This analysis describes what Cohere's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision allocates data protection responsibilities by designating the customer as the party responsible for lawful basis, compliance obligations, and end-user disclosures, while Cohere assumes processor liability for handling personal information according to customer directions. This allocation determines which party bears primary responsibility for regulatory compliance and data subject rights under frameworks like GDPR.
Interpretive note: The precise contractual terms of Cohere's DPA are referenced but not reproduced in the public privacy policy, so the exact scope of processor obligations and sub-processor disclosure mechanisms cannot be fully assessed from this document alone.
The updated policy removes explicit language describing data retention timelines and deletion request procedures that were previously available. The prior policy stated that Enterprise Users' inputs and outputs were retained for 30 days, that Trial Users and Researchers were not intended to process personal information, and that deletion requests would normally be responded to within one month (up to three months for complex requests). The updated policy now contains only a general reference to 'retention practices' without specifying these timelines, response windows, or user-type distinctions. Users cannot determine from the updated policy what retention periods apply to their account category or what timeline to expect for deletion requests.
View change record →Users of customer-built applications access those applications under terms established by the customer as data controller, not by Cohere directly. Cohere's role is limited to processing personal information according to customer instructions, which means customer privacy policies and data handling practices—not Cohere's—govern how personal information is collected and used in those applications.
How other platforms handle this
We collect information about you when you shop in our stores, including through store cameras, loyalty programs, payment processing systems, and other in-store technologies. This information is used to improve store operations, loss prevention, and marketing.
We target (and measure the performance of) ads to Members, Visitors and others both on and off our Services directly or through a variety of partners, using the following data, whether separately or combined: Data from advertising technologies on and off our Services, like web beacons, pixels, ad ta...
We may de-identify or aggregate your personal information so that it can no longer reasonably identify you, and use such de-identified or aggregated data for any purpose, including sharing with third parties for research, analytics, and marketing purposes, without restriction.
Monitoring
Cohere has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When our customers use our API to build their own products and services, they act as data controllers for any personal information their end users provide through those applications. In such cases, Cohere acts as a data processor, processing personal information on behalf of our customers in accordance with their instructions and our Data Processing Agreement.— Excerpt from Cohere's Cohere Privacy Policy
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision allocates data protection responsibilities by designating the customer as the party responsible for lawful basis, compliance obligations, and end-user disclosures, while Cohere assumes processor liability for handling personal information according to customer directions. This allocation determines which party bears primary responsibility for regulatory compliance and data subject rights under frameworks like GDPR.
Users of customer-built applications access those applications under terms established by the customer as data controller, not by Cohere directly. Cohere's role is limited to processing personal information according to customer instructions, which means customer privacy policies and data handling practices—not Cohere's—govern how personal information is collected and used in those applications.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cohere.