- Trains on your data by default
- Unknown
The consumer FAQ, last shown as May 12, 2025, says SpaceXSI may use your content and interactions with Grok, including prompts, searches, and other materials you submit, along with Grok's responses, to train models, and that you control this in settings. The pages we read do not explicitly say whether Improve the Model is on or off when you first create a logged-in account. They do say that if you use Grok without logging in, where that is permitted outside the EU and UK, you will not have an option to opt out of model training. The same FAQ and the Enterprise FAQ say SpaceXSI does not use content from business and enterprise customers to train models, except that the Enterprise FAQ allows an optional trade of free credits for permission to train. Grok on the X platform is governed by X's privacy policy and terms, not this consumer policy.
- How to opt out
- Steps
On grok.com, open Settings, then Data, and deselect Improve the Model. In the Grok mobile app, open Settings, then Data Controls, and deselect Improve the model. The consumer FAQ says this applies to new conversations. Private Chat, where available, is also excluded from training; turn it on with the ghost icon. Even after you opt out, voluntary feedback such as a thumbs-up or thumbs-down may still be used for training. Unauthenticated use outside the EU and UK has no opt-out. If you use Grok on X, the consumer FAQ points you to the X Help Center instead.
- Data retention
- What they keep
Logged-in users can keep conversation history until they delete it. If you delete conversations or your account, or if you use Private Chat, the privacy policy and consumer FAQ say the data is deleted from SpaceXSI systems within 30 days, unless it must be kept longer for legal, compliance, or safety reasons, or has been de-identified or pseudonymized and disassociated from your account. The privacy policy, last updated October 27, 2026, does not state one retention period for ordinary saved chats you have not deleted. For the API, the security FAQ says inputs and outputs are stored encrypted for 30 days by default, or not persisted if the team enables Zero Data Retention.
- BAA / HIPAA
- No
The consumer privacy policy and terms do not offer a business associate agreement for personal Grok accounts. The Enterprise FAQ and the API security FAQ say SpaceXSI can support a customer's HIPAA obligations under some circumstances, and they point businesses to a BAA questionnaire. The API product page describes the enterprise API as HIPAA eligible, with a BAA available. That is not a consumer-plan offer.
- Enterprise and admin controls
- Controls
This draft is for the personal Grok app and grok.com, not for a Business or Enterprise workspace. Consumer terms say that if you sign up with a work email, your account may be linked to your organization's Grok Enterprise subscription, and an admin may access, monitor, and control it. Grok Business and Grok Enterprise, described on the business product page, the December 30, 2025 announcement, and the Grok.com user guide, are separate workspaces. Those pages and the consumer and enterprise FAQs say business and enterprise customer content is not used for training, with an Enterprise FAQ exception if the customer agrees to training in exchange for free credits. Business and Enterprise listings include no-training, team and seat management, and SOC 2. Enterprise adds custom SSO, SCIM, custom data retention, and, in Enterprise Vault, customer-managed keys and an isolated data plane. API customers can use a US regional endpoint and optional Zero Data Retention, which turns off features that need stored data. Authorized personnel may still review data when legally required, and automated classifiers may run for safety. A separate Grok Business or Grok Enterprise directory entry would be the cleaner way to rate those plans, similar to how ChatGPT is split. Certifications: Unknown for the consumer app. The API product page and API security FAQ say SpaceXSI is SOC 2 Type 2 compliant, and the Grok Business page also lists SOC 2 Type I and Type II. The pages we read do not say that certification covers the personal Grok app.