Does an AI email assistant train its models on my emails?

“We do not train on your emails” answers one important question, but it is routinely treated as if it answers five. An assistant still needs to read selected content, transmit it to computing services, store context, retrieve that context later and keep operational evidence. Each stage has its own purpose, location and retention. Consumer model terms can also differ materially from enterprise cloud terms. This guide maps the lifecycle and applies it to the current architecture. The adopted policy commits to no model training on customer content through Google Vertex AI, but publication requires proof that the deployed configuration and signed contracts match that promise. It also requires plain answers about storage, derived memory and deletion rather than using “no training” as a privacy shortcut.

What does model training actually mean?

Model training or fine-tuning uses data to change model parameters; ordinary inference uses supplied content to produce an answer without necessarily changing the model. Both involve processing, but they are different operations and require different questions.

When an assistant receives an invoice email, it may send relevant text to a model to identify the supplier and due date. That is inference. If a provider later adds the message and desired output to a dataset used to improve future model behaviour, that is training or fine-tuning. A service may also create an evaluation set to measure quality, which is another secondary use even if it never updates model weights.

Google Cloud's current Vertex AI terms state that Google will not use customer data to train or fine-tune models without prior permission or instruction. The associated documentation also describes limited retention scenarios such as abuse monitoring and caching, which means “not used for training” should not be rewritten as “never retained anywhere.” Exact model, location and configuration still matter.

How is training different from retrieval and business memory?

Retrieval stores private information outside the model and supplies selected context when a user asks for it; the model does not need to learn the mailbox globally. This is how persistent assistance can coexist with a no-training commitment.

The current product captures communications as per-user observations and derives contacts, tasks, bills, documents and other records with source identities. An interactive request can search the live mailbox or those stored records, then pass the relevant result into the model's working context. That supports a business-aware assistant without adding one customer's email to a general training corpus.

Retrieval still creates obligations. The store must keep tenants separate, prevent over-broad search, preserve provenance and allow a false fact to be corrected. A remembered client address can be more operationally consequential than a transient model prompt. Buyers should therefore ask what becomes durable, whether raw messages or only extracted records remain, how old facts are superseded and which retrieved portions leave the primary database for model processing.

Where can email data persist even without training?

Email may persist in the mailbox, application database, attachment storage, derived records, model-service logs, backups and audit systems even when no training occurs. A data map should name each copy and retention rule.

The adopted privacy policy specifies a 30-day window for original transient attachments while extracted text and derived records remain to preserve context. It also sets live-account deletion and backup-rotation targets. The storage lifecycle configuration and full self-service deletion route are not visible in the present repository, so those promises need deployment evidence before publication.

What do the current Hank policy and architecture say?

The policy says customer content is processed through Vertex AI under enterprise terms and is not used to train Google's models or Hank's own models. The code uses the Vertex AI client rather than a consumer chat interface.

Model calls are created with a Google Cloud project, Vertex mode and configurable location. Classification, extraction and interactive reasoning pass selected communication or document content for inference. The product does not contain a model-training pipeline. The subprocessor register names Google Vertex AI and records the no-training restriction as a load-bearing promise.

That is credible design evidence, not a complete contractual packet. The operating legal entity, privacy contact, customer DPA and subprocessor DPA references remain open in governance. The default model endpoint is configured as global in code while policy statements mention US regions for primary hosting. Before public use, the team must record the deployed model location, relevant retention settings, contracts and any human-review route. The email-access safety checklist explains the other controls that remain important even after training is ruled out.

Which contract terms should a buyer inspect?

Read the terms that apply to the exact paid plan and service chain, not a general AI privacy page. The application vendor, model host, cloud provider and optional monitoring tools can each process different data.

The agreement should define processing purposes, customer instructions, confidentiality, security measures, subprocessors, international transfers, deletion, incident notification, assistance with rights requests and audit evidence. It should also restrict training, human review, advertising, sale and unrelated product improvement. If optional feedback permits broader use, the default and the user's control must be clear.

Confirm whether consumer and business plans differ, whether beta or third-party models have separate terms, and which contract version governs the account. A public “your data is private” sentence has little value if an incorporated term permits a use the buyer did not expect.

How should deletion and correction work?

A trustworthy product must delete or correct both copied content and operational conclusions derived from it, subject to clearly stated legal and security retention. Removing the original message alone can leave the consequential memory untouched.

Suppose an assistant mistakenly records an old bank account as current. Correcting the source view without updating the derived contact or payment record preserves the risk. A deletion workflow should map source observations, extracted attachment text, indexed embeddings, records, draft attachments and caches. Audit entries may need to remain, but they should be minimised and record the correction rather than continue serving the false value.

The current governance policy promises access, correction, export, restriction and deletion rights. Self-service export and full-account deletion are described as product requirements, not yet visible completed features. Until those routes and the privacy contact exist, the no-training commitment cannot carry the entire privacy proposition.

Who it is not for

A no-training assistant can still be unsuitable when its processing locations, retention, security, contracts or professional-use boundaries do not fit the mailbox. Training is only one risk category.

Organisations requiring local-only processing, customer-managed keys, formal legal holds, special-category safeguards or contractual client consent may need an enterprise deployment with additional controls. A professional should not upload client content under consumer terms merely because a settings toggle says training is off. If the vendor cannot identify its model service, subprocessors or deletion lifecycle, do not use confidential data to test the claim.

Use synthetic material until the exact account, plan and configuration have been reviewed.

Conclusion: does the assistant learn from your emails?

An AI email assistant does not need to train its models on customer mail to understand a business. It can process selected content for inference, store private source-linked records and retrieve relevant context later. The architecture uses Vertex AI, whose enterprise terms restrict training without customer permission, and policy prohibits training on customer content. That answer must remain paired with the rest of the lifecycle: model-service logging, application storage, derived memory, backups, human access, correction and deletion. Before publication, deployed settings and executed agreements must be verified, and product deletion must be tested end to end. “No training” is valuable. It becomes trustworthy only when buyers can see exactly what processing still occurs.