MiniFiles.io
All articles
Privacy7 min20 April 2026

What Happens to Your Files When an AI Agent Processes Them?

AI assistants like Claude, ChatGPT, and Gemini can now read PDFs, analyse spreadsheets, and process images you upload directly in the chat. AI agents built on these models — through tools like n8n, Zapier AI, Microsoft Copilot, and custom MCP servers — can access files on your behalf automatically. Before you drop a contract, medical record, or internal report into one of these tools, it is worth understanding exactly where that file goes and what happens to it.

What happens when you upload a file to an AI assistant

When you attach a file to a ChatGPT, Claude or Gemini conversation, the file is transmitted to the provider's servers over HTTPS. The content is read and processed by the model. Depending on the provider and the plan you are on, the file content may be stored temporarily (for the session), stored longer for conversation history, or in some cases used to improve the model. OpenAI's default settings for ChatGPT Free and Plus users allow conversation data — including file contents — to be used for model training unless you opt out in settings. Claude (Anthropic) and Gemini (Google) have their own policies, which differ by product tier and region.

Claude's file handling and privacy policy

Anthropic states that for Claude.ai consumer accounts, conversations (including uploaded files) may be used to improve models by default. Users can opt out in Privacy Settings. For Claude API and Claude for Business/Enterprise, Anthropic does not train on your data by default. Files uploaded via the API are processed in memory and not stored beyond the request. If you are using Claude for sensitive documents, the API or an Enterprise account provides stronger privacy guarantees than the free consumer product.

ChatGPT's file handling and privacy policy

OpenAI stores uploaded files as part of conversation history. For ChatGPT Free and Plus users, data improvement (model training) is on by default — you can disable it at openai.com/settings. With the setting disabled, files are still transmitted to and processed on OpenAI's servers, but are not used for training. ChatGPT Team and Enterprise accounts have data training disabled by default. Files may be retained for up to 30 days for safety monitoring regardless of training settings.

AI agents and automated file access (MCP, Zapier AI, Copilot)

AI agents go further than chat interfaces. Model Context Protocol (MCP) servers — which Anthropic introduced and Claude supports natively — allow AI agents to read files from your local filesystem, connected cloud storage, or third-party APIs. Zapier AI agents and Microsoft Copilot agents can access files in OneDrive, SharePoint, and connected services automatically. When a file is read by an agent, it is transmitted to the AI provider's infrastructure for processing. The same policies that apply to manual uploads apply here — but the automated nature means it is easy to lose track of which files have been processed.

What GDPR says about sending personal data to AI tools

Under GDPR, uploading a file containing personal data to a cloud AI service counts as a data transfer to a processor. Article 28 requires a written Data Processing Agreement (DPA) with the processor. OpenAI, Anthropic, and Google all offer DPAs — but only on their business or enterprise tiers. Consumer products (ChatGPT Free, Claude.ai free tier) typically do not include DPAs. If you process personal data on behalf of EU data subjects using a consumer AI product without a DPA, you are likely in violation of GDPR Article 28.

How to reduce exposure when using AI tools with files

Several practical steps reduce the risk of sending sensitive file content to AI providers. Compress and strip metadata before uploading: MiniFiles.io removes EXIF data and compresses files locally before they leave your device — useful for images that may contain location or device data. Redact personal information before uploading to a consumer AI tier. Use enterprise tiers or the API with a signed DPA for workflows involving personal data. For files that do not need to leave your device at all, use local browser-based tools for compression, protection, and format conversion instead of AI-assisted workflows.

What 'processed locally' means versus 'processed by AI'

Local processing (MiniFiles.io, Squoosh, offline apps) means the file never leaves your device. The tool runs in your browser or on your machine. No provider sees the file content. AI processing (Claude, ChatGPT, Gemini, Copilot) means the file is transmitted to the provider's infrastructure. Useful capabilities come with this — but the file is no longer local. Understanding this distinction is important for making decisions about which files to share with which tools.

Key takeaways

  • Files uploaded to Claude, ChatGPT, Gemini are transmitted to provider servers — not processed locally.
  • ChatGPT Free/Plus uses data for training by default; opt-out available in settings. Enterprise disabled by default.
  • Claude consumer accounts may use data for improvement; API and Enterprise do not train on your data.
  • GDPR Article 28 requires a DPA with AI providers processing personal data — only available on business tiers.
  • MCP agents read files automatically; same privacy policies apply as manual uploads.
  • Compress and strip metadata locally (MiniFiles.io) before uploading to AI tools to reduce data exposure.

Frequently asked questions

Does ChatGPT use uploaded files for training?

By default on Free and Plus plans, yes — unless you opt out in Settings > Data Controls. On Team and Enterprise plans, training is disabled by default.

Does Claude (Anthropic) store files I upload?

On Claude.ai consumer accounts, conversations including files may be stored and used for improvement by default (opt-out available in settings). On the Claude API and Enterprise, files are processed in memory and not retained or used for training.

Are AI agents like Copilot or n8n subject to GDPR?

Yes. Any automated processing of personal data by an AI agent falls under GDPR if the data subjects are in the EU. You need a DPA with the AI provider and a legitimate legal basis for processing.

What is MCP and why does it matter for file privacy?

Model Context Protocol (MCP) is an open standard that lets AI agents read files and data from connected sources automatically. When an MCP-enabled agent reads a file, that file is transmitted to the AI provider for processing — the same privacy considerations apply as for manual uploads.

How can I compress a file before sending it to an AI tool?

Open MiniFiles.io in your browser, compress the file locally, and download the result. MiniFiles strips EXIF metadata and reduces file size — the compressed output contains less embedded data before it ever reaches an AI service.

Try it now — free

Compress PNG, JPEG, and PDF files in your browser. No upload, no installation.

Compress files