Don’t assume a tool built on Google’s Gemini keeps no copy of what your customers wrote to it. If it runs through a new paid Google project, created on or after October 26, Google now saves the full text of every prompt and every reply by default. Picture a customer’s email and the draft that answered it, sitting in a dashboard.
Google put this in its release notes for developers, in a short entry. The one write-up I found, on datastudios.org, is careful and written for the team that runs the code. It says the release note doesn’t define “new project” and suggests treating anything created from October 26 on as new. Google’s policy pages, updated that same day, now say exactly that. What neither gives an owner is a list. Who do you ask, and what do you ask them?
The change is to what Google calls the Generate Content API. An API is how one program asks another for something, and this is the usual way a tool puts a question to Gemini. Here’s the rule, from Google’s Logs and datasets page, last updated October 26:
Starting October 26, 2026, the Generate Content API stores requests by default for new projects. Projects created before this date keep their existing storage setting for the Generate Content API, which is off (store=false) unless previously enabled in AI Studio.
Two details matter more than the date. “Requests” means the whole exchange: the same page says you can “inspect the full prompt and response,” plus the earlier turns of the conversation. And the cutoff is the day the project was created. It isn’t the day anyone started paying.
How long does it stay? The page sets “a default retention window of 55 days” and lets the project owner shorten it. I counted forward from October 26 for each setting:
| Retention setting | A message sent October 26 is marked for deletion on |
|---|---|
| 7 days | November 2 |
| 14 days | November 9 |
| 28 days | November 23 |
| 55 days (the default) | December 20 |
That assumes the clock starts when the message is sent. The page doesn’t say so in those words. And “marked for deletion” isn’t “gone”; I couldn’t find how long Google takes to finish the job. There’s one more way out of the clock. A log saved into a dataset is exempt, because Google says datasets “don’t expire.” Saving a few bad replies to study is normal. That folder has no end date, though.
What to Ask Whoever Set It Up
If a freelancer, an agency or a no-code tool wired Gemini into your email replies or your quotes, four questions cover it:
- When was the Google project created? On or after October 26 is the line.
- Is billing on? Google says storing logs is for paid projects only.
- What’s the retention setting, and who picked it? Shorter is your call, down to a week.
- Has anyone saved logs into a dataset, shared one with Google, or joined the invite-only Contributor Tier, which trades a discount for permission to use the data?
That last one changes the deal. Google’s data logging and sharing page says that by default “prompts and responses within logs are not used for product improvement or development.” Share a dataset, and the terms flip: “human reviewers may read, annotate, and process the API inputs and outputs you share,” after Google disconnects them from your account and project. Sharing is opt-in, and the same page asks people not to “contribute logs containing sensitive, confidential, or proprietary information.” A customer’s email can be exactly that. Ask who opted.
Keeping logs isn’t the mistake. They’re how you find out why a reply went wrong. The mistake is keeping them because nobody touched a default. And “keep less” isn’t always the answer either: the proposed New York City chatbot rule we covered on October 21 would make businesses keep “logs of all covered interactions” for at least three years. Those logs show things like whether a customer was offered a person, so it’s a different record from Gemini’s. The point holds anyway. Somebody has to decide.
Does your privacy policy say how long you keep customer messages? If it does, is this copy covered?
Here’s what I don’t know. Who besides the project owner can open that dashboard; the pages don’t say. Whether a project created after October 26 on the free plan starts storing the day it goes paid. And I haven’t made a new project to watch the default switch on, so all of this is Google’s own pages, read on the morning of October 27, not a test. One source, in other words, even if it’s the right one.
If you’d rather go through that list with someone, the free intro call is thirty minutes. Bring whatever you know.