When a company tells you that people may review your information, it is describing something the company does. The notice alone does not tell you whether you can approve that review, stop it, delete the reviewed copy or challenge what happens next. Each of those is a separate question.
We read a notice like this to learn two things: what the company says it does and which controls it says it offers. This chapter works through that distinction using Google's disclosures for its Gemini Apps. The record carries dates because any statement about a policy needs an identifiable version. It draws on published terms and help text, not any inspection of Google's internal operations.
A product name does not describe a policy completely. Record the particular service, whether the account is personal or organizational, the license that applies and any regional difference in which company acts as provider. If you draw a conclusion about one category of account, do not carry it over to another category just because both display the same product name.
The consumer record below comes from the Gemini Apps Privacy Hub, which displayed an update date of 24 September 2026, and from the notice embedded in it, dated 29 June 2026. This book's review of both took place on 5 October 2026. Table 2.1 keeps the distinctions that bear on human review and control.
Company disclosure, as distinct from independently observed practice.
The qualification about anonymized data belongs right next to the description of the setting. A reader should not have to find out somewhere else that a control does less than its short label suggests. Likewise, "up to three years" should not turn into a claim that Google necessarily holds every reviewed chat for exactly three years. The Hub's retention passages say "up to three years" or "up to 3 years," but one summary passage says that data reviewed by service providers is "saved for 3 years." When a notice varies its own wording, record the variation instead of picking whichever phrase is more convenient.
The record for organizational accounts looks different. Google's help page for work and school accounts, in its Business/Enterprise view, separates license categories and gives each its own data-handling statement. The page title also mentions school accounts, but that does not establish the terms for every education license. Table 2.2 describes only the view this book examined.
Company disclosure, as distinct from independently observed practice.
The two contract records do different jobs. The archived version shows the text as it stood on 15 October 2024. The current page gives the most recent text available at the research cutoff. Both contain the training restriction, but to apply the clause to a real account, you still need to identify that account's agreement and service scope. The restriction also keeps its condition: it applies unless the customer gives prior permission or instruction.
Read the review disclosure in seven parts
Start with what reviewers can see. A prompt, a response, an uploaded file and a piece of feedback are different things. So are associated context, metadata, audio and screen content. Check each category against the notice that applies, and do not assume that every reviewer always receives every category.
The question here is sharper than whether a company uses "your data." Which information reaches which process? If the record describes chats and related data, keep that distinction. A description that mentions only the words typed into a conversation could suggest a boundary that the disclosure does not draw.
Work out whether the disclosure refers to employees, service-provider reviewers, a safety team or an automated process. A review workflow can include automation, but an automated step does not count as a human reviewer. Keep those stages apart.
In its consumer notice, Google includes trained service-provider reviewers in its description of human review. That supports a statement about the category of reviewer Google discloses. It does not identify who reviewed any particular conversation, and it tells us nothing about the selection rate, the reviewers' location or the access controls that apply.
Next, separate the purposes wherever the notice distinguishes them: service delivery, quality assessment, improvement, safety, abuse detection, legal compliance and complaint handling. If a control affects one purpose, do not describe it as ending all of them unless the notice's language supports that.
Google attributes improvement and protective purposes to its review processes. Reporting those stated purposes is different from concluding that every review achieves them. This book's concern is how the process divides authority: what the provider chooses to inspect and what power, if any, the person who supplied the information has over that use.
Account separation answers one question: whether the information stays associated with an account. Identifiability, access and deletion raise further questions that separation alone leaves open. Avoid replacing "disconnected" with "anonymous" unless the evidence supports the stronger word.
Google says it disconnects chats from the account before sending them to service providers. Its notice also asks users not to enter confidential information that they "wouldn't want a reviewer to see or Google to use" to improve its services. Both statements matter. The first describes a separation step. The second stops the reader from treating that step as a promise that nobody will see what they submitted.
Ask which copy you are discussing. Account activity and a reviewed copy held somewhere else are different records, even though both started as the same conversation.
The consumer notice says that deleting activity does not delete previously reviewed chats that Google keeps separately. It also says that deleting activity does not delete data saved in other Google services. A claim about deleting activity therefore has to keep its boundary. It cannot stand in for a claim that every related copy, recipient record or derived effect disappears.
This question concerns what the published control establishes. It gives no license to invent an account of internal copies, backups or technical deletion procedures. If the material you reviewed contains no operational evidence on those points, record the gap.
Keep Activity, temporary chats, feedback, activity deletion and a legal request are separate paths. For each one, describe the action, the data it reaches, when it takes effect and which uses or copies may remain.
The consumer record shows why those four elements belong together. What Google discloses about future training does not establish that protective human review stops. The feedback pathway and the separate statement about creating anonymized data also need attention. Deleting earlier activity raises yet another question: what happens to copies that Google has already separated from the account?
Chapter 8 develops the full revocation map. For now, the task is to resist squeezing several controls into a reassuring but inaccurate phrase such as "human review is off."
A policy review cannot establish facts it did not investigate. This chapter does not measure how often review happens, inspect where reviewers work, test how the company enforces internal access, trace where information travels downstream or establish that anyone can reverse the effects of earlier training.
Record these as limits of the evidence. If the reviewed material says nothing about an internal process, that silence does not prove the process is absent. Equally, a plausible explanation of how it might work does not replace a documented finding.
Use these questions to check your written account:
Does "may review" tell you how often review happens, or only that it can happen?
Does the notice distinguish employees from contractors or service providers?
Does it describe disconnection, pseudonymization, anonymization or simply hiding an account identifier?
Does the control you selected stop improvement review, all human access or some narrower specified purpose?
Does deletion reach reviewed copies, connected services, vendors, backups, derived data and models, or does the evidence leave some of those questions open?
Does your description give the update date, access date, account category and jurisdictional scope?
These questions are a reading method that I propose. They do not imply that every notice must publish every operational detail or that a missing public answer proves wrongdoing. They help you keep your conclusion within the evidence you have.
A good policy description sets out the company's statement first and then offers an interpretation. I propose this template:
For [product, account and jurisdiction], the company stated in [notice and version], accessed on [date], that [reviewer category] may review [specific information] for [purposes] and that it keeps that information for [period], subject to [exceptions and limits].
If a field remains unknown, mark it as unknown. Do not fill it with an answer that merely sounds reasonable. After the description, add any distinction you need between the practice the company discloses and operations for which the record shows no independent examination.
Company review can serve a legitimate purpose and remain a process the provider directs. Questions about a person's own authority need their own answers. Chapter 3 takes up one of them: what does it mean to authorize a particular action before it happens?