Can nonprofits use ChatGPT with donor data? A threat model for donor and client records

The Morse teamPublished November 12, 20269 min read

Yes, nonprofits can use ChatGPT with donor data, but only on a workspace the organization owns, and a staffer's personal account isn't one. As of November 12, 2026, OpenAI, Anthropic, Google, and Microsoft all sell nonprofits discounted business plans that keep chats out of model training by default, while the free and personal plans staff tend to reach for first may train on what they're given. The AFP's fundraising code treats donor information as the organization's confidential property, and the UK's Fundraising Regulator advises against putting anything not already public into publicly available AI.

We read the four companies' nonprofit pages, pricing pages, and privacy pages on November 12, 2026, along with the UK Fundraising Regulator's AI guidance, the Charity Commission's post on AI, the Association of Fundraising Professionals' Code of Ethical Standards, and the FTC's order against Blackbaud. This isn't legal advice. The vendors deserve credit. Every one of these nonprofit offers starts with no training on your data, a stronger default than the same companies' personal plans.

Can staff paste donor records into their personal ChatGPT?

Under the main fundraising codes, likely not. The AFP Code of Ethical Standards, amended in December 2023, asks members to "protect from disclosure confidential information to unauthorized parties" (standard 19), and says donor and prospect information "is the confidential intellectual property of that organization and may not be taken, shared with, or transferred to other entities" (standard 20) (AFP). The Code never mentions AI, but a gift history pasted into a fundraiser's own chatbot account could count as a transfer to another entity.

The UK is blunter. The Fundraising Regulator's guidance on AI, published December 8, 2025, says: "We recommend you do not feed information not already in the public domain into publicly available or open access AI." It also asks charities to "make sure you know how any AI tool will use, store and share the material you use to train and prompt it" (Fundraising Regulator). The Charity Commission said in April 2024 that it doesn't plan AI-specific guidance, but warned that "some AI tools handle data in less secure ways than others," and that charities whose beneficiaries include children, or that "hold sensitive data like medical information," need to be "particularly mindful" (Charity Commission).

OpenAI's own consumer page explains why. It says OpenAI "may use content submitted to ChatGPT and our other services for individuals to improve model performance," that authorized staff and "trusted service providers" may access content for abuse, support, legal matters, or model improvement unless you opt out, and it asks: "Please do not enter sensitive information that you would not want reviewed or used" (OpenAI). The pricing page marks its personal plans with "Content is used to train our models" (OpenAI).

Does OpenAI for Nonprofits train on your data?

No. OpenAI's nonprofit help page says that on ChatGPT Business and Enterprise "we do not train on your data or conversations, and our models don't learn from your usage" (OpenAI). The program launched on May 30, 2024 at 20% off Business, and an update dated February 6, 2026 raised it to "up to a 75% discount" (OpenAI). As of November 12, 2026, that means Business Standard seats at $8 per user a month billed yearly, or $10 monthly. Premium seats get no discount, eligibility is checked by Goodstack, and the discount doesn't extend to the API.

OpenAI's help page also says, "We do not offer BAAs for ChatGPT Business." A health or behavioral health nonprofit that needs a Business Associate Agreement under HIPAA has to talk to sales about Enterprise, so the discounted self-serve plan is the wrong home for patient information.

Business also changes who inside your organization can read a chat. OpenAI's privacy page says workspace admins "can view, access, export, and delete end user conversations," that OpenAI's own access includes "specialized third-party contractors" bound by confidentiality, "solely to review for abuse and misuse," and that deleted chats leave its systems within 30 days "unless longer retention is required by law" (OpenAI). A development director's chats about a major donor are readable by whoever runs the workspace. We go through those admin rights in is ChatGPT Business private.

What does Claude for Nonprofits include?

Up to 75% off Claude's Team and Enterprise plans, three nonprofit connectors, and a free course. Anthropic launched it with GivingTuesday on December 2, 2025, with connectors to Blackbaud ("CRM and fundraising tools for donor management"), Candid, and Benevity (Anthropic). As of November 12, 2026, the nonprofit Team plan is $8 per user a month, or $3 for nonprofits based in low- or middle-income countries, for 2 to 150 seats, and Anthropic's page promises "no training on data by default" (Claude). Eligibility covers 501(c)(3) organizations and their international equivalents, K-12 schools, and some healthcare providers, such as Federally Qualified Health Centers.

The two plans split on retention. "Custom data retention controls" appear in the Enterprise column on that page and not in Team's, so check how long a Team workspace keeps chats before client stories go into it.

Is Gemini free for nonprofits, and is it private?

