AI data policies

Mistral (Le Chat, La Plateforme)

What Mistral (Le Chat, La Plateforme) keeps, for how long, whether it trains on it, and what rights you grant, for Vibe (Mistral's chat assistant app, including Chat and Vibe Work), individual use, Mistral AI Studio APIs (pay-as-you-go and free mode; includes Vibe CLI calls), Vibe Team and Enterprise plans, and other business use (Mistral as data processor). Each answer quotes Mistral (Le Chat, La Plateforme)'s own policy.

Type Model maker Policies captured 2026-11-08 4 documents read How this is made

Vibe (Mistral's chat assistant app, including Chat and Vibe Work), individual use Consumer app

Default retention How long prompts and chats are kept

Stated Inputs and outputs are kept until you delete the conversation or your account, so your chat history stays visible.

What the policies say (2 quotes)

"we keep your Input and Output until you delete your account or until you delete the conversation from Vibe."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"**Input and output are maintained by default** so you can see your **conversation history in the product**."

Can I delete a chat conversation?help.mistral.aicaptured 2026-11-08
After you delete How long until it is gone

Stated Deleted chats and accounts are removed, typically after an unspecified 'short grace period'. Some backend data lasts longer: account data 1 year after deletion, identity data 5 years.

What the policies say (4 quotes)

"Conversations are removed from our systems **upon manual deletion on your side**, or **when you delete your account**, typically after a **short grace period** to prevent accidental data loss, and for monitoring and legal retention purposes."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"Even **after your manual deletion on your end**, we may retain **different types of data in our backend systems** for different amounts of time, as specified in our [Privacy Policy](https://mistral.ai/terms#privacy-policy) and/or your Data Protection Agreement with us."

Can I delete a chat conversation?help.mistral.aicaptured 2026-11-08

"for 1 year after you delete your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"for 5 years after the termination of your Mistral AI account."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated Chats may be kept to enforce the Usage Policy, handle violations, or meet legal duties (no duration given). Technical connection data is kept 1 rolling year.

What the policies say (4 quotes)

"For instance, we may retain your input and output data to **enforce our Usage Policy**, address Terms of Service or **policy violations**, or as **required by law**."

Can I delete a chat conversation?help.mistral.aicaptured 2026-11-08

"Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"for 1 rolling year from the date of connection, for each operation contributing to the operation of connection."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Please note that the categories of personal data we retain longer will not be accessed or used by any member of our teams during their legal keeping periods, except to fulfill our legal obligations or in case of dispute or litigation (e.g. to recover an unpaid invoice)."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Stated Not available for Vibe Work or Chat on any plan, because Mistral stores data for conversation history and app state.

What the policies say (2 quotes)

"ZDR is **not available** for Vibe Work or Chat, regardless of your subscription plan."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"This is because **we must store your data for user experience purposes**"

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08
Trains on your data By default

Inferred Inferred yes: an opt-out exists, and the legal-bases table lists inputs and outputs for training 'subject to your opt-out'. Feedback is listed without that qualifier.

What the policies say (6 quotes)

"We’ve introduced a user control which allows you to object to the use of your input and output data for model training directly from your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"your use of our products (to the extent permitted by our applicable terms)"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"If you use Vibe, you can instead manage your data-training preferences in your privacy settings."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"To train our artificial intelligence models (large language models) to answer questions, generate text, translate, summarize and correct text, classify text, analyze feelings, etc. according to context, Inputs (e-mails, letters, reports, computer code, etc.) and Outputs."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Your Input and Output, subject to your opt-out. Your Feedback."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Our legitimate interest in developing and providing state-of-the-art large language models as part of the Mistral AI Products."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Use the training control in your account privacy settings. Mistral warns training requests have 'technical limitations'; whether already-trained data is removed isn't stated.

What the policies say (3 quotes)

"We’ve introduced a user control which allows you to object to the use of your input and output data for model training directly from your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"If you use Vibe, you can instead manage your data-training preferences in your privacy settings."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"However, when your request concerns the training of our models, it’s important to note that your rights have technical limitations and fulfilling your requests might involve a complex technical process."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Human review Whether people read conversations

Inferred Inputs and outputs are used for debugging, customer support, and moderation and abuse monitoring, and authorized staff may access data for their jobs. Whether people read chats isn't stated outright.

What the policies say (3 quotes)

"Authorized members of our teams who need to access your personal data, strictly to perform their jobs"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"To manage and enforce our Terms of Service and licenses, including moderation and abuse monitoring"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"To provide customer support, including debugging and fixing errors reported by you"

Privacy Policylegal.mistral.aicaptured 2026-11-08
Memory Remembered facts and profiles

Stated Vibe's Memory feature (becoming 'Knowledge Base') personalizes answers from past chats. You can turn it off and view, add, edit or delete memories in settings. Sensitive data needs explicit consent.

