Loading report

CertScore.ai report

Loading report

The report is ready; we’re loading its retained findings and evidence.

mistral.ai tracking, cookie, consent, and accessibility scan | CertScore.ai

Scanned from EU-IR

Oct 12, 2026, 7:34:21 PM UTC(16 sec scan)

Coverage

CMS / generator: Not identified
Declared version: Not available

Coverage

Scan scope: Single page
Pages scanned: 1
Scan region: EU-IR

Timing

Observation window: 16 sec

Started: Oct 12, 2026, 7:34:21 PM UTC
Completed: Oct 12, 2026, 7:34:38 PM UTC

mistral.ai

https://mistral.ai/

Executive overview

62/ 100

Page score

4 priority issues

1 page scanned

Assessment highlights

This assessment needs work, with activity before consent the first area to review. “Pre-consent non-essential tracking”: Tracking-classified requests were observed before consent: Google Analytics. The first retained qualifying request was Google Analytics at 3.78s after scan start. Review the retained vendor and request timing evidence, confirm purpose and necessity, and gate confirmed non-essential requests until the relevant consent state is available. Could not complete: “Observed form transport”. Also review “Decline consent control” and “Pre-consent storage classification review”.

Pre-consent resource counts & classifications

Each resource is counted once. Services group requests, cookies/storage and frames.

Requests47

Non-essential: 3
Classification review: 0
Unknown purpose: 11
Contextual: 33
Essential: 0

Cookies & storage4

Non-essential: 0
Classification review: 3
Unknown purpose: 0
Contextual: 0
Essential: 1

Embedded frames0

Non-essential: 0
Classification review: 0
Unknown purpose: 0
Contextual: 0
Essential: 0

Services3

Cloudflare Bot Management
Google Analytics
Google Tag Manager

Forms0

Hidden links0

Requests473 non-essential0 review

Cookies & storage40 non-essential3 review

Embedded frames00 non-essential0 review

Regulatory Risk Review

Top issues on this page

4 issues

01Pre-consent non-essential trackingStarting pageTracking-classified requests were observed before consent: Google Analytics. The first retained qualifying request was Google Analytics at 3.78s after scan start.Potential gapPotential gap

Affected pages

https://mistral.ai/ · Starting page

GDPR / ePrivacy: Pre-consent non-essential tracking
Tracking-classified requests were observed before consent: Google Analytics. The first retained qualifying request was Google Analytics at 3.78s after scan start.

Recommended fixes

View supporting evidence ↓

Review the retained vendor and request timing evidence, confirm purpose and necessity, and gate confirmed non-essential requests until the relevant consent state is available.

