Mistral AI

The consumer terms are explicit that the user retains all ownership rights in their Input. Mistral takes only a license to use the data for defined purposes, not ownership.

Users own all Output, and Mistral affirmatively assigns any interest it may have in the Output to the user. A caveat is that Outputs are not guaranteed to be unique and may be identical to other users' results.

Mistral trains its models on user Input and Output by default for free-tier, Vibe Pro and Vibe Student users unless they opt out, and always uses Feedback (and its associated Input/Output) for training. An opt-out control is provided, which mitigates the risk, but training-by-default for these tiers plus mandatory Feedback use makes this a moderate concern.

The Privacy Policy provides an unusually detailed, itemised retention schedule covering conversations, API data (30 rolling days for abuse monitoring unless zero data retention is active), fine-tuning data, and legally mandated periods. Users can delete their account and conversations at any time via account controls, and a zero-data-retention option exists for certain APIs.

Sharing is limited to need-to-know recipients (team members, financial institutions, regulators, legal/professional services) and vetted sub-processors bound by data protection agreements, with a Trust Center sub-processor list referenced. The policy affirmatively states no sale, sharing (in the statutory sense) or targeted advertising has occurred in the preceding 12 months.

The policy provides concrete opt-out mechanisms: a user control to object to use of Input/Output for model training, controls to turn off the Memory feature, and the ability to opt out of IP-based personalization. Marketing communications are consent-based and withdrawable.

The documents demonstrate clear GDPR alignment (French controller, CNIL, SCCs, Article 46 safeguards, lawful bases) and address US state privacy laws (CCPA/CPRA and multiple other states). However, no specific security/AI attestation (SOC 2, ISO 27001, ISO 42001) is named in the supplied text — the policy references 'our certifications' and a Trust Center without naming any framework, so those remain unverifiable here.

The policy states Mistral does not engage in profiling or automated decision-making and references a Usage Policy commitment to transparency, and the Partner-Served terms include watermarking/traceability for weight access. However, there is no substantive commitment to enterprise model auditing or explainability of model behavior in the consumer documents.

A Trust Center is referenced and the policy mentions security audits of sub-processors, watermarking of model weights, and a security-incident notification obligation for weight holders. However, the supplied documents disclose no specifics on encryption at rest/in transit, penetration testing, bug bounty, or breach history, and reference the vendor's own 'certifications' without naming them.

The consumer terms reveal a material tier difference within the consumer space: free, Vibe Pro and Vibe Student data is used for training by default (opt-out available), while other paid usage is not trained on except via Feedback/moderation. The Partner-Served terms confirm that data used via cloud partners/own infrastructure is never used for training, indicating a favourable delta for infrastructure-served/enterprise deployments.

Mistral reserves the right to monitor use through automated means and to review content flagged by moderation, and staff may access Input/Output for customer support, debugging and abuse enforcement. The policy states legally-retained data will not be accessed except for legal obligations or disputes, but human review for support and moderation is clearly contemplated.

The documents disclose that Mistral may share data with regulators (CNIL), courts, and law enforcement, and will report illegal activity and CSAM to authorities. There are no disclosures of actual litigation or government data-request volumes, but cooperation with legal/governmental orders is expressly contemplated.

Mistral collects a broad but disclosed range of PII (name, email, IP address, technical/usage data, billing information) with stated lawful bases and purpose limitation. Notably, sensitive personal data voluntarily included in prompts may be stored as a 'Memory' with explicit consent, and the US-user section states SPI is processed only as permitted by law — significant PII plus optional SPI handling with disclosure and controls places this at moderate risk.

The Privacy Policy is current in substance — it addresses AI/LLM training, third-party model interactions, MCP servers, integrations, fine-tuning and the Memory feature, matching the AI-first products (Vibe, Studio, Forge) visible in the product surface. However, no explicit effective or last-updated date appears anywhere in the supplied documents, which caps the rating at YELLOW and prevents a recency determination.

Multiple documents were supplied (Privacy Policy, Partner-Served Terms, RoW Consumer Terms, Usage Policy). The training-use statements are consistent and complementary across them — the consumer terms describe training-by-default with opt-out for certain tiers, while the Partner-Served terms describe a distinct no-training/no-access model for infrastructure-served deployments. No genuine contradictions were identified across the documents.