question. Read it as evasion and you go looking for a flat denial instead. You’ll find one eventually, from somebody who shouldn’t have offered it.
- The fear underneath the question is about persistence. A model read your mail this morning, because that’s the product. What matters is whether anything of it survives inside something strangers query.
- Every honest commitment here says generalized models, and that word is the clause. Outside it sits the supplier making the product better for you, and that’s most of what actually happens to your mail.
- Training runs on a copy somebody kept. Retention sits upstream of it and answers more, and the training sentence is silent on how long anything lives.
- The commitment has an exception written into it, and the exception is yours to give. The route from a practice into a training corpus runs through somebody in your office far more often than through your supplier.
What the fear is actually about
The picture in a partner’s head is specific, and it’s worth saying out loud. A client’s figure comes back out of somebody else’s chatbot a year from now. Or their identifying number. Or the sentence they wrote about their marriage. Nobody got hacked. The information just became part of a thing other people ask questions of.
That fear earns its own section. Training has two properties nothing else in your data handling has.
It’s permanent. Every other exposure has a remedy with a mechanism behind it. Delete the record. Close the account. Rotate the credential. Ask for the export back. A message absorbed into a model’s weights has become part of the weights. Your deletion clause reaches records, and there’s no record left for it to reach.
It’s also remote. Every other failure in a practice surfaces somewhere you have a relationship: a client, a colleague, a supplier, an insurer. This one surfaces in a system belonging to a company you never contracted with, in front of somebody you’ll never meet. You won’t know it happened.
Now set the ordinary day beside that. A model reads your correspondence to rank it, to summarize it, to answer a question about an attachment, to write a draft. That contact runs all day. It’s the reason you bought the software, and every commitment on every page leaves it in place. What happens to that message afterwards is the whole question. Under sound terms it’s processed, an answer comes back, and a retention clause governs the copy. Under a consumer product’s terms it may be kept and used to build the next model.
So you settled the question of whether AI sees client data when you connected the mailbox. The live question is whether anything of it persists inside something other people use. Everything that follows is a way of getting at that one.
The adjective is the clause
Here’s a real commitment, from a document you can go and read. Point’s privacy policy, at section 6.5:
Point does not use Customer Content to train generalized third-party large language models or generalized foundation models unless you expressly authorize it. Point may use Customer Content to provide and improve the Services for you or your organization, including improving user-facing features, safety, security, reliability, and quality.
(Privacy policy, version 1.0, effective July 7, 2026, checked August 19, 2026.)
Two sentences, because there are two facts. One sweeping sentence would have to drop one of them. The first names a category of model: generalized, foundation, third-party. It covers that category, and it leaves the supplier’s own tuning of the product you pay for outside. The second says your content may be used to make that product better.
Firms read the first sentence and skip the second. The second sentence is where nearly all of your mail actually goes.
So it’s worth knowing what improving the service consists of in a product like this. Ranking that adjusts to the senders you actually open. A search index that gets more useful as it fills with your own correspondence. Prompts and routing rewritten after somebody watched the software get a thread wrong. A set of real failures kept as a test, so the next change can be checked against them before it ships. Every one of those uses your mail. All of them are the product learning your work, and retraining a foundation model is a different activity. A supplier who promised to do none of them would be promising you a product that never gets better at your work.
So the two of you are using one word for different sets of activities, and both of you are being straight about it. Training has no agreed boundary between a firm’s vocabulary and a vendor’s.
So ask about artifacts and lifespans instead of the verb. What does the software make from my mail? Where does each of those things live? Does any of it outlast my account? Those have factual answers. “Do you train on my data” has a definitional one, and how to read the answer you get back is a discipline of its own.
The copy has to exist first
Training runs on data somebody kept. That sounds too obvious to write down, and it reorders your diligence once you take it seriously. A training clause governs one use of a copy. A retention clause governs whether the copy is there to be used at all. If you could get only one of the two in writing, take the second. It covers more ground.
So count the copies. In this category there are more of them than firms expect.
Your supplier holds the mail, and it holds what it made from the mail. Search indexes, embeddings, summaries, the tasks lifted out of a thread. Point’s subprocessor list itemizes those beside the content they came from. That’s the shape worth wanting, for one narrow reason. A list that names the derived material is a list you can ask a deletion question about. Does deletion reach the index and the embeddings? Or does it reach the messages and leave everything computed from them behind? A summary can easily outlive the correspondence it summarized.
Then there’s a copy on the model provider’s side, and this is the one the training conversation hides. Point’s data processing addendum states it plainly:
Customer acknowledges that AI providers and other Subprocessors may process prompts, requests, outputs, metadata, logs, and telemetry for safety, abuse prevention, fraud prevention, security, operational reliability, and legal compliance, subject to applicable provider terms and controls.
(Terms, data processing addendum section 7.2, checked August 19, 2026.)
