Cohere
What Cohere keeps, for how long, whether it trains on it, and what rights you grant, for Cohere API / SaaS Platform: trial accounts (no payment method on file), Cohere SaaS Platform: paying and enterprise customers, Private and third-party cloud deployments (VPC, on-premises, Model Vault, OCI/Azure/AWS/GCP). Each answer quotes Cohere's own policy.
- Cohere API / SaaS Platform: trial accounts (no payment method on file)
- Cohere SaaS Platform: paying and enterprise customers
- Private and third-party cloud deployments (VPC, on-premises, Model Vault, OCI/Azure/AWS/GCP)
- Notes
- Open questions
- Documents
Cohere API / SaaS Platform: trial accounts (no payment method on file) API
- Default retention How long prompts and chats are kept
-
Not stated No retention period is given for trial inputs and outputs. The 30-day figure in the policies is stated only for Enterprise (paying) Users.
- After you delete How long until it is gone
-
Stated You can self-delete your account, and email privacy@cohere.com to delete inputs that contain personal information. No timeframe is given for trial users.
What the policies say (2 quotes)
"You can delete your account at any time by selecting “Your Profile” in the Platform, navigating to the “Danger Zone” tab, and clicking on “Delete my Account”."
Privacy Policycohere.comcaptured 2026-11-08"If personal information is inadvertently included in an input, deletion can be requested by emailing privacy@cohere.com as set out below."
Privacy Policycohere.comcaptured 2026-11-08 - Kept longer when Safety flags, legal holds, backups
-
Stated Data is kept as long as needed for business or legal reasons, including litigation holds, with no fixed periods. De-identified data can be kept and used for research.
What the policies say (3 quotes)
"We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to meet business or legal requirements, and as otherwise permitted or required by applicable law, including litigation holds."
Privacy Policycohere.comcaptured 2026-11-08"there is not typically a fixed retention period that will always apply to a particular category of personal information."
Privacy Policycohere.comcaptured 2026-11-08"We may use De-Identified Information for the purposes described above, such as research, product development, marketing purposes"
Privacy Policycohere.comcaptured 2026-11-08 - Zero data retention Whether it exists and who can get it
-
Stated Not available to trial users. Cohere offers ZDR only to enterprise customers who make extra commitments about their usage.
What the policy says
"we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Trains on your data By default
-
Stated Yes in effect: Cohere may use de-identified trial inputs and outputs for research and to improve model performance and safety. For EU/UK users it relies on legitimate interests, not consent.
What the policies say (4 quotes)
"We may use this input and output data to conduct research and development. This includes analyzing usage trends and using inputs/outputs to improve the performance and safety of Cohere Products."
Privacy Policycohere.comcaptured 2026-11-08"Cohere takes steps to de-identify input and output data prior to any use for research and development purposes."
Privacy Policycohere.comcaptured 2026-11-08"Section 2.3 (Research and Model Improvement): Analyzing usage patterns and using Trial or Research User Inputs/Outputs to improve the performance and safety of our AI models."
Privacy Policycohere.comcaptured 2026-11-08"Legitimate Interests: We process your data based on our legitimate interests in operating, securing, and improving our business and AI technologies, including enhancing the performance, reliability, and safety of our AI models."
Privacy Policycohere.comcaptured 2026-11-08 - Opting out How, and what it doesn't cover
-
Inferred No opt-out is described for trial users. The dashboard training toggle is documented in the Enterprise Data Commitments, which apply only to paying customers, so trial users may lack it.
What the policies say (2 quotes)
"Our Enterprise Data Commitments apply to enterprise data of our commercial, paying customers. For the SaaS Platform, this means customers who have a credit card on file in their account."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Enterprise customers can access opt out toggle in the [Cohere dashboard settings.](https://dashboard.cohere.com/data-retention)"
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Human review Whether people read conversations
-
Not stated The policies that cover trial users don't say whether people read prompts or outputs.
- Memory Remembered facts and profiles
-
Not stated Not addressed in the captured policies.
- Connected apps Email, calendar, drive
-
Not stated Not addressed in the captured policies.
- Agent actions Actions taken, browsing, credentials
-
Not stated Not addressed in the captured policies.
