Mistral AI Privacy Policy

This document is Mistral AI's Privacy Policy (effective April 8, 2026), governing personal data collection, use, and retention for consumer-facing products including Le Chat and Mistral AI Studio, with Mistral AI (a French company) acting as data controller under GDPR principles. The policy states it uses contractual necessity, legitimate interest, and consent as lawful bases for processing; notably, the terms authorize use of user Inputs and Outputs for AI model training under a legitimate interest basis unless users opt out, with an explicit carve-out stating that Le Chat Enterprise and paid API users are excluded from this training use. The training opt-out structure, reliance on legitimate interest rather than consent for model training, and the Memory feature's potential to store sensitive health data represent operationally distinct provisions; the policy asserts that sensitive data in the Memory feature is processed on explicit consent, though the degree to which incidental inclusion of sensitive data in prompts triggers adequate prior consent mechanisms warrants evaluation. As a French company with EU-based operations, this policy engages GDPR most directly, including obligations around data subject rights, lawful basis documentation, and DPO appointment; the EU AI Act may also require evaluation given Mistral AI's role as an AI model provider, and California residents may have additional rights under CCPA that are not explicitly addressed in this document.