Every item on that list is safety and operations work. Every item is also a copy of an excerpt of your client’s correspondence, sitting on a third party’s infrastructure for a period set by that third party’s terms rather than yours. A firm that took a no-training answer and stopped there never asked how long that copy lives, and it’s the copy furthest from anything the firm controls.
Last, the copies you make yourself, and this is the exposure nobody counts. A thread forwarded to your own personal address so you could look at it at home. A statement dropped into a spreadsheet tool to get a total out of it. Those leave your supplier’s terms entirely and land under somebody else’s.
How long any of it is kept, and what survives in backups afterwards, belongs in the terms rather than on a security page. The conditions hung off that clause are worth more of your attention than the number in it.
The link you have no contract with
Your agreement is with the company selling you the mail client. The models belong to somebody else, and that boundary is where a training commitment becomes a promise about conduct rather than about outcomes.
Read what the commitment says at that boundary. Point’s addendum:
Where the Services use third-party large language models or AI services, Point will use configurations intended to prevent Customer Personal Data from being used to train or improve generalized third-party models, consistent with applicable provider controls and terms.
(Terms, data processing addendum section 7.1, checked August 19, 2026.)
The subprocessor list carries the same shape beside each AI provider: used under business terms with no-training controls where available. Configurations intended to prevent. Consistent with applicable provider controls. Where available.
That’s a supplier undertaking to use the switch wherever there is one. It’s a promise about their own conduct, and it’s the widest promise anybody in this category can make, because nobody here owns the model. Read the conditionals as competence. The other drafting, a flat guarantee about a third party’s internal behavior, comes from somebody who hasn’t worked out who would be liable for it.
A second clause decides how long your answer stays true. Point’s terms, at section 6.7, reserve the ability to select, route, replace, or change AI models, embedding models, model providers, infrastructure providers, and processing methods at any time. Every serious product in this category holds that right. It has to. The models change every few months, and a product frozen to one provider would be a worse product within the year.
So the answer you were given in August describes a routing decision, and the routing can change while the software looks exactly the same. The durable half is the conduct commitment, which survives the swap. The half naming which company holds the model is a fact with a shelf life. A dated, versioned subprocessor list is worth more than any paragraph of assurance, because it makes the swap something you can notice.
The exception is on your side
Both of Point’s sentences carry the same escape, and so does every equivalent clause you’ll read: unless you expressly authorize it. That’s how the option stays yours. Somebody has to be able to say yes, and it’s you. Now look where that puts the risk.
The path from a practice’s mailbox into a training corpus that anybody has actually walked begins with a person agreeing to something.
The shapes are ordinary, and each one feels like a small thing at the time. A research or early-access program with a consent screen nobody reads to the bottom. A toggle offering to help improve the product, in some other tool entirely, on by default. A feedback button that submits the thread along with the complaint about the thread. And the one that actually happens in March: a preparer with a K-1 they can’t make sense of at eleven at night, and a free summarizer whose consumer terms say the opposite of everything your supplier’s say.
That inverts the picture most firms carry. The product you spent two weeks interrogating is the safest surface in your practice, because it’s the one anybody looked at. Your exposure sits in the tools nobody bought, nobody diligenced and nobody wrote down. A firm holding an excellent vendor answer and nothing else has a good response to a question it isn’t being asked.
One line belongs on this page, and the rest is a policy question for another day. Authorizing this should take more than one person on a Tuesday with nobody else knowing. Decide who at your firm may accept terms on behalf of the practice, and an offer to improve somebody’s model becomes an item that goes to that person.
What to say when a client asks
Clients ask this now, and firms want one word for it. The one word is the problem. No is the most reassuring sentence available and the one most likely to be wrong, and it fails in the worst way, because the client discovers the exception instead of hearing it from you.
Three sentences hold up, and they run in this order for a reason.
A model does read your correspondence, because that’s how the software works. Lead with the concession. A client who learns this later remembers which of the two things you told them, and everything after it is believed because of it.
Under our agreement it is not used to build the general AI models other people use, and the AI providers are used with training turned off wherever that control exists. That’s the actual commitment, stated at its actual width, and it beats a slogan because you can hand over the document it comes from.
It is used to run and improve the service for us, it is kept for this long, and here is the list of companies that touch it. That’s the part firms leave out, and it’s what makes the answer sound like a professional’s rather than a brochure’s.
Here’s the one line to keep away from a client: their data is never seen by AI. You bought the product precisely because AI reads it, so the sentence is false, and with your firm’s name at the top of the page it’s worse than saying nothing. Where any of this belongs, whether it’s notice or something the client must sign, and why the format matters for a 1040 client, is a different question with its own answer.
Where does Point fit?
Every question above can be put to Point. What’s worth setting out here is which document holds each answer.
