OpenAI Dots Privacy Review: Are Always-On Agents Safe for Client Work?

Short answer: OpenAI’s Dots can read your connected inbox, calendar, and Slack around the clock, and you cannot delete a single memory it builds from that client data without wiping the whole agent. Our verdict is AVOID FOR PAID CLIENT WORK on personal ChatGPT plans until OpenAI ships per-item memory controls. Policy reviewed October 2026, five days after launch. Dots arrived on September 29, 2026 as always-on agents inside ChatGPT, each running on its own cloud computer and browser and able to reach more than 4,000 apps through plugins. For a solo consultant, that means a tireless assistant that also keeps working, and remembering, when you are not watching. Here is how we vet privacy claims before any tool gets a verdict.

What OpenAI Dots does with your data

Privacy at a glance

Privacy dimension	OpenAI Dots’ answer
Trains on your data?	Personal plans: yes, unless you switch training off
Training opt-out	One toggle under Data Controls; business tiers off by default
Data retention	Memories kept until you reset the entire dot
Third-party sharing	Every app you connect, plus OpenAI vendors
Storage region	Not stated; runs on OpenAI cloud computers
Enterprise-team tier	Business Premium and Enterprise, no training by default
Per-item memory deletion	Not available at launch

OpenAI’s own privacy FAQ for Dots, its help center, and the main privacy policy all returned a Cloudflare block to our automated fetch on October 3, 2026. Everything below is therefore drawn from coverage that cites those documents directly, cross-checked across five outlets (per coverage in Search Engine Journal, DEV Community, IBTimes Singapore, and eesel, citing OpenAI’s Dots help pages as of September 30 to October 1, 2026).

A dot is an agent powered by GPT-6 Astra. It gets its own remote computer and browser, inherits the plugin connections you already granted to ChatGPT, and can be messaged from ChatGPT, Slack, or Teams. Plugin permissions are shared across Dots, ChatGPT, ChatGPT Work, and Codex, so an old Gmail or Slack connection is live for your dot on day one.

The feature that matters most for privacy is proactive research. When you are not talking to it, a dot can read from your permitted sources, such as email, calendar, and Slack, and write private notes to itself. During that unsupervised mode it is read-only: it cannot message anyone, edit content, or drive a browser (per Search Engine Journal’s report on the Dots help documentation, published 2026-09-30).

Memory is where the posture weakens. A dot receives memories from ChatGPT and forms its own, including from connected apps. At launch you can pause memory or reset the dot, but you cannot view, edit, or delete individual memories. Disconnecting an app stops new reads but keeps whatever context the dot already derived (per DEV Community’s walkthrough of the Dots docs, 2026-09-30, and IBTimes Singapore, 2026-10-01).

On training, business, enterprise, and education content is excluded by default. Personal plans follow the “Improve the model for everyone” setting, and OpenAI says it does not train directly on proactive research or a dot’s private notes, though those may feed conversations that are eligible (per eesel’s Dots explainer, 2026-09-30). Deleted chats leave OpenAI systems within 30 days, subject to legal holds and abuse review (per terms.law’s review of OpenAI’s privacy policy effective May 18, 2026).

What this means for solo freelancers

Dots is sold on Pro plans starting at $100 a month and on Business Premium. Pro is not offered in the EEA, Switzerland, or the UK at launch, while Business Premium is available in every supported region. That means plenty of US and Canadian solo workers are already eligible. Three scenarios show where the risk sits.

If you connect your work inbox, your clients’ emails become dot memory. A dot doing proactive research on Gmail reads contracts, invoices, and NDA-covered threads, then saves notes about them. When a client later asks you to return or destroy their confidential material, you cannot remove just their part. Based on the policy as written, your only option is to reset the dot and lose every rule, task, and memory it holds for other clients too.

If you leave training on, client context can reach model improvement. On a personal Pro plan, the training toggle decides whether conversations with your dot are eligible for model training. A dot summary that quotes a client’s pricing or product roadmap is still client data, even if you never pasted it yourself. Based on the policy as written, personal plans carry a real risk of client material entering training unless you change one setting.

If a client email contains hidden instructions, your dot may act on them. OpenAI acknowledges that a website, email, or document can try to trick a dot, and that its safeguards reduce this risk rather than remove it. An always-on agent with access to your inbox and Slack is exactly the target a prompt injection needs.

For EU clients, there is also a controller-processor question. A dot reading their staff’s emails on a personal US plan with no data processing agreement leaves you as the party answering for it. Based on the policy as written, Business Premium with its DPA is the only Dots setup that gives you paperwork to show a client.

• Client-confidential threads end up in memory you cannot prune.
• Training eligibility depends on one toggle on personal plans.
• Prompt injection risk grows with every connected inbox.

How to use it safely

If you still want Dots for internal or non-client work, set it up deliberately:

1. Turn off training first. In ChatGPT, open Settings, then Data Controls, and switch off “Improve the model for everyone” before you create a dot. Our guide on opting out of AI training for freelance work covers the same step across other tools.
2. Audit inherited plugins. Go to your ChatGPT connected apps and disconnect any client-facing inbox, drive, or Slack workspace before the dot starts proactive research. Remember that disconnecting later will not erase what it already learned.
3. Write Custom Rules on day one. Set email sending, file sharing, and calendar invites to “Ask before taking action”. Set anything touching payments to “Hand off to me”.
4. Keep local computer access off. It is disabled by default. Leave it that way on any machine that holds client files.
5. Use a separate account for client work. If a client pays for Business Premium, run the dot inside their workspace, not your personal Pro account.
6. Check Activity View weekly. On the desktop app, review completed tasks for anything the dot read or drafted that involved a client.
7. Plan your reset. Before a client engagement ends, note that a full reset is the only memory wipe available, and schedule it.