- Your inputs Who owns them
-
Inferred Not said outright. You grant Cohere a license to what you submit, which implies you keep ownership, and you must only upload data you hold rights to.
What the policies say (2 quotes)
"YOU GRANT US A NONEXCLUSIVE, WORLDWIDE, ROYALTY-FREE, IRREVOCABLE, SUBLICENSABLE, AND FULLY PAID-UP RIGHT TO ACCESS, COLLECT, USE, PROCESS, STORE, DISCLOSE AND TRANSMIT ANY DATA, INFORMATION, CONTENT, RECORDS OR FILES"
Terms of Usecohere.comcaptured 2026-11-08"upload and disseminate only data to which you own all required rights under law and do so only consistent with applicable law;"
Terms of Usecohere.comcaptured 2026-11-08 - Outputs Who owns them
-
Not stated The Terms of Use don't say who owns model outputs.
- License you grant Scope, and whether it is perpetual
-
Stated Irrevocable, worldwide, sublicensable, royalty-free license to everything you submit: to run the service, enforce terms, and improve Cohere's offerings, including sharing with third parties. Survives termination.
What the policies say (3 quotes)
"YOU GRANT US A NONEXCLUSIVE, WORLDWIDE, ROYALTY-FREE, IRREVOCABLE, SUBLICENSABLE, AND FULLY PAID-UP RIGHT TO ACCESS, COLLECT, USE, PROCESS, STORE, DISCLOSE AND TRANSMIT ANY DATA, INFORMATION, CONTENT, RECORDS OR FILES"
Terms of Usecohere.comcaptured 2026-11-08"(III) IMPROVE AND ENHANCE THE COHERE SOLUTION AND OUR OTHER OFFERINfGS AND BENCHMARK THE FOREGOING, INCLUDING BY SHARING API DATA AND FINETUNING DATA WITH THIRD PARTIES WHO MAY USE THE FINETUNING DATA AND API DATA TO PROVIDE SERVICES TO COHERE AND FOR OTHER PURPOSES PERMITTED UNDER THEIR TERMS AND CONDITIONS."
Terms of Usecohere.comcaptured 2026-11-08"will survive expiration or termination of these Terms of Use for any reason: Sections 4 (Customer Data and Privacy)"
Terms of Usecohere.comcaptured 2026-11-08 - Sharing Model providers, subprocessors, ads
-
Stated Cohere may share API and fine-tuning data with third parties whose terms may allow own-purpose use. Vendors include ad and analytics firms; cookies may count as a 'sale'.
What the policies say (4 quotes)
"(III) IMPROVE AND ENHANCE THE COHERE SOLUTION AND OUR OTHER OFFERINfGS AND BENCHMARK THE FOREGOING, INCLUDING BY SHARING API DATA AND FINETUNING DATA WITH THIRD PARTIES WHO MAY USE THE FINETUNING DATA AND API DATA TO PROVIDE SERVICES TO COHERE AND FOR OTHER PURPOSES PERMITTED UNDER THEIR TERMS AND CONDITIONS."
Terms of Usecohere.comcaptured 2026-11-08"ANY FINETUNING DATA OR API DATA SHARED BY COHERE WITH THIRD PARTIES WILL BE ACCESSED, USED, AND OTHERWISE HANDLED BY SUCH THIRD PARTIES IN ACCORDANCE WITH THEIR TERMS AND CONDITIONS, WHICH MAY PERMIT SUCH THIRD PARTY TO USE FINETUNING DATA OR API DATA FOR ITS OWN PURPOSES."
Terms of Usecohere.comcaptured 2026-11-08"We use vendors and service providers for services such as cloud computing and data storage, advertising and analytics; communications; and customer support and management."
Privacy Policycohere.comcaptured 2026-11-08"our disclosures of business contact information, device and online information, professional information and geolocation information (as described above) to our advertising, marketing, and related analytics providers or partners (via cookies and tracking technologies) may qualify a “sale” or “sharing” of personal information under the CCPA."
Privacy Policycohere.comcaptured 2026-11-08 - Where data lives Regions and residency
-
Stated Data may be transferred to Canada, the US, the UK and other countries; cloud infrastructure includes GCP in the US. No residency option is described.