The Gemini app is free, and Google's business privacy terms cover it. Google Workspace for Nonprofits costs $0 per user and covers up to 2,000 users, with Business Standard at $3.50 a user a month for nonprofits (Google for Nonprofits). Google's feature comparison shows the free nonprofit edition gets the Gemini app "with enterprise-grade security & privacy," but not Help me write in Gmail or Docs or the Gemini side panels, which start at Business Standard (Google).

Google's Workspace privacy hub, last updated October 6, 2026, says chats and uploaded files in the Gemini app "won't be reviewed by human reviewers or otherwise used to train generative AI models outside of your domain without your permission." Admins choose whether chats are saved and for how long. They can auto-delete after 3, 18, or 36 months, and "the default is 18 months." With history off, new chats are still kept "for up to 72 hours" (Google). Unless someone changes that setting or deletes the chat, a beneficiary's details typed into Gemini can stay in your Workspace for a year and a half.

Does Microsoft Copilot have a nonprofit discount?

Yes, though a smaller one than its Office discount. Microsoft offers Microsoft 365 Business Premium "now 75% off for eligible nonprofits," with Copilot Chat included (Microsoft). Its nonprofit pricing page lists Microsoft 365 E3 at $9.75 a user a month, says Copilot Chat comes "at no additional cost" with an eligible Microsoft 365 subscription, and offers the full Microsoft 365 Copilot at "a 15% discount for eligible nonprofits" (Microsoft).

Microsoft's enterprise data protection page, updated November 4, 2026, says prompts and responses "aren't used to train foundation models" and fall under its Data Protection Addendum. Web searches are the exception. Queries sent to Bing are covered by the Microsoft Services Agreement, with Microsoft acting "as an independent data controller," and HIPAA compliance "doesn't apply to web search queries" (Microsoft). Microsoft says those queries are shortened and sent without user or tenant identifiers, but a question that names a client and triggers a search sends some of that question outside your contract. We cover the rest of Copilot's settings in is Copilot private.

Who are you protecting donor and client records from?

Four readers, and each plan handles them differently. Every vendor claim links to a page read on November 12, 2026.

In May 2024 the FTC finalized an order against Blackbaud, the fundraising software company, over its 2020 breach. The FTC alleged that a hacker went undetected for three months and removed "massive amounts of unencrypted sensitive consumer data," including Social Security and bank account numbers, and the order requires Blackbaud to "delete data that it no longer needs" (FTC). Those are the FTC's allegations, resolved by a settlement order. AI chats that are kept can be taken the same way, and chats that stay in a workspace can be subpoenaed, as we cover in can AI chats be subpoenaed.

Each kind of record has its own worst-case reader:

• Donor records (names, gift history, wealth screening notes): the AI company and anyone it shares with. They belong in your CRM, and only inside your organization's own workspace if an AI needs to touch them.
• Beneficiary and client case data: a court or a breach, because it can harm someone who never chose your vendor. Social service agencies face rules of their own, which we cover in can social workers use ChatGPT.
• Volunteer and staff data (background checks, HR notes, addresses): your own colleagues, since an admin can export chats. Our guide to what your employer can see in AI tools covers the workplace side.
• Grant drafts: the lowest risk of the four, unless they quote a funder's confidential terms or a client's story.

How to draft for your nonprofit without the donor file on someone else's server

Every row of that table describes a readable copy of your chat sitting on a company's servers, either under the AI vendor's terms or inside a workspace your admins can export. A nonprofit discount lowers the price of that copy and leaves it on the same servers. Morse is built so your chat history stays on your own device, stored only in your browser and encrypted, and not on Morse's servers.

• Private, for grant drafts, the lowest-risk record above, with no AI host keeping a copy. It's the default for a new chat. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run with zero data retention, because Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't. The history sits in your browser, encrypted, not on Morse's servers.
• E2EE, for the beneficiary story a court or a breach would do the most harm with. If your organization's AI policy allows it, take the names out and start the chat in E2EE when a grant report needs a client's story. Your browser checks the secure enclave's proof that it's genuine before anything leaves your device, then encrypts the message so only that enclave can read it, and Morse's servers relay text they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE chats come with Pro, at $19 a month.
• Anonymous, to ask GPT, Claude, or Gemini about a funder's guidelines or the Fundraising Regulator's rules without a staff login attached. Morse's proxy removes your account, email, and IP address and sends the question under Morse's own account, so the provider sees it without knowing it's you. It may keep the message for a limited time to check for abuse, under its own policy, so leave donor and client details out of this mode.

In every mode, Morse doesn't train AI on your content, sell your data, or show ads, so there's no training setting to find. Because we don't store chats, we usually have very little to give authorities. A donor's name and gift history still belong in your CRM, under your organization's own policy. Clearing your browser or losing the device deletes your chats, and Morse can't recover them, so paste the finished proposal into your organization's files.

Try a chat from the Morse home page without an account, or start free and move to Pro when a report needs E2EE.