You cannot audit what a free model tier does with your prompt after the request leaves your process. You can audit what your own pipeline put into that request, and that is the only evidence you can collect without a contract, a lawyer, or a vendor's retention page. What follows is a small, reproducible workflow that produces that evidence in about a minute per run, and it will tell you more than any privacy FAQ will.

Flip the direction of the audit

Most teams start with the vendor's data-retention paragraph and try to read it charitably. That paragraph is a claim written by the party with the least incentive to be specific, and it can change between the day you read it and the day you ship. Your side of the boundary is measurable: fixtures, logs, trace exports, build artifacts, cache directories, container layers.…