7 Total
0 High severity
5 Medium severity
2 Low severity
Summary

This document establishes Cohere's privacy practices for personal information collected through its website, API, and AI language model services including Command and North. The policy authorizes Cohere to use inputs and prompts submitted through certain service tiers for AI model improvement, with different terms applicable to enterprise API customers under separate agreements. Users in the EU, UK, and California may exercise data access, deletion, or export rights by contacting privacy@cohere.com.

Technical / Legal Breakdown

This document is Cohere Inc.'s Privacy Policy governing the collection, use, and disclosure of personal information through the cohere.ai website and AI-powered services including its language model platform, operating under a consent and legitimate interests framework across multiple jurisdictions. The policy states that Cohere collects account registration data, usage data, API interaction data, device and browser identifiers, and communications content, and the terms authorize use of this data for service delivery, product improvement, model training on certain inputs, security, and marketing communications. The policy authorizes disclosure of personal information to service providers, business partners, and in the context of corporate transactions such as mergers or acquisitions, and the terms assert a broad right to use inputs submitted through the platform for improving Cohere's AI models subject to stated limitations for enterprise API customers. The policy engages GDPR and UK GDPR for EEA and UK users, PIPEDA and Canadian provincial privacy law for Canadian users, and CCPA for California residents, with jurisdiction-specific rights sections addressing data subject access, deletion, portability, and objection requests. Material compliance considerations include cross-border data transfers from the EEA to Canada and the United States, the applicability of GDPR to AI training data practices, and the need for enterprise customers to evaluate whether their use of Cohere's API requires a separate data processing agreement.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Start Compliance free trial

2 important changes detected

2 versions captured · Last updated: May 2026

What changed Cohere updated its privacy policy on May 2, 2026 to add specific retention timelines and procedures for handling personal information. The revised policy now explicitly states that inputs and outputs on the Platform are retained for 30 days for Enterprise Users, clarifies that Trial Users and Researchers should not be providing personal information, and establishes a process for requesting deletion of inadvertently included personal data by emailing privacy@cohere.com with a typical one-month response time. The policy also added guidance for requests related to training data, directing users to a separate Model Training Privacy Notice and noting that Cohere does not intentionally collect personal information for training purposes.
Why this matters The updated policy establishes a concrete 30-day retention timeline for enterprise users' inputs and outputs on the Platform, whereas the previous version referenced retention practices without specific durations. The policy now provides an explicit process for requesting deletion of inadvertently included personal information by emailing privacy@cohere.com, with Cohere stating it normally responds within one month or up to three months for complex requests. You can request deletion of personal data by contacting privacy@cohere.com with details about the information and reasons it should not appear.
View full change record →
What changed Cohere removed 16 sentences from its privacy policy that previously specified data retention practices for different user types and procedures for requesting deletion of personal information inadvertently included in platform inputs. The updated policy now provides only a general reference to retention practices without specifying the 30-day retention period for Enterprise Users, the non-processing of personal information for Trial and Researcher accounts, response timelines for deletion requests, or guidance on training data deletion. This creates operational ambiguity about what retention periods currently apply to different user categories and how deletion requests are handled.
Why this matters The updated policy removes explicit language describing data retention timelines and deletion request procedures that were previously available. The prior policy stated that Enterprise Users' inputs and outputs were retained for 30 days, that Trial Users and Researchers were not intended to process personal information, and that deletion requests would normally be responded to within one month (up to three months for complex requests). The updated policy now contains only a general reference to 'retention practices' without specifying these timelines, response windows, or user-type distinctions. Users cannot determine from the updated policy what retention periods apply to their account category or what timeline to expect for deletion requests.
View full change record →

Medium — 5 provisions
Low — 2 provisions

Monitoring

Cohere has updated this document before.

Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.

Start Monitor free trial Or create a free account →

Compliance Governance Intelligence

Need provision-level monitoring and regulatory mapping?

Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.

Start Compliance free trial

Cross-platform context

See how other platforms handle Use of Inputs and Outputs for Model Training and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

CCPA/CPRA
California, USA
View official text ↗
Connecticut Data Privacy Act Amendments
US-CT
View official text ↗
FTC Act Section 5
United States Federal
View official text ↗
GDPR
European Union
View official text ↗
Indiana Consumer Data Protection Act
US-IN
View official text ↗
Kentucky Consumer Data Protection Act
US-KY
View official text ↗
Universal Opt-Out Mechanism Expansion 2026
US
View official text ↗
Archival ProvenanceSource & Archival Record
Last Captured May 2, 2026 06:38 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000440
Version ID CA-V-002113
SHA-256 870c6ae4fbd23c19db8bd5f5ce33d2fee2f5d3575a37fb4561db279652ba948d
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.

Create free account Compare plans