# Claude Governance for Marketing Teams: Privacy and Approvals

> Set Claude rules for a marketing team: what data goes in, privacy and training settings by plan, Usage Policy limits, brand safety checks and approvals.

Source: https://mentionx.ai/learn/claude/claude-marketing-governance-privacy  
Author: Dipuck Jones, founder of MentionX  
Updated: 3 November 2026  
Level: Practitioner

**Governing Claude in a marketing team comes down to four decisions: which account people use for work, what data may go in, what the content may never do, and who approves what before it ships.** Anthropic's own rules give you the boundaries. Consumer plans have a training setting you control, Team and Enterprise data isn't used for training by default, and the Usage Policy bans fake reviews, sock-puppet accounts and spam outright. Your job is to turn those into a one-page policy people will actually follow.

> **Key takeaways**
>
> - Use a Team or Enterprise account for company work; on those plans the organisation controls the data and Anthropic doesn't train on it by default.
> - On individual plans (Free, Pro, Max), check Settings > Privacy: the model training setting decides whether new chats can train future models.
> - Incognito chats aren't saved to history or memory and aren't used for training, on every plan.
> - The Usage Policy bans fake reviews, astroturfing, impersonation and spam. Put those lines in your team policy word for word.
> - Approvals should scale with risk: a social reply needs less review than a pricing claim or a customer quote.

*Checked 3 November 2026 (CET) against Anthropic's help centre, privacy centre and Usage Policy. "Our view" marks MentionX opinion. Ledgerline is a fictional company used for illustration. This lesson isn't legal advice.*

## Why does a marketing team need Claude rules at all?

Marketing is the team most likely to paste customer data, unreleased plans and competitor material into an AI tool, and the team whose output goes straight to the public. Without rules, three things tend to happen: people use personal accounts for company work, someone pastes a customer list to "personalise" an email, and a claim nobody checked ends up in an ad.

None of that needs a long policy. It needs a page that answers the questions people actually have, plus a habit of checking the riskiest content before it ships.

*Our view:* a short policy that people read beats a thorough one they don't. If yours runs past two pages, split the detail into an appendix.

## Which account should people use for work?

This is the most important decision, because data handling differs by plan.

| Plan type | Who controls the data | Training on your chats |
| --- | --- | --- |
| Free, Pro, Max, Ultra (individual plans) | The individual user | Controlled by the user's model training setting |
| Team, Enterprise (Claude for Work) | The organisation, as controller | Not used for training by default, unless you join the Development Partner Program |

On Team and Enterprise plans, Anthropic says the customer is the "Controller" of data its users submit, can export conversation history, and that Anthropic only processes the data to provide the service ([Anthropic](https://support.claude.com/en/articles/9267385-does-anthropic-act-as-a-data-processor-or-controller)). That's what most legal and security teams want for company work.

If some people use personal Pro or Max accounts, say plainly what they may and may not put into them. A reasonable default is public information and their own drafts only, with no customer data and nothing under NDA.

## What do the privacy settings actually do?

On consumer plans, Anthropic's privacy centre describes a model improvement setting under Settings > Privacy. When it's on, new or resumed chats may be used to train future models and kept in de-identified form for up to five years. When it's off, new chats aren't used for future training, though data already in training runs or trained models stays there ([Anthropic Privacy Center](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data)).

A few details matter for marketers:

- **Deleting a chat** removes it from history immediately and from back-end storage within 30 days, and deleted chats aren't used for future training.
- **Thumbs up or down feedback** stores the whole related conversation for up to five years, so don't rate conversations that contain anything sensitive.
- **Connector content** such as raw Google Drive files isn't included in training data, but anything you copy directly into the chat can be ([Anthropic Privacy Center](https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training)).
- **Incognito chats** aren't saved to history or memory and aren't used for training, even with model improvement turned on. They're available on all plans ([Anthropic](https://support.claude.com/en/articles/12260368-use-incognito-chats)).
- **Flagged chats** are different: if safety systems flag a chat as violating the Usage Policy, Anthropic says it may keep inputs and outputs for up to two years.

On Enterprise plans, owners can set custom retention periods, with a minimum of 30 days ([Anthropic](https://support.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans)).

