Mistral Processes Personal Data as Data Controller

The updated terms restrict API access to business customers only; consumers outside the EEA can no longer use Mistral AI's APIs for personal needs. Mistral AI Studio is also now limited to business customers and excluded from the consumer terms. Additionally, the terms now explicitly disclaim third-party models and connectors as not Mistral AI products and provide them 'as is' without warranties beyond legal guarantees that cannot be excluded. Consumers who were previously using APIs for personal purposes will no longer have contractual authorization to do so under these terms.

The updated terms expand the scope of actions Mistral AI may perform when users connect third-party services. Previously, the terms stated Mistral AI could 'retrieve, process, and store' data; the revised language now explicitly authorizes the company to 'execute actions upon your request, including to retrieve, process, store, execute, transmit, modify, delete, invoke, or otherwise act upon' data and resources. The terms also clarify that users are solely responsible for actions they request through these integrations, and that Mistral AI bears no responsibility for actions performed by third-party MCP servers, including 'actions, executions, routing, modifications, accesses, storage, transfers, disclosures, corruption, or deletions' of data or systems. Users should review the specific third-party service terms before enabling integrations, as the updated language grants broader operational authority over connected data and systems.