The Mistral consumer assistant

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AVD-2026-0018

Kind

Consumer tier

Jurisdiction

France

Last verified

15 September 2026

Added

15 September 2026

• Inputs and outputs are used to train Mistral's models under legitimate interest, subject to the user's opt out.
• Feedback is the exception. Rating a response surrenders the associated input and output for training regardless of the setting.
• Conversations are kept until the person deletes the account or deletes the conversation from the assistant.
• The September 2026 privacy policy names the consumer assistant Vibe and the developer platform Mistral AI Studio.

Used for training by default, Retention period, Deletion on request, Storage region and residency, Subprocessor list published, Human review of content, Opt out available, DPA available, Persistent memory across sessions, Last change to the terms. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

Used for training by defaultStated

Yes by default under legitimate interest, subject to opt out. Feedback is carved out, so rating a response gives up that input and output for training either way.Mistral AI privacy policy, primary source, 3 September 2026.

Retention periodStated

No automatic clock on conversations. Inputs and outputs are kept until the person deletes the account or deletes the conversation from the assistant.Mistral AI privacy policy, primary source, 3 September 2026.

Deletion on requestStated

User driven, with fixed periods afterwards for identity and account data, and permanent deletion once the legal retention periods have expired.Mistral AI privacy policy, primary source, 3 September 2026.

Storage region and residencyStated

A French controller that prioritises providers within the European Union, and attaches standard contractual clauses to contracts with providers outside it.Mistral AI privacy policy, primary source, 3 September 2026.

Subprocessor list publishedStated

Audited, each under a dedicated data protection agreement, and listed on Mistral's trust centre rather than inside the policy.Mistral AI privacy policy, primary source, 3 September 2026.

Human review of contentSilent

No human review of conversations is described in the privacy policy or the consumer terms. The only human obligation runs the other way, on labelling output.Mistral AI terms of service for European consumers, primary source, 7 August 2026.

Opt out availableStated

Yes, a toggle in user preferences on the account, separate from the platform toggle, and separate again from the personalisation setting.Mistral AI privacy policy, primary source, 3 September 2026.

DPA availableSilent

Out of scope by the policy's own terms. It does not apply where the products are used to process personal data in the course of business activities.Mistral AI privacy policy, primary source, 3 September 2026.

Persistent memory across sessionsStated

Yes and named. The memory feature is described as becoming a knowledge base, and previous memories are retained in it.Mistral AI privacy policy, primary source, 3 September 2026.

Last change to the termsStated

The privacy policy prints Effective 3 September 2026 and the European consumer terms print Effective 7 August 2026.Mistral AI privacy policy, primary source, 3 September 2026.

1. 5 years

   Retention of civil identity data after account termination

   Mistral AI privacy policy, primary source, as of 3 September 2026.

2. 1 year

   Retention of account data after deletion

   Mistral AI privacy policy, primary source, as of 3 September 2026.

A European vendor is not automatically the conservative choice on the consumer tier. Training is on by default here, the legal basis is legitimate interest rather than consent, and there is no automatic retention clock on conversations at all. What you do get is a French controller, European hosting preference and a real opt out, which is a meaningfully different transfer story from the United States vendors even where the training default matches.

1. Mistral AI privacy policyPrimary · 3 September 2026
2. Mistral AI terms of service for European consumersPrimary · 7 August 2026
3. Mistral AI help centre, opting out of trainingPrimary · 15 September 2026

• VerifiedAPI and platformAVD-2026-0019

  The Mistral developer platform

  France · verified 15 September 2026

  The addendum says Mistral trains its models in accordance with its privacy policy unless the customer is or has opted out.

• VerifiedConsumer tierAVD-2026-0001

  ChatGPT Free, Plus and Pro

  United States · verified 15 September 2026

  Training is on by default on the consumer plans. The help centre says OpenAI may use content from services for individuals to train its models.

• Open questionOpen questionAVD-2026-0029

  Is a subprocessor change notice period actually enforceable?

  European Union · verified 15 September 2026

  Article 28 of the General Data Protection Regulation states that the processor shall not engage another processor without prior specific or general written authorisation of the controller.