Mistral AI is legally obligated to respond to requests from users who want to access, correct, delete, export, or restrict their personal data, and has a DPO contactable via a web form or by post.
This analysis describes what Mistral AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes Mistral AI's GDPR compliance framework by explicitly defining the types of personal data subject to rights requests and establishing a procedural mechanism for users to exercise data access, correction, deletion, and portability rights under applicable EU data protection law.
The updated policy now explicitly includes data accessed through third-party services and integrations users connect to Mistral AI Products as 'Input' data subject to collection and use. The policy removed its prior statement that Input and Output data are not used to train AI models when using Le Chat Enterprise or paid versions of Mistral APIs. This creates operational ambiguity: users of paid services and Enterprise customers no longer have a documented commitment that their data will be excluded from model training, though the privacy policy does not affirmatively state that model training now occurs. The policy also changed language describing product improvement from 'aggregated and anonymous statistics' to 'aggregated or anonymous datasets or statistics,' broadening the stated scope of what can be collected for improvement purposes.
View change record →You can formally request access to, correction of, deletion of, or a copy of your personal data held by Mistral AI by contacting their Data Protection Officer via the Privacy Requests form, and Mistral AI is legally required to respond.
How other platforms handle this
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
to request that your data be transferred to a third party (data portability)
"To reply to your requests to exercise your rights on your personal data [...] Your Civil Identity Data, Your Account Data, Your Contact Data, Any other personal data included in your privacy request [...] Our legal obligation to reply to your requests.Excerpt from Mistral AI's Privacy Policy
(1) REGULATORY FRAMEWORK: This provision fulfils Mistral AI's obligations under GDPR Arts.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision operationalizes Mistral AI's GDPR compliance framework by explicitly defining the types of personal data subject to rights requests and establishing a procedural mechanism for users to exercise data access, correction, deletion, and portability rights under applicable EU data protection law.
You can formally request access to, correction of, deletion of, or a copy of your personal data held by Mistral AI by contacting their Data Protection Officer via the Privacy Requests form, and Mistral AI is legally required to respond.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Mistral AI.