GeminiA support agent at a logistics company opens Gemini to draft a reply to an angry customer. She pastes the full complaint thread (name, address, order history, and the customer's bank details from a refund request) and asks Gemini to "write a calm, professional response." The draft is excellent. She never notices the small line of text beneath the prompt box: Gemini can make mistakes, so double-check it. Your conversations may be reviewed.
She is not using her company's Google Workspace. She is signed into her personal Google account, in the free consumer app, where a subset of conversations is read by human reviewers and reviewed chats can be kept for up to three years.
This is the part of Gemini that catches organisations out. The risk is not a single careless prompt. It is that Gemini does not feel like a separate tool you visit. It sits inside Gmail, Docs, Drive, and the phone in your pocket, and most people have no idea which version of it they are actually talking to.
Is Gemini safe for business data?
Gemini can be used safely at work, but the answer depends almost entirely on which Gemini. Google ships the brand under two very different products with two very different sets of promises.
The free consumer app at gemini.google.com is built around product improvement: Google samples conversations for human review and uses them to train its models, and it tells you so. Gemini in Google Workspace is built around enterprise commitments: Google states in writing that it does not use your Gmail, Docs, or Drive content to train its generative models and that your data is not reviewed by humans outside your domain without permission.
Same name. Same interface, more or less. Completely different exposure. The privacy risk in Gemini is rarely the model being "unsafe". It is an employee placing customer or employee data into the consumer app while believing they are protected by their employer's contract with Google.
How Gemini handles your data
| Consumer Gemini (gemini.google.com) | Gemini in Google Workspace | |
|---|---|---|
| Account | Personal Google account | Managed work account |
| Used to train Google's models | Yes (a subset, with human review) | No: contractually excluded |
| Human review of conversations | Yes, a subset | No, without permission |
| Retention after you delete | Reviewed chats kept up to 3 years | Controlled by your administrator |
| Data processing agreement | No | Yes (Workspace terms) |
| Admin control | None | Full, via Admin console |
Consumer Gemini displays Google's own warning: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services, products, and machine-learning technologies." That is not a footnote. It is Google telling you, directly, what the service is for. A subset of chats is reviewed by trained reviewers, and those reviewed chats (plus related signals such as language, device type, and location) are retained for up to three years, even if you delete your activity. Turning off Gemini Apps Activity stops new chats being sampled; otherwise chats are kept for 72 hours to operate the service.
Gemini in Workspace is the version an organisation can actually govern. Google commits that customer data is not used to train or improve its generative models without permission, is not reviewed by humans outside your domain, and is not used for advertising. Data residency can be restricted to the EU, and client-side encryption is available. An administrator decides whether Gemini is on at all, what it can reach, and how long conversation history is kept.
The trouble is that nothing on the screen makes the difference obvious to the person typing.
Five places where it goes wrong
1. Employees using the consumer app instead of the managed one
This is the headline risk. An employee signs into their personal Google account, on a work laptop or on their phone, and uses the free Gemini. Anything they paste is governed by the consumer terms: sampled for review, used for improvement, retained. The company's Workspace protections do not apply, because the company was never in the loop.
2. Gemini reaching into Gmail, Docs, and Drive
The feature that makes Gemini in Workspace useful ("summarise this thread," "find the contract in my Drive," "draft from my notes") is also a wide data surface. When Gemini is enabled with access to Workspace content, a single question can pull together information from across your mailbox and files. That works well and, under Workspace terms, it is contained. But it means access scope is now an admin decision, not a per-document one.
3. Acting on your phone apps, even with activity tracking off
In July 2025, Google emailed Android users that Gemini would be able to "help you use Phone, Messages, WhatsApp, and Utilities" whether Gemini Apps Activity is on or off. The change decoupled app access from the data-logging toggle: turning off activity no longer stopped Gemini from interacting with those apps. It was switched on by default and announced by an easily-missed email. Gemini does not train on these interactions while activity is off, but the access itself is the point, and many users never realised it had changed.
4. Prompt injection through summarised content
In July 2025, a researcher at Mozilla's 0DIN programme demonstrated that hidden text in an email (white, zero-size, wrapped in a fake <Admin> tag) could hijack Gemini's "summarise this email" feature. When the recipient asked for a summary, Gemini followed the hidden instruction and appended a fake security warning with an attacker's phone number. No link, no attachment. Google says it has seen no real-world abuse and is hardening its defences, but the technique turns any incoming newsletter, ticket, or CRM message into a potential injection vector.
5. Confidential data in a prompt that did not need it
Even in a fully governed Workspace, the safest data is the data you never paste. Summarising a performance review does not require the employee's date of birth and phone number to be in the prompt. The model will happily accept them, and the more identifiable data flows through prompts, the larger the footprint that any future misconfiguration, export, or access review has to cover.
