Send customer data only from projects with active billing, because Google uses unpaid traffic, including AI Studio and free quota, to improve its products and does not use paid traffic. Paid and unpaid traffic both keep prompts and outputs 55 days for abuse monitoring. If you need zero data retention, Google points you to its Agent Platform.
When you need this
- Security or legal review asks whether Google trains on your prompts.
- Customer contracts require that a model provider retain nothing.
- Your users are in the EEA, Switzerland, or the UK.
Evaluation criteria
Paid or unpaid
Is every request that carries customer data on a project with active billing?
Look forEach Cloud project linked to an active billing account, which makes its Gemini API access a Paid Service. For unpaid use, Google disconnects content from your account, key, and project before human reviewers read it.
Abuse-monitoring retention
How long can Google keep your prompts and outputs?
Look forA retention policy that allows Google to keep prompts, context, and outputs for 55 days to detect policy violations. Authorized human reviewers can inspect flagged content.
Your own logs
Are request logs on, and who can share them?
Look forOpt-in logs on billing-enabled projects keep data up to 55 days by default, and you can set 7, 14, or 28. Datasets you share with Google fall under its unpaid terms.
Region rules
Do you serve users in the EEA, Switzerland, or the UK?
Look forPaid Services only. Developers based in those three places also get the paid data terms on AI Studio and unpaid quota. Google's terms say: "You may use only Paid Services when making API Clients available to users in the European Economic Area, Switzerland, or the United Kingdom."
Zero data retention
Do you need zero data retention?
Look forThe Agent Platform's documented process, with abuse-monitoring, grounding, and request-response logs each handled. Google does not train on customer data there without permission. Google Search grounding keeps queries for 3 days with no opt-out, so use Web Grounding for Enterprise, which Google recommends when you need zero retention. An AI Studio key has no request route. A small business with a paid key asked the forum how to get zero data retention. Google's Developer API page publishes no form and says: "If your workload requires guaranteed zero data retention or enterprise data processing agreements, use Vertex AI."
Regulated data
Do you process health or other regulated data?
Look forReview Google Cloud agreements for regulated workloads on the Agent Platform. Gemini API terms prohibit clinical practice and medical advice. One team summarizes medical records on a HIPAA-compliant Gemini setup in Vertex AI.
Questions to ask vendors
- Which of our projects have no billing account, so their traffic falls under the unpaid terms?
- Do we need an exception from abuse-monitoring logging, and is our account eligible?
- Which of our features use Google Search grounding, whose logs cannot be disabled?
Red flags
- Testing with production data in AI Studio on a project without billing.
- Assuming paid-tier terms cover a key whose project has no active billing account.
- Sharing log datasets with Google without checking what they contain.
Products in this piece
Sources
- Official documentation
- 8
- Public source
- 3
- Gemini API Additional Terms of Service
- Gemini API docs: Abuse monitoring
- Gemini API docs: Data logging and sharing
- Gemini API docs: Billing
- Gemini API docs: Available regions
- Agent Platform docs: Gemini Enterprise Agent Platform and zero data retention
- Gemini API docs: Gemini Developer API vs. Gemini platform
- Hacker News comment on telling whether API calls are used for training (May 4, 2025)
- Hacker News comment on a HIPAA-compliant setup of Gemini on Vertex AI (Aug 3, 2025)
- Google AI Developers Forum: How to request Zero Data Retention for a Gemini Developer API project (Jun 27, 2026)
- Gemini API docs: Zero data retention in the Gemini Developer API