What the policies say (2 quotes)
"Examples of countries we transfer personal information to include, but are not limited to, Canada, the United States, and the United Kingdom."
Privacy Policycohere.comcaptured 2026-11-08"Our cloud infrastructure provided by GCP in the United States, for instance, is protected under the EU-US"
Privacy Policycohere.comcaptured 2026-11-08 - Enterprise controls Retention settings, DPA, SSO
-
Stated None for trial accounts. Cohere says to move to an enterprise tier with a commercial agreement and DPA if you need to include personal information.
What the policy says
"If you need to include personal information in inputs to Cohere Products, consider moving to an enterprise tier and entering into a commercial agreement and DPA with Cohere."
Privacy Policycohere.comcaptured 2026-11-08
Cohere SaaS Platform: paying and enterprise customers Business
- Default retention How long prompts and chats are kept
-
Stated Prompts and generations are logged and automatically deleted after 30 days, unless an exception applies.
What the policies say (2 quotes)
"We automatically delete logged prompts and generations after 30 days, unless we need it to comply with a legal requirement or customer contract, or unless your usage is flagged as potentially violating our terms, including our Usage Policy (e.g. abuse or misuse of our services)."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Retention of inputs and outputs on the Platform is generally 30 days for Enterprise Users."
Privacy Policycohere.comcaptured 2026-11-08 - After you delete How long until it is gone
-
Stated Account self-deletion is processed within 7 days (keys revoked, account data deleted). It does not delete prompts or generations, which expire at 30 days. No manual prompt deletion is described.
What the policies say (2 quotes)
"Account deletions are processed automatically within 7 days—your API keys will be revoked and account data (e.g. name, email, organization ID) will be deleted. Deleting your account does not delete prompts or generations, which are deleted automatically after 30 days unless exceptions apply."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"For SaaS Platform customers, prompts and generations are deleted automatically after 30 days unless exceptions apply."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Kept longer when Safety flags, legal holds, backups
-
Stated Kept longer for legal or contract requirements and flagged misuse (prompts and logs may be retained and reviewed). Training-opted data is kept separately. No durations are given for any exception.
What the policies say (3 quotes)
"If your usage is flagged as potentially violating our terms, including the Usage Policy, we may retain and review the flagged user prompts and associated logs to enforce our policies."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Data you allow us to use for training purposes may be retained separately in accordance with our agreement with you."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Our safety team may also aggregate flagged prompts and generations after removing customer identifiers to evaluate our models’ ability to detect safety issues and enforce our Usage Policy."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Zero data retention Whether it exists and who can get it
-
Stated Enterprise customers who make extra usage commitments can request ZDR via support@cohere.com. Then no prompts or generations are logged, but usage data is still collected.
What the policies say (3 quotes)
"we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"ZDR does not affect usage data, which Cohere still receives. Contact support@cohere.com to make a ZDR request with a copy to your sales representative, if you have one."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"If you have been approved for zero data retention, Cohere does not log any customer prompts or generations."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Trains on your data By default
-
Inferred Default not stated. 'Opt out' wording suggests training unless toggled off, but the training notice says 'Where a user has given Cohere permission', implying opt-in. Unresolved.
What the policies say (3 quotes)
"You can opt out from your prompts and generations being used to train Cohere models in your dashboard settings at any time."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"We filter and strip common types of personal information from prompts and generations before they are made available for possible use in training for Cohere models (if you are opted in)."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Where a user has given Cohere permission to use inputs and outputs for model training, we take steps to de-identify and strip personal information that may appear in inputs or outputs prior to use in model training."
Model Training Privacy Noticecohere.comcaptured 2026-11-08 - Opting out How, and what it doesn't cover
-
Stated Switch the 'Data Controls' toggle off in settings. It applies only to data created after the change; your org's administrator may control access to the setting.
What the policies say (3 quotes)
"To verify and update your settings, select “Data Controls” under your Settings in the left hand menu bar of the Cohere Platform. Adjust the toggle to ‘Off’ to opt out."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Your change in settings will apply to data created after you make that change."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Check with your organization’s administrator if you do not have access to the settings page, or contact us at support@cohere.com."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Human review Whether people read conversations
-
Stated Safety and security teams may review prompts, generations and logs when misuse is suspected. Authorized employees and service providers can access logs for support, legal compliance and safety.