## What data should never go into Claude?

Anthropic recommends care with highly sensitive details: financial information such as card and bank numbers, health records, passwords and login credentials, and confidential documents ([Anthropic](https://support.claude.com/en/articles/8325621-i-would-like-to-input-sensitive-data-into-my-chats-with-claude-who-can-view-my-conversations)). For a marketing team, turn that into three tiers:

| Tier | Examples | Rule |
| --- | --- | --- |
| Green | Published pages, public reviews, your own drafts, anonymised survey results | Any approved account |
| Amber | Unreleased campaigns, pricing plans, aggregate CRM exports, interview transcripts | Team or Enterprise account only; remove names first |
| Red | Customer lists with emails, payment data, health data, passwords, anything under NDA | Never, unless legal has approved a specific setup |

The most common slip is the "just this once" CRM export. Before analysing one, strip columns you don't need. For most questions, segment, stage and dates are enough; names and emails rarely are.

```
Before we start: list every column in this file and tell me
which ones look like personal data (names, emails, phone
numbers, addresses, IDs that identify a person). Don't analyse
anything yet. I'll remove those columns and re-upload.
```

## What does Anthropic's Usage Policy rule out for marketers?

Most marketing work is nowhere near the line, but a few prohibitions apply directly. Anthropic's Usage Policy bans using Claude to:

- create fake personas, accounts or organisations to mislead people about how widely a view is held, with "sockpuppets, astroturfing, fake reviews, or bots that claim to be human" given as examples;
- impersonate real people or organisations, apart from clearly disclosed parody, satire or fiction;
- distribute content through networks of supposedly independent sites or accounts that hide a common source;
- promote or generate spam, or use automation to create accounts or behave in spammy ways;
- create content that falsely appears to come from a real candidate, official, campaign or news outlet ([Anthropic Usage Policy](https://www.anthropic.com/legal/aup)).

Put these in your policy in plain words: no fake reviews, no review-gating scripts that pretend to be customers, no "independent" blogs that are really yours, no bulk outreach that breaks spam rules. They're also the tactics that damage a brand fastest when found.

## How do you set approvals without slowing everything down?

Match the review to the risk. Most teams need three levels:

| Level | Content | Who checks | What they check |
| --- | --- | --- | --- |
| Light | Social replies, internal docs, first drafts | The author | Tone, obvious errors |
| Standard | Blog posts, emails, ads, landing pages | A second marketer | Facts, links, brand voice, claims |
| Full | Pricing, legal or regulated claims, comparisons naming competitors, customer quotes, press | Marketing lead plus legal or product | Every claim against a source; permissions |

AI help doesn't change the level. A pricing page drafted by hand and one drafted with Claude need the same review. What changes is the kind of error to watch for: Claude drafts can contain confident claims with no source, outdated product facts, and statistics that sound right but can't be traced. Lesson 9 covers the fact-checking routine in detail.

Ask Claude to help you review its own work before a person does:

```
Review this draft before it goes to approval. List:
1. Every factual claim, with the source I gave you for it,
   or "NO SOURCE" if there isn't one.
2. Any comparison with another company.
3. Any quote or testimonial, and where it came from.
4. Any promise about results, pricing or guarantees.
Don't rewrite anything. Just produce the list.
```

## How do you keep brand safety in Claude's output?

Brand safety problems with AI drafts are usually subtle: a claim slightly stronger than your product supports, a competitor described unfairly, a tone that's off for a sensitive moment. Three habits help.

**Put the rules in the project.** In the brand voice project from lesson 4, add a short "never" list: claims you can't make, words legal has banned, topics to avoid, and how to refer to competitors. Claude follows project instructions in every chat inside it.

**Keep a fact sheet.** A single document with current pricing, limits, integrations and approved proof points, dated and owned by product marketing. Tell Claude to use only facts from it and to flag anything else.

**Check timing.** Claude doesn't know what happened in the news this morning unless it searches. Before a scheduled post goes out during a crisis or major event, a person should look at it again.

> **Pro move:** add a line to your project instructions: "If a draft needs a fact that isn't in the fact sheet, write [CHECK: what's needed] instead of guessing." Reviewers can then search for "CHECK" before approval, and the gaps are obvious rather than hidden in fluent prose.

## What should your one-page policy say?

Here's a template you can adapt. Ask Claude to fill it in from your existing security and brand guidelines, then have legal review it.

```
CLAUDE USE POLICY: MARKETING (v1, owner: [name], review: [date])

1. Accounts: use the company [Team/Enterprise] account for all
   work. Personal accounts: public information only.
2. Data: Green / Amber / Red tiers (see table). When unsure,
   treat as Red and ask [name].
3. Never: fake reviews or testimonials, fake personas or
   accounts, undisclosed impersonation, spam, content that
   appears to come from someone who didn't write it.
4. Facts: every claim in published content must trace to the
   fact sheet or a source. Mark gaps [CHECK].
5. Approvals: Light / Standard / Full (see table).
6. Customer quotes: only with written permission.
7. Settings: don't rate chats that contain Amber data. Use
   incognito chats for one-off tests.
8. Questions and incidents: [channel or person].
```

Review the policy every six months, or sooner when Anthropic changes its terms or your team adds a connector that reaches new data.

