Privacy Policy | Mistral AI

Welcome to Mistral AI! We know that your privacy is important, and we're committed to protecting it. This Privacy Policy explains, in a clear and simple way, how we collect, use, and protect your personal data when you use our generative AI Mistral AI Products such as Le Chat or Mistral AI Studio (the "Mistral AI Products").

Scope of this Privacy Policy. This Privacy Policy does not apply if you use our Mistral AI Products to process personal data in the context of your business activities. In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf.

1. Who collects your data?

Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used.

Who we are. Mistral AI is a French company incorporated in Paris, under number 952 418 325, having its registered offices at 15 rue des Halles, 75001 Paris (“We”, “Us” or “Mistral AI”).

How to contact us:

By sending us a letter at Mistral AI: Mistral AI, 15 rue des Halles, 75001 Paris, France.
For any other concerns, please consult our Help Center and the relevant contact forms.

How to contact our Data Protection Officer (DPO):

By using the “Privacy Requests” contact form available here
By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France.

2. What data do we collect?

2.1. Data you provide directly to us

Category of personal data	When do we collect your personal data ?
Civil Identity, such as your first and last name. Account data, such as the means to retrieve your password and to verify your account. Contact Data, such as your email address. Contract Data, such as the Mistral AI Product your subscribe to.	When you create your Mistral AI Account and subscribe to a Mistral AI Product.
Contact Data, such as your email address.	When you subscribe to receive our communications.
Payment and billing information, such as your invoices or your billing address.	When you subscribe to a paid Mistral AI Product
“Input”, any data you provide to generate an Output, such as prompts or fine-tuning data. “Feedback”, any information you provide when you rate an Output, such as “thumbs up” or “thumbs down", and the associated Input and Output.	When you use the Mistral AI Products

2.2. Personal data generated when you use the Mistral AI Products

Category of personal data

When do we collect your personal data ?

“Technical Data”, any log or technical data that your browser and device automatically send when you use the Mistral AI Products, such as your IP address or the type of network protocol you use.

Cookies listed here.

"Usage Data", any data that relates to how you use the Mistral AI Products.

“Output”, any content generated by the Mistral AI Products based on your Input.

When you use the Mistral AI Products

2.3. Personal data that is indirectly provided to us

Data publicly available on the Internet. Our artificial intelligence models are trained on data that is publicly available on the Internet by third parties, which may contain personal data, even if we use good practices to filter out such personal data.

Data provided by third-parties:

Hugging Face. If you download our artificial intelligence models on Hugging Face, we collect your username and email address to enforce our license and send you communications about our new models.
Third-Party Content. When you use certain features that interact with third party Mistral AI Products, such as Web Search or verified news on Le Chat, we may display content from third parties on Le Chat, such as links, thumbnails, or snippets (the "Third Party Content"). This content is displayed to help you understand the Output better. If you include personal data in your Input, personal data might also appear in the Third-Party Content. We do not use this Third-Party Content to train our models.
Training Datasets. In some cases, we access datasets provided by third parties for our model training purposes. These datasets may include personal data (even if such third parties and Mistral AI use good practices to filter out such personal data), proprietary data, or public data.

