Check a stated policy
Look for explicit descriptions of prompt storage, service-provider access, training use, and deletion. Read exceptions as carefully as the headline promise: a general privacy statement may not answer what happens to a particular kind of content.