What the policies say (4 quotes)

"To enhance your experience on Vibe via the Memory feature (now becoming Knowledge Base) by providing you more relevant and personalized answers based on your past interactions with Vibe."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"As the Memory feature is becoming Knowledge Base, your previous Memories will be retained in Knowledge Base"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Your explicit consent for any sensitive data contained in your Memories (Knowledge Base will not seek to store sensitive data included in your Input)"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Turn off the feature at all times through your settingsAccess, add, delete or edit your Memories or your Knowledge Base at all time through your settings."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Connected apps Email, calendar, drive

Stated Data accessed through integrations you connect is defined as 'Input', which the training row covers 'subject to your opt-out', so it seems treated like prompts. Disconnect handling isn't described.

What the policies say (2 quotes)

"“Input”, any data provided by you or accessed by Mistral AI through integrations or services you have connected to generate an Output, such as prompts, content or fine-tuning data."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Your Input and Output, subject to your opt-out. Your Feedback."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Agent actions Actions taken, browsing, credentials

Stated Web Search can show third-party links and snippets, which may echo personal data from your input; Mistral doesn't train on them. Nothing on action logs or stored credentials.

What the policies say (2 quotes)

"When you use certain features that interact with third party Mistral AI Products, such as Web Search or verified news on Vibe, we may display content from third parties on Vibe, such as links, thumbnails, or snippets"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"If you include personal data in your Input, personal data might also appear in the Third-Party Content. We do not use this Third-Party Content to train our models."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Your inputs Who owns them

Not stated Not addressed; the consumer Terms of Service were not captured.

Outputs Who owns them

Not stated Not addressed; the consumer Terms of Service were not captured.

License you grant Scope, and whether it is perpetual

Not stated Not addressed; the consumer Terms of Service were not captured.

Sharing Model providers, subprocessors, ads

Stated Shared with service providers under data protection agreements (listed on Trust Center), banks, regulators and legal advisers. No sale or targeted advertising of consumer data in 12 months (US-law terms).

What the policies say (7 quotes)

"Additionally, we may share all or part of your personal data with our service providers."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"We sign a dedicated data protection agreement with each of these providers."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Our main providers are listed on our [Trust Center](https://trust.mistral.ai/subprocessors)."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Banks and other financial organizations"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Such as the French data protection authority (CNIL)"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"When appropriate, we may share data with competent courts, mediators, accountants, auditors, lawyers, bailiffs, and debt collection agencies."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Mistral AI has not “sold,” “shared,” or engaged in “targeted advertising” with (as those terms are defined under U.S. state privacy laws) any personal data of consumers in the preceding 12 months"

Privacy Policylegal.mistral.aicaptured 2026-11-08
Where data lives Regions and residency

Stated Mistral prefers EU providers; non-EU providers are used in exceptional cases under Standard Contractual Clauses. No residency choice is described.

What the policies say (2 quotes)

"We prioritize selecting providers within the European Union that strictly adhere to the GDPR. However, in exceptional cases, we may opt for non-EU providers that meet our high standards of data security and Personal Data protection."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Additionally, we attach the most recent version of the European Commission’s Standard Contractual Clauses to all such contracts."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Not stated Not applicable to individual use; see the Team and Enterprise product.

Mistral AI Studio APIs (pay-as-you-go and free mode; includes Vibe CLI calls) API

Default retention How long prompts and chats are kept

Stated Most APIs: kept while generating, then 30 rolling days for abuse monitoring. Agents API: until account termination. Fine-tuning data: until deleted. Files API stores uploads (no period given).

What the policies say (4 quotes)

"Except for specific APIs, we keep your Input and Output for the period necessary to generate the Output and then for thirty (30) rolling days to monitor abuse (unless zero data retention is activated)."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"If you use our Agents API, we keep your Input and Output until you terminate your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"If you use our Fine-Tuning API, we keep your fine-tuning data until you delete it from Mistral AI Studio or until you terminate your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"For example, the Files API stores uploaded files and is outside the scope of ZDR."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08
After you delete How long until it is gone

Stated You can delete your account and fine-tuning data yourself. No timeframe is given for purging API data afterward; account data is kept 1 year, identity data 5 years.

What the policies say (3 quotes)

"We’ve introduced a user control which allows you to delete your account at all times."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"for 1 year after you delete your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"for 5 years after the termination of your Mistral AI account."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated 30-day abuse-monitoring window on most endpoints. Data may be kept longer for legal obligations or proceedings, with category-specific periods; staff may access it only for legal or dispute purposes.

What the policies say (4 quotes)

"Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Please note that the categories of personal data we retain longer will not be accessed or used by any member of our teams during their legal keeping periods, except to fulfill our legal obligations or in case of dispute or litigation (e.g. to recover an unpaid invoice)."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"for 1 rolling year from the date of connection, for each operation contributing to the operation of connection."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"For instance, we may retain your input and output data to **enforce our Usage Policy**, address Terms of Service or **policy violations**, or as **required by law**."

