Is my chat used to train AI? What the policy says
Portraitor's privacy policy says the provider that generates your portrait does not train on your conversation, and names one retention it cannot switch off.
No. Portraitor’s privacy policy states that the provider which generates your portrait does not use your conversation to train or improve its models, and that no personnel there review it for that purpose. The same section adds that the provider does retain submitted content for a limited period in order to monitor misuse of its own service, and that Portraitor is unable to disable that retention.
It is the first question worth asking before handing a conversation to anything that reads it. Portraitor answers it in its privacy policy rather than on a sales page, which means the answer arrives with its qualifications attached. The qualifications are the useful part.
The provider’s terms are what the promise rests on
The policy says the redacted text is analysed by a third party artificial intelligence provider, on that provider’s paid service tier. It then sets out three limits that apply under the terms applicable to that tier. The provider does not use your conversation to train or improve its models. It is not reviewed by the provider’s personnel for that purpose. And the provider does retain submitted content for a limited period in order to monitor misuse of its own service.
The structure of that is worth noticing. The promise is not a policy choice Portraitor made and could quietly unmake. It is a term of the commercial tier it buys, the same term every other paying customer of that provider gets, which is a sturdier place for a promise to sit than a sentence in marketing copy. It is also weaker in one respect: a promise that rests on somebody else’s service terms moves if those terms move.
The policy does not name the provider on the page. It identifies it as an artificial intelligence provider located in the United States, links that provider’s own privacy policy in its register of third parties, and says the service terms the three limits rest on are available.
There is a retention Portraitor says it cannot switch off
This is the sentence to read twice. The policy says the provider does retain submitted content for a limited period in order to monitor misuse of its own service, and that Portraitor is unable to disable that retention.
Two things follow. The first is that not used for training and not retained at all are different claims, and only the first one is being made. The second is that the admission is published rather than omitted. A company writing its own policy has every incentive to leave a clause like that out, and leaving it out would have been easy and unremarkable.
What it amounts to in practice is that the masked text of your conversation sits with the provider for a period the policy describes only as limited, and which Portraitor says it cannot shorten or stop. What arrives there carries no names, email addresses or telephone numbers, because the policy says those were replaced on your own device before anything was transmitted. The identities are gone. The text is there for a while.
Whether that is acceptable is a question about your conversation rather than about the policy. A page of logistics with the names taken out is a different proposition from a page about somebody’s marriage with the names taken out, and the policy draws no distinction between the two.
Seven parties receive something, and the list is published
The policy carries what it calls a complete list of the third parties that receive your data, what each one receives, and the purpose it is disclosed for. Seven entries, each processing under its own privacy policy.
The artificial intelligence provider receives your masked conversation text and generates your portrait. Stripe receives your email address, card details and billing country, takes payment, sends receipts and holds the only copy of your email address. Apple receives your payment and Apple Account details when you buy in the iPhone app, plus the identifier the app attaches to the purchase. Google Analytics receives pages visited, referring site, device and browser type and an approximate location, and the policy states it never receives your conversation.
Hostinger hosts the service and receives everything that passes through it, plus your portrait and email address when the portrait is sent. Google Fonts receives your IP address when a page loads. Cloudflare receives your IP address when a page loads or when your browser or the iPhone app downloads the privacy filter, and your email address and purchase details when you buy, because the payment gateway runs there. The policy adds that your card details never pass through Cloudflare and never reach Portraitor’s servers either, going from your browser directly to Stripe.
One entry on that list deserves naming plainly on a page about privacy. Portraitor’s website and this blog run Google Analytics, which sets cookies. The policy says so, and says how to stop it: Google’s browser opt out add on, blocking cookies for the site, or turning on Global Privacy Control or Do Not Track, both of which it says are honoured so the analytics cookies are never set. The policy also notes that the payment processor’s script loads on every page of the site rather than on payment pages alone, and collects device information for fraud prevention. A tool that runs no analytics at all can make a cleaner claim here than Portraitor can, and pretending otherwise would be the wrong way to answer a question about data.
What the masking does not take out before it travels
The training question has a sibling that matters more, and the policy answers it in the same breath. Masking removes names, email addresses, telephone numbers, postal addresses and credentials on your own device before anything is transmitted, and the list matching each placeholder back to a real detail never leaves your device. Then, in the policy’s own words: this removes who is speaking, it does not remove what was discussed, and if the people in the conversation talked about their health, beliefs, relationships or sexuality, those passages travel to the analysis provider inside the anonymised text without any name attached.
So the better question is not whether a model learns from your words. It is which of your words leave the device at all. The answer is the subject matter, with the identities stripped out of it. The policy also says photographs, videos and voice recordings are never opened and never transmitted, and that only the written messages are read, on the device.
The full data path, from the file on your laptop to the portrait coming back, is set out in whether it is safe to upload your chat history. What happens to the people in the conversation who never agreed to any of this is in what group chat analysis does with everyone else.
A long conversation goes in sections, not as one file
One mechanical detail in the same paragraph is easy to miss and changes how to picture the thing. The policy says a long conversation is analysed in sections, each sent separately in anonymised form, with the results combined into one portrait. There is no single moment at which your whole conversation exists in one place on somebody else’s computer.
The upload half of that journey is described elsewhere in the same policy. A very large conversation arrives in parts and is held in a temporary file on the server until the analysis request is assembled, at which point it is consumed and deleted. An upload abandoned part way becomes unreadable after fifteen minutes and is removed by daily maintenance. Conversation content is not stored on the servers, is held only for as long as generation requires, and is never written to the database, to backups or to logs.
The policy adds that your data may be processed outside your country, including in the United States where the provider, Stripe and Apple operate, and that Standard Contractual Clauses are among the safeguards applied. If the absence of an account is the part you care about, how the Pass works without an account covers the checkout, and what a chat analysis cannot tell you about someone covers the limits of the output itself. You can see the flow the policy is describing at Portraitor.
The policy also says where that provider operates, and that answer sits in two separate sections. Is my chat sent to the United States works through what crosses the border and what stays on your own device.
Frequently asked questions
Frequently asked questions
Does Portraitor use my chat to train its own AI?
The policy describes no training use of its own. It states that conversation content is not stored on Portraitor’s servers, is held only for as long as generation requires, is discarded once your portrait has been produced, and is never written to its database, backups or logs. The model that writes the portrait belongs to a third party provider rather than to Portraitor.
Does the AI provider train on my conversation?
The policy says no. Under the terms of the paid service tier Portraitor buys, the provider does not use your conversation to train or improve its models, and does not review it for that purpose.
Is my conversation kept anywhere after the portrait is made?
Not by Portraitor, on its own account. The policy does say the provider retains submitted content for a limited period in order to monitor misuse of its own service, and that Portraitor is unable to disable that retention.
Which AI provider does Portraitor use?
The policy does not name it on the page. It identifies it as an artificial intelligence provider located in the United States and links the provider’s own privacy policy in its register of third parties.
Does the masking stop the provider seeing what we talked about?
No, and the policy says so directly. Masking removes who is speaking, not what was discussed. Passages about health, beliefs, relationships or sexuality travel to the provider inside the anonymised text with no name attached.
The provider that performs the analysis is one entry on a longer list, and the policy publishes the whole list rather than that single name. Who else receives your chat reads the register out, company by company, and says what each one is given.
The question people ask is whether a model is learning from them. The question the policy actually answers is which words leave the device, and for how long they sit somewhere else. That one has a number missing from it, and the policy says whose number it is.
See what actually leaves your device
Names, numbers and addresses are replaced in your own browser before anything is transmitted, and the list matching them back never leaves it.
See how Portraitor works →