For API users, Mistral AI keeps your prompts and AI responses for 30 days after generation to monitor for abuse, unless you have activated zero data retention. Agents API data is kept until you close your account.
If you or a business you use deploys Mistral AI's APIs, your conversation data is retained for up to 30 days for abuse monitoring unless the operator has enabled zero data retention — creating a window during which your data is accessible to Mistral AI.
Cross-platform context
See how other platforms handle Data Retention — API Inputs and Outputs (30-Day Rolling Window) and similar clauses.
Compare across platforms →Developers and businesses using the API should know their users' data is retained for 30 days by default, which may conflict with their own privacy commitments or data minimisation obligations.
(1) REGULATORY FRAMEWORK: This provision implicates GDPR Art. 5(1)(e) (storage limitation principle), which requires personal data be kept no longer than necessary for the stated purpose. The 30-day retention for abuse monitoring must be justified by a documented necessity assessment. GDPR Art. 28(3)(g) requires data processing agreements to specify retention and deletion obligations, making this provision directly relevant to DPA compliance for commercial API customers. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.