Can I delete a chat conversation?help.mistral.aicaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Stated Pay-as-you-go only, stateless endpoints only (chat, FIM, embeddings, moderation, OCR, audio). Request via support with your reasons; Mistral approves at its discretion. Agents, batch, files excluded.

What the policies say (5 quotes)

"Zero Data Retention (ZDR) is available **only with pay-as-you-go** and **only for stateless API calls**."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"As part of this request, **you must provide sufficient detail of your legitimate reasons** for requesting Zero Data Retention."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"We will review your request and, **at our discretion**, approve or deny it."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"ZDR does **not** apply to stateful APIs or products, including agents, batch processing files, conversations, libraries, `/v1/files`, Vibe Work, and Chat."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"If ZDR is enabled for your organization with pay-as-you-go, Vibe CLI API calls follow the same ZDR rules as the underlying API endpoint."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08
Trains on your data By default

Inferred Not stated for the API. The policy lists inputs and outputs for training 'subject to your opt-out', covering 'eligible data' (undefined), so API data may be used unless opted out.

What the policies say (3 quotes)

"**Training opt-out** controls whether eligible data may be used to improve Mistral’s models."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"We’ve introduced a user control which allows you to object to the use of your input and output data for model training directly from your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Your Input and Output, subject to your opt-out. Your Feedback."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Opting out How, and what it doesn't cover

Stated Opt out with the account control. Mistral calls it a control separate from ZDR. What counts as 'eligible data' isn't defined.

What the policies say (3 quotes)

"We’ve introduced a user control which allows you to object to the use of your input and output data for model training directly from your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"ZDR and training opt-out are separate controls:"

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"**Training opt-out** controls whether eligible data may be used to improve Mistral’s models."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08
Human review Whether people read conversations

Inferred API data is kept 30 days 'to monitor abuse', and authorized staff may access personal data for their jobs. Whether people read prompts isn't stated.

What the policies say (3 quotes)

"then for thirty (30) rolling days to monitor abuse (unless zero data retention is activated)"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Authorized members of our teams who need to access your personal data, strictly to perform their jobs"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"To manage and enforce our Terms of Service and licenses, including moderation and abuse monitoring"

Privacy Policylegal.mistral.aicaptured 2026-11-08
Memory Remembered facts and profiles

Not stated Not addressed. Stateful products (agents, conversations, libraries) are named, but no memory feature is described.

Connected apps Email, calendar, drive

Not stated Not addressed in the captured policies.

Agent actions Actions taken, browsing, credentials

Stated Agents API inputs and outputs are kept until you close your account. Vibe CLI runs locally and calls stateless APIs. Nothing on action logs or stored credentials.

What the policies say (2 quotes)

"If you use our Agents API, we keep your Input and Output until you terminate your account."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Vibe CLI runs on your machine and calls stateless APIs."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08
Your inputs Who owns them

Not stated Not addressed; the Commercial Terms of Service were not captured.

Outputs Who owns them

Not stated Not addressed; the Commercial Terms of Service were not captured.

License you grant Scope, and whether it is perpetual

Not stated Not addressed; the Commercial Terms of Service were not captured.

Sharing Model providers, subprocessors, ads

Stated Shared with service providers under data protection agreements (listed on Trust Center), banks, regulators and legal advisers. No sale or targeted advertising of consumer data in 12 months (US-law terms).

What the policies say (7 quotes)

"Additionally, we may share all or part of your personal data with our service providers."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"We sign a dedicated data protection agreement with each of these providers."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Our main providers are listed on our [Trust Center](https://trust.mistral.ai/subprocessors)."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Banks and other financial organizations"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Such as the French data protection authority (CNIL)"

Privacy Policylegal.mistral.aicaptured 2026-11-08

"When appropriate, we may share data with competent courts, mediators, accountants, auditors, lawyers, bailiffs, and debt collection agencies."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Mistral AI has not “sold,” “shared,” or engaged in “targeted advertising” with (as those terms are defined under U.S. state privacy laws) any personal data of consumers in the preceding 12 months"

Privacy Policylegal.mistral.aicaptured 2026-11-08
Where data lives Regions and residency

Stated Mistral prefers EU providers; non-EU providers are used in exceptional cases under Standard Contractual Clauses. No residency option is described.

What the policies say (2 quotes)

"We prioritize selecting providers within the European Union that strictly adhere to the GDPR. However, in exceptional cases, we may opt for non-EU providers that meet our high standards of data security and Personal Data protection."

Privacy Policylegal.mistral.aicaptured 2026-11-08

"Additionally, we attach the most recent version of the European Commission’s Standard Contractual Clauses to all such contracts."