- The commitment lives in two documents, and the terms tell you which one counts. Section 6.5 of the privacy policy and section 6.8 of the terms carry the same position, and the terms state that the privacy policy becomes a contractual term only where it’s expressly incorporated. The contractual version is also slightly wider in its second sentence. It adds the development of aggregated or de-identified information that doesn’t identify you, your users or individuals. Read the one inside the agreement, then compare.
- The model providers are named rather than described, and the wording is honest about its limit. Subprocessors carries a version and an effective date. It lists AWS for hosting, Anthropic and OpenAI for the AI processing, and Google for text embeddings, and it says of the AI providers that they are used under business terms with no-training controls where those exist. That’s the conduct commitment above, in a document you can diff against the copy you kept.
- What Point makes from your mail is itemized beside your mail. Indexes, embeddings, summaries, points and outputs are listed as things processed, which is what makes it possible to ask whether deletion reaches them.
- The providers and the models can change at any time, and the terms say so at 6.7. Take that as the reason to watch the dated list. A product that could never change model would be a worse product by next spring.
- A mailbox carrying return information sits outside what the standard service covers. Tax-return data is one of the named regulated categories, and an executed supplement is what brings it inside. Raise it while you’re still deciding, rather than once a season has been run on it.
- A message locked end to end is the one place the question dissolves. Point can’t read it, so there’s no excerpt, no derived index entry and no copy on a provider’s infrastructure to have an opinion about. The cost is stated rather than buried: anything sealed that way stays out of ranking, summaries and tasks. It’s a lane for a few messages a year, and a practice runs on the other lane.
Every capability, written out in full, is on the benefits page. Point for accountants reads it back in a practice’s terms, and Point is the shortest version there is.
Common questions
Can I tell clients their data is never used to train AI?
Use different words. The commitment you’re relying on is narrower than that sentence, and it carries an exception that belongs to you. The true version is more convincing anyway: a model does read the correspondence, under the agreement it isn’t used to build the general models other people query, and it is used to run and improve the service for your firm. Lead with the concession, because that’s the sentence a client will otherwise find out about on their own.
Is a no-training promise worth anything if I cannot test it?
It’s worth something, and it’s worth less than the answers you can test, so treat it as its own class of item. A model can’t be inspected for a client’s data, so there’s no export to request and no ticket to raise. That leaves you two levers rather than three. Get the sentence into the document that binds rather than the one that describes. Then shrink the population it applies to, by asking how long copies are kept and by whom. That’s the question with evidence behind it.
Does “improve the service” mean they are training on my mail after all?
Usually it means something else, and the honest answer is that the phrase covers a set of things your firm and your supplier would describe with different words. Most improvement in a product like this is ranking that adapts to your senders, an index that fills up, prompts rewritten after a failure, and a test set built from real mistakes. Ask about artifacts and lifespans instead of about the verb: what does the software make from my mail, where does each of those live, and does any of it outlast my account.
Our supplier says the AI providers have training switched off. Is that a guarantee?
It’s a commitment about their conduct, and that’s the strongest thing anybody in this category can give you, because they don’t own the models. The drafting to look for says the supplier will use no-training configurations where the provider’s controls allow, and the conditionals are the mark of somebody who has thought about who would answer for the sentence. Pair it with the clause letting them change providers, and you can see why the dated subprocessor list matters more than the assurance.
What is the biggest training risk in a small practice?
Somebody in your office, agreeing to something. The commitment in your supplier’s terms turns on your own express authorization, so a person is the realistic route into a training corpus. A research program with a consent screen. A helpful toggle left on in some unrelated tool. A free summarizer used on a K-1 at eleven at night in March. The product you interrogated sits well below those. Decide who at your firm can accept terms on the practice’s behalf, and the vendor work you already did starts covering the surface you thought it covered.
The short version
- The fear is about persistence. A model reads your mail because that’s the product you bought. Training is the case where something survives inside a system other people query, and it’s the one exposure with no deletion route and no local symptom.
- The commitment is two sentences, and the adjective is the clause. Generalized third-party and foundation models sit inside it. The supplier improving the product for you sits outside it, and that’s where nearly all of your mail actually goes.
- Training runs on a copy somebody kept, so retention answers more than training does. So count the copies. Your supplier’s store. Everything derived from your mail. An excerpt on the model provider’s infrastructure, under its own terms. And the copies your own people make.
- Your contract is with the mail client, and the model belongs to somebody else. A promise to use no-training configurations where the provider allows them is a commitment about conduct, and it’s the honest shape, since the routing underneath can change at any time.
- The exception is customer-side. The realistic path into a training set starts with somebody in your office agreeing to something, so deciding who may accept terms on your firm’s behalf does more for you than any further reading of a vendor’s policy.
The wider question of whether to connect a practice mailbox at all is in the client data guide, and what an AI email client is defines the category. What changes inside a firm once reading becomes cheap is in using an AI inbox without breaking confidentiality. How far you let the software go sets your exposure more than any clause, and that’s in is it safe to use AI with client financial data.