AI Data Privacy (Training on Your Data)

Why it matters in construction

A GC’s competitive advantage often sits in its information: which subs are reliable at what price, the real margins, which owners pay late, and what the last ten bids on a project type came in at. An AI precon tool can use that information, but it should not feed a model shared with competitors.

“Do you train on our data” is now a standard vendor question, and it should be. But the answer needs to be specific. The vendor’s own models, the model provider underneath the tool, and any subprocessors in between are three separate answers.

How it works

Data can be used in three ways, each with a different privacy profile:

1. Prompt and retrieval. The tool sends your document to the model as part of a request, the model answers, and the request is done. Whether the provider retains the request and whether they train on it are two separate policy questions.
2. Fine-tuning. A vendor trains a model on customer data to improve it. If that model is shared across customers, one customer’s data shapes another’s results. If it is per-customer, it does not.
3. Aggregate learning. A vendor uses patterns across customers, such as benchmarks or typical unit costs, without raw documents. This may be a product feature, but it still belongs in the agreement.

The controls to look for:

• A written commitment in the contract, not a web page, that customer data does not train shared models.
• The same commitment flowed down to the model provider. Business API agreements typically include this; consumer products typically do not.
• Retention limits on prompts and outputs.
• A SOC 2 report or equivalent that covers the AI components as well as the web app.
• Clarity on what happens to your data if you leave.

Example in practice

For example, a commercial GC is evaluating two AI estimating tools. Both say “we don’t train on your data” on their websites.

In the security questionnaire, vendor A confirms in the MSA that neither they nor their model provider trains on customer inputs, names the provider, shares a SOC 2 Type II report, and specifies 30-day prompt retention. Vendor B’s MSA is silent on training. Pressed, they explain they fine-tune a shared model on “anonymized” customer bid data. That model has absorbed three years of sub pricing from 40 GCs, some in the same market.

Vendor B may produce better unit-cost suggestions. The CFO decides the improvement is not worth putting the firm’s pricing history into a pool its competitors draw from and goes with vendor A.