3. Why do we use your personal data?

Why we use your personal data	Categories of personal data	Lawful basis
To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms	Your Civil Identity Data Your Account Data Your Contract Data Your Technical Data Your Input, Output and Feedback Your Usage Data. Please note that we use part of your IP address to make your experience better, such as, for instance, to provide you with more accurate Outputs depending on where you use our Mistral AI Products. You can opt-out of this processing at any time through your user preferences on your Mistral AI Account.	The performance of the contract between you and Mistral AI
To enhance your experience on Le Chat via the Memory feature by providing you more relevant and personalized answers based on your past interactions with Le Chat. For more information about Memories, see our Help Center.	Your Input (prompts). If you include sensitive data in your Input, such as health details, this data may be stored as a Memory to provide you with more relevant and personalized answers.	Our legitimate interest to provide you with an enhanced and personalized service. Your explicit consent for any sensitive data explicitly included in your input and saved as a Memory. You can: Access, add, delete or edit your Memories at all time through your settings. Turn off Memories at all times through your settings. For more details about the controls you have on Memories, please see our Help Center.
Debugging	Your Input, Output and Feedback	The performance of the contract between you and Mistral AI.
To create and administer your Mistral AI Account	Your Civil Identity Data Your Account Data Your Contract Data	The performance of the contract between you and Mistral AI.
To provide customer support, including debugging and fixing errors reported by you	Your Civil Identity Data Your Contact Data Your Feedback Your Input and Output	The performance of the contract between you and Mistral AI.
To manage the security and integrity of the Mistral AI Products	Your Civil Identity Data Your Account Data Your Technical Data Your Contact Data Your Usage Data	To comply with our legal obligations. Our legitimate interests in managing the security and integrity of the Mistral AI Products.
To communicate with you, including to send you newsletters or non-marketing communications about the Mistral AI Products	Your Civil Identity Data Your Contact Data	Your consent, for marketing communications. The performance of the agreement, for all non-marketing communication (e.g. to send you notifications about changes to our terms).
To improve the Mistral AI Products or develop new products (but excluding model training), such as to conduct research or to make aggregated and anonymous statistics	Your Civil Identity Data Your Feedback Your Input and Output Aggregated and anonymous statistics	Our legitimate interest in continuously improving the Mistral AI Products and to introduce new features.
To train our artificial intelligence models (large language models) to answer questions, generate text, translate, summarize and correct text, classify text, analyze feelings, etc. according to context, Inputs (e-mails, letters, reports, computer code, etc.) and Outputs.	Personal data included in the data publicly available on the Internet, despite our efforts to filter out such personal data Your Input and Output, subject to your opt-out. Please note that we do not use your Input and Output to train our artificial intelligence models when you use Le Chat Team, Le Chat Enterprise or the paid version of our APIs. If you connect a third-party service to the Mistral AI Products, we do not use this third-party service to train our artificial intelligence models. Your Feedback.	Our legitimate interest in developing and providing state-of-the-art large language models as part of the Mistral AI Products.
To manage and enforce our Terms of Service and licenses, including moderation and abuse monitoring	Your Civil Identity Data Your Account Data Your Contact Data Your Input and Output Your Feedback	The performance of the contract between you and Mistral AI.
To manage our commercial relationship with you, including to process payments and manage billing	Your Civil Identity Data Your Account Data Your Contact Data Your Payment and Billing information	The performance of the agreement between you and Mistral AI. Our legal obligations.
To investigate and resolve disputes between you and Mistral AI	If applicable and depending on the dispute: Your Civil Identity Your Account Data Your Contact Data Your Contract Data Your Technical Data Your Usage Data Your Input, Output and Feedback Any other data necessary for the investigation or resolution of the dispute.	Our legitimate interest in protecting and exercising our legal rights. The performance of the Agreement between you and Mistral AI.
To reply to your requests to exercise your rights on your personal data	Your Civil Identity Data Your Account Data Your Contact Data Any other personal data included in your privacy request	Our legal obligation to reply to your requests.

4. Cookies

When you visit our website, we use cookies (small text files stored on your device) to enhance your experience on the Mistral AI Products. For more information about the way we use cookies, please see our Cookie Policy.

5. How long do we keep your personal data?

We store your personal data only as long as needed for the purposes described in Section 3 of this Privacy Policy. You will find the main applicable retention periods below, for illustrative purposes:

Data we use to provide Le Chat to you: we keep your Input and Output until you delete your account or until you delete the conversation from Le Chat.
Data we use to provide our APIs to you:
- Except for specific APIs, we keep your Input and Output for the period necessary to generate the Output and then for thirty (30) rolling days to monitor abuse (unless zero data retention is activated).
- If you use our Agents API, we keep your Input and Output until you terminate your account.
- If you use our Fine-Tuning API, we keep your fine-tuning data until you delete it from Mistral AI Studio or until you terminate your account.
Non-essential cookies data: only as long as you consent to their use.
Your contact data (used for marketing operations): only as long as you are subscribed to our newsletter.
Leads identity and contact data: for 3 years from collection.

Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below. Please note that the categories of personal data we retain longer will not be accessed or used by any member of our teams during their legal keeping periods, except to fulfill our legal obligations or in case of dispute or litigation (e.g. to recover an unpaid invoice). Once the legal retention periods have expired, we will permanently delete these categories of data.

Your Civil Identity Data (your first and last name, etc.): for 5 years after the termination of your Mistral AI account.
Account Data (such as the phone number or email address you provided to verify or change your account password, etc.): for 1 year after you delete your account.
Technical data (such as the types of protocols used to connect to our service, etc.): for 1 rolling year from the date of connection, for each operation contributing to the operation of connection.
Invoices and related correspondence: for 10 years from the close of the relevant financial yea
Contracts, commercial licenses to use our Models and contact details relating to both: we keep your data for the duration of the contract and for 5 years following the termination of the contract.
Data relating to dispute resolution: until the appeal period ends, provided that we may keep such data longer for archival purpose.
Data relating to your privacy requests: for the duration of processing the request and for 6 years following the request.
Technical support data: We keep your data until your request is processed and for 5 years for record-keeping.

6. Who do we share your personal data with?

We may share your personal data on a need-to-know basis with the following parties:

Our Team Members. Authorized members of our teams who need to access your personal data, strictly to perform their jobs
Financial Institutions. Banks and other financial organizations
Regulatory Authorities. Such as the French data protection authority (CNIL)
Legal and Professional services. When appropriate, we may share data with competent courts, mediators, accountants, auditors, lawyers, bailiffs, and debt collection agencies.

Additionally, we may share all or part of your personal data with our service providers. Before engaging with any provider which handles customer data, our security team conducts audits to ensure they meet our privacy and security standards, in accordance with our certifications.We sign a dedicated data protection agreement with each of these providers.

Our main providers are listed on our Trust Center.

7. Do we transfer Your Personal Data Outside of the European Union?

We prioritize selecting providers within the European Union that strictly adhere to the GDPR. However, in exceptional cases, we may opt for non-EU providers that meet our high standards of data security and Personal Data protection.

We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR. Additionally, we attach the most recent version of the European Commission’s Standard Contractual Clauses to all such contracts.

8. Your rights

You can exercise the following rights :

Access. You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center.
Portability. You have the right to obtain and transfer your personal data you provided to another entity. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center.
Rectification. You have the right to ask us to update or correct your personal data.
Deletion. You have the right to delete and/or ask us to delete your personal data. We’ve introduced a user control which allows you to delete your account at all times. For more information, please refer to our Help Center.
Objection. You have the right to object to the processing of your personal data. This right does not apply when we have a legal obligation to process your personal data. We’ve introduced a user control which allows you to object to the use of your input and output data for model training directly from your account. For more information, please refer to our Help Center.
Consent withdrawal. You have the right to withdraw your consent to the processing of your personal data at any time.
Limitation. You have the right to ask us to freeze the processing of your personal data.
Automated decision. You have the right to not be subject to an automated decision (including profiling) and to appeal such a decision. Mistral AI does not engage in profiling or automated decision-making in the processing of personal data.
Post mortem. You have the right to tell us how you would like us to process your personal data after your death.
Lodge a complaint. You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL).

We will take every step to make sure we reply to your requests. However, when your request concerns the training of our models, it’s important to note that your rights have technical limitations and fulfilling your requests might involve a complex technical process.

You can exercise these rights at all times:

By using the user controls which are available from your Mistral AI Account settings and which allow you to: delete your account at all times, obtain a copy of your data, object to the use of your input and output data for model training. For more information on these user controls, please refer to our Help Center.
By using the “Privacy Requests” contact form available here.
By sending us a letter at Mistral AI, Attn: Privacy Team, Mistral AI, 15 rue des Halles, 75001 Paris, France.