Credentials are one bright spot: when a dot needs to sign in, it pauses while you type into a secure form that the model does not see. Store those passwords in a dedicated manager vault so you can rotate them quickly if a dot ever behaves strangely.

Privacy-friendlier alternatives

Dots is a general-purpose agent, so the useful alternatives either keep your data out of a training pipeline, keep the agent on your own machine, or lock down the credentials an agent touches. If a client insists on Dots itself, ask them to run it inside their own Business Premium workspace, where training is off by default and their DPA covers the data. Otherwise, these three options cover most solo setups.

• Lumo by Proton: Proton’s AI assistant keeps no chat logs and does not train on your conversations, and it sits inside Proton’s Swiss jurisdiction. What it gives you that Dots doesn’t: a chat assistant whose history you fully control. It is not an always-on agent. Free tier, with Lumo Plus at roughly $10 to $13 per month. Best for writers and consultants who mostly need drafting and summarizing.
• Codync: an MIT-licensed, end-to-end encrypted way to run Claude Code, Codex, Cursor, and dozens of other agents as named bots on your own computer, then approve their work from your phone. What it gives you that Dots doesn’t: the agent runs on hardware you own, so client files never sit on a vendor’s cloud computer. Free and open source; you pay only for the model you plug in. Best for freelance developers. See our Claude Code privacy review for the model side.
• Bitwarden or 1Password: neither replaces an agent, but if any AI agent signs in on your behalf, isolate those logins in a separate vault you can revoke in seconds. What they give you that Dots doesn’t: an audit trail and instant credential rotation outside OpenAI. Bitwarden has a free plan and Premium under $20 a year; 1Password individual plans run about $36 a year. Best for anyone connecting more than two client systems to an AI tool.

If your main worry is an assistant reading client inboxes, our VA inbox access privacy review walks through the same risks with a human assistant.

The verdict

Frequently asked questions

Does OpenAI Dots train on my data?

On personal plans such as Pro, the answer comes down to the “Improve the model for everyone” setting in Data Controls, which is on by default. OpenAI says it does not train directly on a dot’s proactive research or private notes, but they can inform eligible conversations. On Business Premium, Enterprise, and Edu, content is excluded from training by default. Switch the toggle off before connecting any client account to a dot.

Can I delete what a dot remembers about a client?

Not selectively, as of October 2026. You can pause memory or reset the dot, and a reset deletes its conversations, saved memories, and scheduled tasks together. You cannot view, edit, or remove individual memories. Disconnecting a client’s inbox stops new reads but keeps context the dot already built. If a contract requires destroying client data, a full reset is the only reliable route.

Is OpenAI Dots GDPR-friendly for EU client work?

Based on the policy as written, Dots on a personal Pro plan gives you no data processing agreement and no per-item deletion, which makes erasure requests hard to honor. Pro is not available in the EEA, Switzerland, or the UK at launch. Business Premium is available there and comes with a DPA and no training by default, which is the only configuration we would consider for EU clients.

Can I use OpenAI Dots for HIPAA data?

Not on Pro. Personal plans do not come with a Business Associate Agreement, and a dot reading a connected inbox would process any patient details it finds. Based on the policy as written, health data belongs only in a Healthcare or Enterprise workspace where your organization has a signed BAA with OpenAI. Even then, keep local computer access off and restrict which plugins the dot may use.

Can a dot send emails or spend money without asking?

During proactive research, no: that mode is read-only. In active tasks, your Custom Rules decide whether a dot acts freely, needs pre-approval, asks first, or hands off to you. Password changes and money transfers always require you to take over, card purchases need advance approval, and auto-review checks outgoing messages against your instructions. Set sending and sharing to “Ask before taking action”.

What happens to my data if I disconnect an app from my dot?

The dot stops reading that app immediately, but anything it already learned from it stays in its memory. Files it created in ChatGPT Library or in connected storage follow those services’ own retention rules. To remove derived context, you need to reset the dot completely, and deleted chats leave OpenAI systems within 30 days unless a legal hold applies.

Sources

• OpenAI Dots privacy, security, and safety FAQs (blocked, fetched via secondary sources, 2026-10-03)
• OpenAI US Privacy Policy (blocked, fetched via secondary sources, 2026-10-03)
• Introducing dots, OpenAI (blocked, fetched via secondary sources, 2026-10-03)
• Search Engine Journal, OpenAI Dots run read-only research (published 2026-09-30, retrieved 2026-10-03)
• DEV Community, Dots permission model from the docs (published 2026-09-30, retrieved 2026-10-03)
• IBTimes Singapore, who is watching what Dots do (published 2026-10-01, retrieved 2026-10-03)
• eesel, OpenAI Dots pricing and limits (published 2026-09-30, retrieved 2026-10-03)
• terms.law, OpenAI privacy policy review (assessed 2026-06-27, retrieved 2026-10-03)
• Product Hunt, Dots by OpenAI (retrieved 2026-10-03)
• Proton, What is proactive AI? (published 2026-10-01, retrieved 2026-10-03)

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of October 3, 2026.