Incident #2BA9F5 · 31 DEC 2025minor
Mistral's EU privacy policy adds AI training disclosures and a US state privacy section
The EU privacy policy now says training data may include datasets provided by third parties, which can contain personal data, and adds a long section for US state residents covering their rights, data categories and purposes. It also states that Mistral uses product use for training where terms permit, and that training began in 2023. The 30-day abuse-monitoring retention for API Inputs and Outputs was already in the old policy; only a typo was fixed.
Taken from you
- Third-party datasets provided to Mistral for model training may include personal data, even after filtering.
Won back
- Clearer disclosure of training data sources and that training began in 2023
- US state residents get listed rights to access, delete, correct and appeal
- Statement that Mistral has not sold or shared personal data or used it for targeted advertising in the past 12 months
Evidence · 4 of 4 quotes matched in source
Our artificial intelligence models are trained on data that is publicly available on the Internet by third parties, which may contain personal data, even if we use good practices to filter out such personal data.+ inserted · ✓ matched in source
Except for specific APIs, we keep your Input and Output for the period necessary to generate the Output and then for thirty (30) rolling days to monitor abuse (unless zero data retention is activated).+ inserted · ✓ matched in source
your use of our products (to the extent permitted by our applicable terms), internally generated data, curated datasets, and synthetic data.+ inserted · ✓ matched in source
Such collection and training began in 2023, is ongoing, and is used to improve our artificial intelligence models.+ inserted · ✓ matched in source
Archived version ↗ · 1,104 words changed