9. Additional Disclosures for U.S. Users

If you reside in California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, or Virginia, this section applies to you. This section serves as our California notice at collection.

Consumer Rights. Depending on the U.S. state where you reside and applicable exceptions, you may be entitled to exercise the following rights in relation to your personal data: (a) the right to know information about how we process your personal data and to access a copy of your personal data; (b) the right to request that we delete your personal data; (c) the right to request that we correct your personal data; (d) the right to be free from discrimination for exercising your rights; and (e) the right to appeal Mistral AI’s decision regarding your request.
No Sale, Sharing, or Targeted Advertising. Mistral AI has not “sold,” “shared,” or engaged in “targeted advertising” with (as those terms are defined under U.S. state privacy laws) any personal data of consumers in the preceding 12 months, including of any consumer that we know is under 18 years old.
Sensitive Personal Data. To the extent you voluntarily provide any sensitive personal data to Mistral AI, we will only process such data as permitted by applicable law and, for clarity, not in a way that gives rise to a right to limit under those laws.
Exercising Your Rights. You may exercise any available rights through the process described below. Please note that some types of requests require your successful completion of identity verification steps before we can fulfill the request.
- Directly with Mistral AI. You may submit a request to exercise your rights by emailing us here or through our online form. We require evidence of your identity to process your request, which may include authenticating your account with us depending on the nature of your request.
- Through an Authorized Agent. You may exercise your available rights through an authorized agent that you appoint. Your authorized agent will be required to submit evidence of your authorization and your identity. Depending on the nature of your request and the evidence provided, we may also require you to independently verify your identity with us, including authenticating your account for the Mistral AI Products.
Appealing a Decision. You may appeal our response to your request by emailing us here with the subject line “US Rights Response Appeal”.
Retention. We retain your personal data as described in Section 5 (How long do we keep your personal data?) above.
Training Information. We use and have used a mix of proprietary and third-party data to train the artificial intelligence models used in the Mistral AI Products for improved performance, which can include information in a variety of formats (such as text or images) from publicly available datasets and internet sources, non-public third-party databases, your use of our products (to the extent permitted by our applicable terms), internally generated data, curated datasets, and synthetic data. Such collection and training began in 2023, is ongoing, and is used to improve our artificial intelligence models. In some cases, this includes cleaning, processing, or modifying such datasets to optimize their effectiveness prior to use in the training process. Our training datasets may include aggregated consumer information.
Additional Information. The following details supplement the above information in Section 2 (What data do we collect?), Section 3 (Why do we use your personal data?), and Section 6 (Who do we share your personal data with?) using terminology of applicable state law:

Disclosure Category	Details
Sources of personal data	Provided directly by you. Generated when you use the Mistral AI Products. Data publicly available on the Internet. Data provided by third parties (e.g., third-party content and training datasets).
Categories of personal data that Mistral AI collects about consumers	Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. Internet or other electronic network activity information, including information regarding your interaction with the Mistral AI Products and our website. Commercial information, such as purchase history and your payment and billing information. Audio, electronic, visual, or similar information.
Categories of personal data Mistral AI discloses about consumers for a business purpose	Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. Internet or other electronic network activity information, including information regarding your interaction with the Mistral AI Products and our website. Commercial information, such as products you subscribe to and your payment and billing information. Audio, electronic, visual, or similar information.
Mistral AI’s business or commercial purposes for collecting personal data	Helping to ensure the security and integrity of the Mistral AI Products. Debugging to identify and repair errors that impair existing intended functionality. Short-term, transient use. Performing services related to a consumer’s use of the Mistral AI Products, such as maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing analytic services, providing storage, or similar services. Providing advertising and marketing services. Undertaking internal research for technological development and demonstration. Undertaking activities to verify or maintain the quality or safety of the Mistral AI Products, and to improve, upgrade, or enhance the Mistral AI Products.

10. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time as our products continuously evolve. Make sure to check this Privacy Policy frequently.