This analysis describes what Cohere's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision allocates data protection responsibilities by designating the customer as the party responsible for lawful basis, compliance obligations, and end-user disclosures, while Cohere assumes processor liability for handling personal information according to customer directions. This allocation determines which party bears primary responsibility for regulatory compliance and data subject rights under frameworks like GDPR.
Interpretive note: The precise contractual terms of Cohere's DPA are referenced but not reproduced in the public privacy policy, so the exact scope of processor obligations and sub-processor disclosure mechanisms cannot be fully assessed from this document alone.
The updated policy removes explicit language describing data retention timelines and deletion request procedures that were previously available. The prior policy stated that Enterprise Users' inputs and outputs were retained for 30 days, that Trial Users and Researchers were not intended to process personal information, and that deletion requests would normally be responded to within one month (up to three months for complex requests). The updated policy now contains only a general reference to 'retention practices' without specifying these timelines, response windows, or user-type distinctions. Users cannot determine from the updated policy what retention periods apply to their account category or what timeline to expect for deletion requests.
View change record →Users of customer-built applications access those applications under terms established by the customer as data controller, not by Cohere directly. Cohere's role is limited to processing personal information according to customer instructions, which means customer privacy policies and data handling practices—not Cohere's—govern how personal information is collected and used in those applications.
How other platforms handle this
If you are in the 'Designated Countries', LinkedIn Ireland Unlimited Company ('LinkedIn Ireland') will be the controller of your personal data provided to, or collected by or for, or processed in connection with our Services. If you are outside of the Designated Countries, LinkedIn Corporation will ...
Crusoe (Sees code data for inference): We manage Crusoe's compute for training some of our custom models, as well as hosting some of our custom models. Modal (Sees code data for inference): We manage Modal's compute for training some of our custom models, as well as hosting some of our custom models...
We use information about you to provide, improve, and develop our products and services, personalize your experience, show you relevant content and ads, and communicate with you. We draw inferences about your interests and preferences based on your activity on Pinterest and elsewhere.
Monitoring
Cohere has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"When our customers use our API to build their own products and services, they act as data controllers for any personal information their end users provide through those applications. In such cases, Cohere acts as a data processor, processing personal information on behalf of our customers in accordance with their instructions and our Data Processing Agreement.— Excerpt from Cohere's Cohere Privacy Policy
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision allocates data protection responsibilities by designating the customer as the party responsible for lawful basis, compliance obligations, and end-user disclosures, while Cohere assumes processor liability for handling personal information according to customer directions. This allocation determines which party bears primary responsibility for regulatory compliance and data subject rights under frameworks like GDPR.
Users of customer-built applications access those applications under terms established by the customer as data controller, not by Cohere directly. Cohere's role is limited to processing personal information according to customer instructions, which means customer privacy policies and data handling practices—not Cohere's—govern how personal information is collected and used in those applications.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cohere.