A company is selecting a Copilot plan for confidential development. An engineer says that putting "do not use this code for training" in a prompt is enough to set the company's data-handling policy. What is the best response?

1. Assume all Copilot plans have identical data usage and retention terms.
2. Evaluate the applicable plan terms, privacy settings, and organization controls; a prompt does not replace those service-level policies.
3. Repeat the sentence in every source-code comment to make it legally binding on the service.
4. Use a repository instruction file as the only record of the company's selected privacy settings.