What the policies say (2 quotes)
"If we detect possible misuse of our SaaS Platform, our safety and security teams may review user prompts, generations, and logs to enforce our customer agreements, including our Usage Policy, and secure our services from misuse."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Access to logs containing prompts and generations is limited to authorized employees and service providers bound by confidentiality and security controls that require access for engineering support, legal compliance, and safety and security monitoring."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Memory Remembered facts and profiles
-
Not stated Not addressed in the captured policies.
- Connected apps Email, calendar, drive
-
Not stated Not addressed. North and Compass are named as products, but their handling of connected-account data is not described.
- Agent actions Actions taken, browsing, credentials
-
Not stated Not addressed in the captured policies.
- Your inputs Who owns them
-
Inferred Only a marketing line ('your data stays yours'). Customer Data is governed by the enterprise agreement, which is not in the captured policies.
What the policies say (2 quotes)
"Opt out of model training at any time — your data stays yours."
AI Security and Data Protectioncohere.comcaptured 2026-11-08"Cohere’s use of Customer Data is governed by the terms and conditions of the enterprise agreement and, where applicable, the Data Processing Addendum entered into between the parties."
Privacy Policycohere.comcaptured 2026-11-08 - Outputs Who owns them
-
Not stated Not addressed; the enterprise or subscription agreement that would cover it is not in the captured policies.
- License you grant Scope, and whether it is perpetual
-
Inferred The Terms of Use's broad irrevocable license likely applies unless your Subscription or enterprise agreement overrides it. Those agreements aren't in the captured policies.
What the policies say (3 quotes)
"YOU GRANT US A NONEXCLUSIVE, WORLDWIDE, ROYALTY-FREE, IRREVOCABLE, SUBLICENSABLE, AND FULLY PAID-UP RIGHT TO ACCESS, COLLECT, USE, PROCESS, STORE, DISCLOSE AND TRANSMIT ANY DATA, INFORMATION, CONTENT, RECORDS OR FILES"
Terms of Usecohere.comcaptured 2026-11-08"if there is a conflict or inconsistency between the terms and conditions of your Subscription Agreement and these Terms of Use, then the provisions of the Subscription Agreement will govern to the extent of such conflict or inconsistency."
Terms of Usecohere.comcaptured 2026-11-08"This Policy does not apply to Customer Data (i.e. inputs and outputs) associated with the use of Cohere Products by Enterprise Users under an enterprise agreement."
Privacy Policycohere.comcaptured 2026-11-08 - Sharing Model providers, subprocessors, ads
-
Stated Service providers and subprocessors (listed on the Trust Center) can access logs. CSAM is reported to authorities. Whether the Terms' third-party data-sharing clause applies to paid accounts isn't clear.
What the policies say (3 quotes)
"You can view a list of sub-processors by visiting Cohere’s [Trust Center](https://cohere-inc.secureframetrust.com/)."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"We use vendors and service providers for services such as cloud computing and data storage, advertising and analytics; communications; and customer support and management."
Privacy Policycohere.comcaptured 2026-11-08"We will report child sexual abuse material that we become aware of to competent authorities and other organizations as appropriate."
Data statementdocs.cohere.comcaptured 2026-11-08 - Where data lives Regions and residency
-
Stated Data may be processed in Canada, the US, the UK and elsewhere, including GCP in the US. No SaaS residency option is described; private deployment is the alternative.
What the policies say (3 quotes)
"Examples of countries we transfer personal information to include, but are not limited to, Canada, the United States, and the United Kingdom."
Privacy Policycohere.comcaptured 2026-11-08"Our cloud infrastructure provided by GCP in the United States, for instance, is protected under the EU-US"
Privacy Policycohere.comcaptured 2026-11-08"Users of the Platform or Cohere APIs can consult our list of [*sub-processors*](https://trustcenter.cohere.com/subprocessors), which includes data processing locations."
Privacy Policycohere.comcaptured 2026-11-08 - Enterprise controls Retention settings, DPA, SSO
-
Stated DPA on request, training toggle, ZDR, SOC 2/ISO reports, just-in-time access. The security page claims customizable retention but gives no details. SSO and audit logs aren't mentioned.
