Mistral AI Privacy Policy

This is Mistral AI's privacy policy covering how the company collects and uses your personal data when you use products like Le Chat and Mistral AI Studio. The most important thing to know is that if you use the free version of Le Chat or free APIs, Mistral AI can use your chat messages and AI-generated responses to train its AI models unless you actively opt out. You can opt out of your conversations being used for AI model training through your account settings, and you can also turn off or delete the Memory feature that stores personal details from your conversations.

This Privacy Policy, effective April 8, 2026, governs Mistral AI's collection and processing of personal data for individual users of its consumer-facing products (Le Chat, Mistral AI Studio), with Mistral AI (a French entity, SIREN 952 418 325) acting as data controller and invoking GDPR-compliant lawful bases including contractual performance, legitimate interest, and consent. The document creates significant obligations for Mistral AI to honor data subject rights (access, rectification, erasure, portability, objection, and restriction) and imposes opt-out rights for users regarding the use of their Inputs and Outputs for AI model training. Notably, the policy uses 'legitimate interest' as the lawful basis for AI model training on free-tier user Inputs and Outputs — a contested legal ground under GDPR that has drawn regulatory scrutiny across multiple EU supervisory authorities — and explicitly carves out paid API and Le Chat Enterprise users from this training use. The policy engages GDPR (Regulation 2016/679), the French Data Protection Act (Loi Informatique et Libertés), and the EU AI Act (Regulation 2024/1689); the primary enforcement authority is the French CNIL, though cross-border processing triggers Article 56 GDPR cooperation mechanisms with other EU supervisory authorities. Material compliance considerations include the adequacy of the legitimate interest assessment (LIA) for model training, the Memory feature's handling of sensitive health data under GDPR Article 9, and the policy's explicit exclusion of business users (who are directed to a separate Data Processing Addendum).