Privacy Policylegal.mistral.aicaptured 2026-11-08
Enterprise controls Retention settings, DPA, SSO

Stated A standard online DPA (cannot be signed offline) and ZDR status in the Admin panel privacy settings. For business data, you are controller and Mistral is processor.

What the policies say (3 quotes)

"Our **Data Processing Agreement (DPA)** is available in our [Data Processing Addendum](https://legal.mistral.ai/terms/data-processing-addendum) and is regularly updated to reflect our processing, services, security measures, and applicable regulations. We cannot sign the DPA offline."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"After your ZDR request is approved, it appears in the [Privacy settings](https://admin.mistral.ai/vibe/privacy) of the Admin panel."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"This Privacy Policy does not apply if you use our Mistral AI Products to process personal data in the context of your business activities. In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf."

Privacy Policylegal.mistral.aicaptured 2026-11-08

Vibe Team and Enterprise plans, and other business use (Mistral as data processor) Business

Default retention How long prompts and chats are kept

Stated No default period is given. Your organization may set its own retention controls, and business processing falls under the DPA rather than the Privacy Policy.

What the policies say (2 quotes)

"For the Team and Enterprise plans, please note that **your Organization may have separate controls in place** based on its own data retention policies."

Can I delete a chat conversation?help.mistral.aicaptured 2026-11-08

"This Privacy Policy does not apply if you use our Mistral AI Products to process personal data in the context of your business activities. In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf."

Privacy Policylegal.mistral.aicaptured 2026-11-08
After you delete How long until it is gone

Stated After you delete, backend retention follows the Privacy Policy and/or your DPA. The captured policies give no timeframe.

What the policy says

"Even **after your manual deletion on your end**, we may retain **different types of data in our backend systems** for different amounts of time, as specified in our [Privacy Policy](https://mistral.ai/terms#privacy-policy) and/or your Data Protection Agreement with us."

Can I delete a chat conversation?help.mistral.aicaptured 2026-11-08
Kept longer when Safety flags, legal holds, backups

Stated Inputs and outputs may be kept to enforce the Usage Policy, handle violations, or as required by law. No durations are given for business plans.

What the policy says

"For instance, we may retain your input and output data to **enforce our Usage Policy**, address Terms of Service or **policy violations**, or as **required by law**."

Can I delete a chat conversation?help.mistral.aicaptured 2026-11-08
Zero data retention Whether it exists and who can get it

Stated Not available for Vibe Work or Chat on any plan. For API use, ZDR requires pay-as-you-go and covers stateless endpoints only.

What the policies say (2 quotes)

"ZDR is **not available** for Vibe Work or Chat, regardless of your subscription plan."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"Zero Data Retention (ZDR) is available **only with pay-as-you-go** and **only for stateless API calls**."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08
Trains on your data By default

Not stated Not stated for Team or Enterprise plans. Likely in the Commercial Terms or DPA, which were not captured.

Opting out How, and what it doesn't cover

Not stated Not stated for Team or Enterprise plans beyond Admin-panel privacy settings existing.

Human review Whether people read conversations

Not stated Not addressed for business plans.

Memory Remembered facts and profiles

Not stated Not addressed in the captured policies.

Connected apps Email, calendar, drive

Not stated Not addressed in the captured policies.

Agent actions Actions taken, browsing, credentials

Not stated Not addressed in the captured policies.

Your inputs Who owns them

Not stated Not addressed; the Commercial Terms of Service were not captured.

Outputs Who owns them

Not stated Not addressed; the Commercial Terms of Service were not captured.

License you grant Scope, and whether it is perpetual

Not stated Not addressed; the Commercial Terms of Service were not captured.

Sharing Model providers, subprocessors, ads

Not stated Not addressed for processor-role data; the DPA and subprocessor list were not captured.

Where data lives Regions and residency

Not stated Not addressed for processor-role data; the DPA was not captured.

Enterprise controls Retention settings, DPA, SSO

Stated Organization-level retention controls, Admin-panel privacy settings, and a standard online DPA that cannot be signed offline. SSO and audit logs aren't mentioned.

What the policies say (3 quotes)

"For the Team and Enterprise plans, please note that **your Organization may have separate controls in place** based on its own data retention policies."

Can I delete a chat conversation?help.mistral.aicaptured 2026-11-08

"Our **Data Processing Agreement (DPA)** is available in our [Data Processing Addendum](https://legal.mistral.ai/terms/data-processing-addendum) and is regularly updated to reflect our processing, services, security measures, and applicable regulations. We cannot sign the DPA offline."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

"it appears in the [Privacy settings](https://admin.mistral.ai/vibe/privacy) of the Admin panel."

Can I activate Zero Data Retention (ZDR)?help.mistral.aicaptured 2026-11-08

Notes

Open questions

Questions the captured policies leave unanswered, and where the answer probably lives.

Documents read