What the policies say (4 quotes)
"Contact privacy@cohere.com if you are a SaaS Platform customer and need a Data Processing Addendum."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"request a copy of our certifications (including ISO 27001 and ISO 42001) or of our SOC 2 Type II Report"
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Cohere relies on just-in-time (JIT) techniques to manage who has access to our system and implements role-based accesses based on the least privilege principle."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Maintain full control over your data with customizable handling and retention settings."
AI Security and Data Protectioncohere.comcaptured 2026-11-08
Private and third-party cloud deployments (VPC, on-premises, Model Vault, OCI/Azure/AWS/GCP) Enterprise
- Default retention How long prompts and chats are kept
-
Stated Cohere says it receives no prompts or outputs, so retention is up to you or your cloud provider. It may still receive some usage data.
What the policies say (2 quotes)
"In third-party cloud AI/ML platforms and private deployment solutions, Cohere does not receive any customer inputs (prompts) or outputs (generations)."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"We may also receive certain usage data for third-party cloud AI/ML platform or private deployments, in accordance with our commercial agreements."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - After you delete How long until it is gone
-
Not stated Not addressed; Cohere says it holds no prompts or outputs for these deployments.
- Kept longer when Safety flags, legal holds, backups
-
Not stated Not addressed. How long Cohere keeps usage data it receives from these deployments is not stated.
- Zero data retention Whether it exists and who can get it
-
Stated No ZDR setting is described; Cohere says it receives no prompts or outputs here and points customers with sensitive data to these deployments.
What the policies say (2 quotes)
"In third-party cloud AI/ML platforms and private deployment solutions, Cohere does not receive any customer inputs (prompts) or outputs (generations)."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"If you are dealing with sensitive data, you can also consider a third-party cloud AI/ML platform or private deployment."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Trains on your data By default
-
Stated No. Cohere says data in these deployments is never accessible to it and it does not train on it.
What the policy says
"The data remains within the enterprise customer’s or the third-party cloud provider’s controlled environment and is never accessible to or used by Cohere (for example, we do not train our models on it)."
Privacy Policycohere.comcaptured 2026-11-08 - Opting out How, and what it doesn't cover
-
Stated No opt-out is needed; Cohere says it has no access to data processed in these deployments.
What the policy says
"Cohere does not have access to data processed in connection with the use of Cohere models or products in Private Deployments or Deployments on Third-Party Managed AI services (e.g. on AWS, Azure, or GCP)."
Privacy Policycohere.comcaptured 2026-11-08 - Human review Whether people read conversations
-
Stated Cohere says it won't have access to your infrastructure or data, so Cohere staff don't review it.
What the policy says
"We won’t have access to your computing infrastructure or data"
AI Security and Data Protectioncohere.comcaptured 2026-11-08 - Memory Remembered facts and profiles
-
Not stated Not addressed in the captured policies.
- Connected apps Email, calendar, drive
-
Not stated Not addressed. North and Compass can run in private deployments, but their connector handling is not described.
- Agent actions Actions taken, browsing, credentials
-
Not stated Not addressed in the captured policies.
- Your inputs Who owns them
-
Not stated Not addressed; governed by commercial agreements not in the captured policies.
- Outputs Who owns them
-
Not stated Not addressed; governed by commercial agreements not in the captured policies.
- License you grant Scope, and whether it is perpetual
-
Not stated Not addressed; governed by commercial agreements not in the captured policies.
- Sharing Model providers, subprocessors, ads
-
Stated Data stays with you or your cloud provider (OCI, Azure, AWS, GCP), whose own security terms apply. Cohere may still receive usage data under the commercial agreement.
What the policies say (3 quotes)
"Our models run on any cloud AI/ML platform, including OCI, Azure, AWS, and Google CP"
AI Security and Data Protectioncohere.comcaptured 2026-11-08"You’ll benefit from third-party cloud security standards and certifications"
AI Security and Data Protectioncohere.comcaptured 2026-11-08"We may also receive certain usage data for third-party cloud AI/ML platform or private deployments, in accordance with our commercial agreements."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 - Where data lives Regions and residency
-
Stated Your choice: your VPC, on-premises, a third-party cloud, or a dedicated Cohere-managed 'Model Vault'.