## How do connectors change the risk?

Connectors let Claude read and sometimes act in tools like Google Drive, Gmail or your CRM. That's useful, but it widens what Claude can reach. On Team and Enterprise plans, an owner must enable connectors at the organisation level before members can use them, and owners decide whether members can let Claude send or change things without asking each time ([Anthropic](https://support.claude.com/en/articles/10166901-use-google-workspace-connectors)).

For a marketing team, a sensible starting point is read-only access to shared marketing folders, with actions that send email, post or change records requiring approval every time. Lesson 13 explains how connectors work and how to judge one before turning it on.

## Worked example: Ledgerline writes its policy

*Ledgerline is a fictional accounts-payable tool. Details are illustrative.*

Ledgerline's five-person marketing team had been using a mix of personal accounts. The head of marketing moved everyone to the company Team account, wrote the one-page policy above and ran a 30-minute session on the data tiers.

Two rules did most of the work. First, CRM exports go into Claude only after the name, email and company columns are removed. Second, any draft that compares Ledgerline with Competitor A or Competitor B goes to full review, because an earlier blog post had described a competitor feature that had since changed.

Within a month, reviewers were finding most issues through the [CHECK] markers rather than by reading every line, and approvals for standard content got faster, not slower.

## What should you check before the next lesson?

- Which account each person uses for work, and whether that's what you want.
- The model training setting on any consumer accounts used for marketing.
- Your Green, Amber and Red examples, written down.
- The Usage Policy bans copied into your policy.
- An approval level for each content type you publish.

Next: [A Claude prompt library for marketers](https://mentionx.ai/learn/claude/claude-prompt-library-marketers). Or return to the [Claude for Marketers track](https://mentionx.ai/learn/claude/claude-for-marketers).

## Common questions

**Does Anthropic train on my marketing team's Claude chats?** It depends on the plan. On individual plans such as Free, Pro and Max, a privacy setting controls whether new chats can be used for training. On Team and Enterprise, Anthropic says it doesn't train on your data unless you join its Development Partner Program.

**Can we paste customer data into Claude?** Only if your company's data rules allow it for that plan. Anthropic itself advises care with sensitive details such as financial data, health information and credentials. Use a Team or Enterprise account for work data and remove personal details you don't need.

**Do we have to disclose that content was written with AI?** Anthropic's Usage Policy bans content that misleads people about its origin, such as fake reviews or personas, rather than requiring a label on all AI-assisted copy. Laws and platform rules in your markets may add disclosure duties, so check with legal.

## Sources

- Anthropic Privacy Center, [How long do you store my data?](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data)
- Anthropic Privacy Center, [Is my data used for model training?](https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training)
- Anthropic Privacy Center, [How do I change my model improvement privacy settings?](https://privacy.claude.com/en/articles/12109829-how-do-i-change-my-model-improvement-privacy-settings)
- Anthropic Help Center, [Does Anthropic act as a data processor or controller?](https://support.claude.com/en/articles/9267385-does-anthropic-act-as-a-data-processor-or-controller)
- Anthropic Help Center, [Configure custom data retention controls for Enterprise plans](https://support.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans)
- Anthropic Help Center, [I would like to input sensitive data into my chats with Claude. Who can view my conversations?](https://support.claude.com/en/articles/8325621-i-would-like-to-input-sensitive-data-into-my-chats-with-claude-who-can-view-my-conversations)
- Anthropic Help Center, [Use incognito chats](https://support.claude.com/en/articles/12260368-use-incognito-chats)
- Anthropic Help Center, [Use Google Workspace connectors](https://support.claude.com/en/articles/10166901-use-google-workspace-connectors)
- Anthropic, [Usage Policy](https://www.anthropic.com/legal/aup)
All accessed 3 Nov 2026.

## Frequently asked questions

### Does Anthropic train on my marketing team's Claude chats?

It depends on the plan. On individual plans such as Free, Pro and Max, a privacy setting controls whether new chats can be used for training. On Team and Enterprise, Anthropic says it doesn't train on your data unless you join its Development Partner Program.

### Can we paste customer data into Claude?

Only if your company's data rules allow it for that plan. Anthropic itself advises care with sensitive details such as financial data, health information and credentials. Use a Team or Enterprise account for work data and remove personal details you don't need.

### Do we have to disclose that content was written with AI?

Anthropic's Usage Policy bans content that misleads people about its origin, such as fake reviews or personas, rather than requiring a label on all AI-assisted copy. Laws and platform rules in your markets may add disclosure duties, so check with legal.

---

Written and reviewed by Dipuck Jones for MentionX Learn. The HTML version of this page: https://mentionx.ai/learn/claude/claude-marketing-governance-privacy