What the policies say (2 quotes)
"We can bring our products and models to your infrastructure through virtual private cloud (VPC), on-premises deployments or Model Vault"
AI Security and Data Protectioncohere.comcaptured 2026-11-08"Deploy through your virtual private cloud (VPC), on-premises setup, or dedicated, Cohere-managed Model Vault."
AI Security and Data Protectioncohere.comcaptured 2026-11-08 - Enterprise controls Retention settings, DPA, SSO
-
Stated You can customize security configurations and controls. Cohere says no DPA is needed because it receives no prompts or generations.
What the policies say (2 quotes)
"You can customize your security configurations and controls"
AI Security and Data Protectioncohere.comcaptured 2026-11-08"No DPA is required for private deployments and deployments on third-party cloud AI/ML platforms as Cohere will not receive any customer prompts/generations."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08
Notes
-
The Terms of Use (last updated 2022) grant Cohere an irrevocable, sublicensable license to submitted data, including sharing API and fine-tuning data with third parties whose terms may let them use it for their own purposes. Section 4 survives termination.
What the policies say (3 quotes)
"(III) IMPROVE AND ENHANCE THE COHERE SOLUTION AND OUR OTHER OFFERINfGS AND BENCHMARK THE FOREGOING, INCLUDING BY SHARING API DATA AND FINETUNING DATA WITH THIRD PARTIES WHO MAY USE THE FINETUNING DATA AND API DATA TO PROVIDE SERVICES TO COHERE AND FOR OTHER PURPOSES PERMITTED UNDER THEIR TERMS AND CONDITIONS."
Terms of Usecohere.comcaptured 2026-11-08"ANY FINETUNING DATA OR API DATA SHARED BY COHERE WITH THIRD PARTIES WILL BE ACCESSED, USED, AND OTHERWISE HANDLED BY SUCH THIRD PARTIES IN ACCORDANCE WITH THEIR TERMS AND CONDITIONS, WHICH MAY PERMIT SUCH THIRD PARTY TO USE FINETUNING DATA OR API DATA FOR ITS OWN PURPOSES."
Terms of Usecohere.comcaptured 2026-11-08"will survive expiration or termination of these Terms of Use for any reason: Sections 4 (Customer Data and Privacy)"
Terms of Usecohere.comcaptured 2026-11-08 -
On the paid SaaS Platform, deleting your account does not delete your prompts or generations; they expire on the 30-day schedule, or later if an exception applies.
What the policy says
"Deleting your account does not delete prompts or generations, which are deleted automatically after 30 days unless exceptions apply."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 -
ZDR is enterprise-only and does not stop Cohere receiving usage data (frequency, features, token counts).
What the policies say (2 quotes)
"ZDR does not affect usage data, which Cohere still receives."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08"Usage data can include frequency and duration of usage, features accessed, user preferences, and aggregate counts of input prompt tokens."
Enterprise Data Commitmentscohere.comcaptured 2026-11-08 -
The security page lists 'Model Vault' among private deployments that Cohere 'won't have access to', but also describes it as Cohere-managed. The captured policies don't reconcile the two.
What the policies say (2 quotes)
"Deploy through your virtual private cloud (VPC), on-premises setup, or dedicated, Cohere-managed Model Vault."
AI Security and Data Protectioncohere.comcaptured 2026-11-08"We won’t have access to your computing infrastructure or data"
AI Security and Data Protectioncohere.comcaptured 2026-11-08 -
The Terms of Use never address output ownership. They define 'Content' broadly as materials provided through the service and bar users from distributing it, which could be read to cover outputs.
What the policies say (2 quotes)
"any text, pictures, media, data, information and other materials or content (collectively, the “**Content**”) contained on or provided through the foregoing (a) to (c)"
Terms of Usecohere.comcaptured 2026-11-08"publish, market, advertise or in any way distribute the Content;"
Terms of Usecohere.comcaptured 2026-11-08 -
Cohere says its products are for business use only, not personal or household use. No consumer chat app is described in the captured policies.
What the policies say (2 quotes)
"you will not use the Cohere Solution for personal, family or household purposes"
Terms of Usecohere.comcaptured 2026-11-08"Cohere Products are not intended to be used by minors (children) and are not for personal or household use."
Privacy Policycohere.comcaptured 2026-11-08 -
If you sign up for partner offers, Cohere may share your email and other authorized personal information with partners and be paid for it.
What the policy says
"You understand that Cohere may receive financial remuneration in exchange for sharing your email address and other Personal Information you authorize with partners if you choose to sign up for an offer."
Terms of Usecohere.comcaptured 2026-11-08 -
The captured policy saved as 'data-statement' is actually Cohere's Usage Policy (docs.cohere.com/docs/usage-policy), not the data statement the Terms of Use incorporate.
What the policy says
"Our Usage Policy applies to all Cohere products and services, including Cohere models, software, applications, and application programming interface"
Data statementdocs.cohere.comcaptured 2026-11-08 -
For EU/UK users, Cohere relies on legitimate interests, not consent, to use Trial or Research User inputs and outputs to improve its AI models. Security and compliance processing covers 'All relevant data'.
What the policies say (3 quotes)
"Section 2.3 (Research and Model Improvement): Analyzing usage patterns and using Trial or Research User Inputs/Outputs to improve the performance and safety of our AI models."
Privacy Policycohere.comcaptured 2026-11-08"Legitimate Interests: We process your data based on our legitimate interests in operating, securing, and improving our business and AI technologies, including enhancing the performance, reliability, and safety of our AI models."
Privacy Policycohere.comcaptured 2026-11-08"Section 2.6 (Security and Compliance): Detecting abuse and ensuring security of Cohere Products, investigating breaches of agreements or policies, complying with legal obligations."
Privacy Policycohere.comcaptured 2026-11-08 -
The California table lists the categories Cohere collects (contact, payment, login, device, professional, geolocation, employment data) and says one use is advertising to enterprise customers. Prompts and outputs aren't listed, and the section excludes data Cohere handles as a service provider to enterprise customers.
What the policies say (2 quotes)
"Advertise our company and products to enterprise customers and their personnel."
Privacy Policycohere.comcaptured 2026-11-08"It does not cover personal information or practices that are exempt from the California Consumer Privacy Act (“**CCPA**”), and it does not cover personal information about individuals who reside outside of California. It also does not cover personal information that we handle as a service provider to our enterprise customers."
Privacy Policycohere.comcaptured 2026-11-08
Open questions
Questions the captured policies leave unanswered, and where the answer probably lives.
How long trial-account inputs and outputs are kept, and whether trial users can opt out of R&D use: not stated. Likely in API docs or the Trust Center.
Data handling for North and Compass (memory, connectors to email, calendar or drive, agent action logs): not covered. Likely in North product docs or its privacy notice.
Ownership of inputs and outputs and the license on paid or enterprise accounts: governed by Subscription and enterprise agreements and the DPA, none of which were captured.
How long flagged or legal-hold data and usage data are kept: no durations given. Likely in the DPA or Trust Center.
Subprocessors and processing locations: referenced but not captured (trustcenter.cohere.com/subprocessors).
The data statement the Terms of Use incorporate (docs.cohere.ai/data-statement) was not captured; the 'data-statement' captured policy is the Usage Policy.
The Terms of Use captured policy is dated September 7, 2022 and uses cohere.ai URLs. Check whether a newer Terms of Use or SaaS agreement replaces it.
SSO, audit logs and custom retention settings for SaaS customers: not described. Likely on the Trust Center or in enterprise docs.
Documents read
-
AI Security and Data Protection
cohere.com captured 2026-11-08 sha256 d257b5a92d23 -
Data statement
docs.cohere.com captured 2026-11-08 sha256 56e58a8f8d0b -
Enterprise Data Commitments
cohere.com captured 2026-11-08 sha256 b8a7f1c67f1e -
Model Training Privacy Notice
cohere.com captured 2026-11-08 sha256 46cbbbd31e39 -
Privacy Policy
cohere.com captured 2026-11-08 sha256 06e5517d5711 -
Terms of Use
cohere.com captured 2026-11-08 sha256 5fb76d8f24f3