JSON evidence

{
  "assessmentStatus": "gap_observed",
  "checklistItemId": "pre_consent_third_party_tracking",
  "coverageArea": "Pre-consent non-essential tracking",
  "evidenceState": "observed",
  "explanation": "Analytics or performance-measurement requests fired before a recorded consent choice, including Google Analytics. Review whether the retained evidence reflects non-essential measurement rather than strictly necessary site operation.",
  "note": "Analytics or performance-measurement requests fired before a recorded consent choice, including Google Analytics. Review whether the retained evidence reflects non-essential measurement rather than strictly necessary site operation.",
  "status": "Gap observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "unified_finding",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_third_party_tracking.gap_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_third_party_tracking"
  },
  "statusBasis": "Classified non-essential tracking request timing evidence was retained before a recorded consent action.",
  "retainedEvidence": {
    "status": "Gap observed",
    "evidenceRefs": [
      "First pre-consent classified tracking request observation: 3.78s after scan start",
      "Third-party tracking observed before recorded consent",
      "Review issue: Trackers fired before consent interaction",
      "Signal: Pre-consent tracking detected",
      "Review issue: Pre-consent tracking incidents detected",
      "Evidence flag: explicit_policy_snippet_retained"
    ],
    "findingEntities": [
      {
        "id": "preconsent_tracking",
        "entities": {
          "runtimeVendors": [
            "Google Analytics"
          ],
          "runtimeRequestUrls": [
            "https://region1.google-analytics.com/g/collect?v=[redacted]&tid=[redacted]&gtm=[redacted]&_p=[redacted]&gcs=[redacted]&gcd=[redacted]&npa=[redacted]&dma_cps=[redacted]&dma=[redacted]&gdid=[redacted]&_eu=[redacted]&are=[redacted]&cid=[redacted]&frm=[redacted]&ibt=[redacted]&ngs=[redacted]",
            "https://www.googletagmanager.com/gtm.js?id=GTM-TX82W9W8",
            "https://static.axept.io/sdk.js",
            "https://www.googletagmanager.com/gtag/js?id=G-V0SRTQLQ82&cx=c&gtm=4e6a80",
            "https://static.axept.io/behavior-detection.min.js"
          ],
          "observedRuntimeVendors": [
            "Google Analytics"
          ],
          "observedTrackingVendors": [
            "Google Analytics"
          ],
          "preconsent_tracker_vendors": [
            "Google Analytics"
          ]
        },
        "sourceRefs": [
          "Review issue: Trackers fired before consent interaction",
          "Signal: Pre-consent tracking detected",
          "Review issue: Pre-consent tracking incidents detected"
        ],
        "evidenceFlags": [
          "privacy.preconsent_tracking_detected",
          "privacy.tracking_before_consent_detected"
        ]
      }
    ],
    "evidenceHighlights": [
      "First pre-consent classified tracking request observation: 3.78s after scan start"
    ],
    "missingEvidenceNeeded": [],
    "trackingRequestTiming": {
      "version": "classified-request-timing.v1",
      "requests": [
        {
          "requestUrl": "https://region1.google-analytics.com/g/collect?redacted=1",
          "vendorName": "Google Analytics",
          "firstSeenMs": 3776,
          "evidenceRefs": [
            "net_1162"
          ],
          "runtimePhase": "pre_consent",
          "vendorCategory": "analytics"
        }
      ]
    },
    "selectedEvidenceReason": "Selected retained pre-consent request/vendor timing evidence; storage evidence is evaluated separately.",
    "weakerArtifactsIgnored": [],
    "preconsentTimingEvidence": {
      "thirdPartyTracking": {
        "trackingRequestTiming": {
          "version": "classified-request-timing.v1",
          "requests": [
            {
              "requestUrl": "https://region1.google-analytics.com/g/collect?redacted=1",
              "vendorName": "Google Analytics",
              "firstSeenMs": 3776,
              "evidenceRefs": [
                "net_1162"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "analytics"
            }
          ]
        },
        "preconsentThirdPartyTrackingObservedMs": [
          3776
        ],
        "firstPreconsentThirdPartyTrackingObservedMs": 3776,
        "firstPreconsentThirdPartyTrackingObservationBasis": "classified_request_timing.v1",
        "preconsentThirdPartyTrackingTimedObservationCount": 1
      }
    },
    "selectedEvidenceStrength": "strong",
    "selectedEvidenceArtifactId": "preConsentTrackingRequestEvidence",
    "preconsentThirdPartyTrackingObservedMs": [
      3776
    ],
    "firstPreconsentThirdPartyTrackingObservedMs": 3776,
    "firstPreconsentThirdPartyTrackingObservationBasis": "classified_request_timing.v1",
    "preconsentThirdPartyTrackingTimedObservationCount": 1
  },
  "projectedFindings": [
    {
      "id": "preconsent_tracking",
      "label": "Third-party tracking observed before recorded consent",
      "severity": "high"
    }
  ],
  "missingOrIncompleteSourceSignals": [],
  "groupedEvidence": [],
  "evidenceDetails": {
    "policyEvidenceDetails": {
      "assessmentStatus": "gap_observed",
      "evidenceRefs": [
        "Third-party tracking observed before recorded consent",
        "Review issue: Trackers fired before consent interaction",
        "Signal: Pre-consent tracking detected",
        "Review issue: Pre-consent tracking incidents detected",
        "Evidence flag: explicit_policy_snippet_retained",
        "Evidence flag: contradiction_runtime_artifact_retained"
      ],
      "explanation": "Analytics or performance-measurement requests fired before a recorded consent choice, including Google Analytics. Review whether the retained evidence reflects non-essential measurement rather than strictly necessary site operation.",
      "regulatoryAreaId": "gdpr_eprivacy",
      "regulatoryAreaTitle": "GDPR / ePrivacy",
      "regulatoryMapping": [],
      "missingOrIncompleteSourceSignals": [],
      "pipeline": {
        "projectionStage": "unified_finding",
        "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_third_party_tracking.gap_observed",
        "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
        "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_third_party_tracking"
      },
      "projectedFindings": [
        {
          "id": "preconsent_tracking",
          "label": "Third-party tracking observed before recorded consent",
          "severity": "high"
        }
      ],
      "retainedEvidence": {
        "status": "Gap observed",
        "evidenceRefs": [
          "First pre-consent classified tracking request observation: 3.78s after scan start",
          "Third-party tracking observed before recorded consent",
          "Review issue: Trackers fired before consent interaction",
          "Signal: Pre-consent tracking detected",
          "Review issue: Pre-consent tracking incidents detected",
          "Evidence flag: explicit_policy_snippet_retained"
        ],
        "findingEntities": [
          {
            "id": "preconsent_tracking",
            "entities": {
              "runtimeVendors": [
                "Google Analytics"
              ],
              "runtimeRequestUrls": [
                "https://region1.google-analytics.com/g/collect?v=[redacted]&tid=[redacted]&gtm=[redacted]&_p=[redacted]&gcs=[redacted]&gcd=[redacted]&npa=[redacted]&dma_cps=[redacted]&dma=[redacted]&gdid=[redacted]&_eu=[redacted]&are=[redacted]&cid=[redacted]&frm=[redacted]&ibt=[redacted]&ngs=[redacted]",
                "https://www.googletagmanager.com/gtm.js?id=GTM-TX82W9W8",
                "https://static.axept.io/sdk.js",
                "https://www.googletagmanager.com/gtag/js?id=G-V0SRTQLQ82&cx=c&gtm=4e6a80",
                "https://static.axept.io/behavior-detection.min.js"
              ],
              "observedRuntimeVendors": [
                "Google Analytics"
              ],
              "observedTrackingVendors": [
                "Google Analytics"
              ],
              "preconsent_tracker_vendors": [
                "Google Analytics"
              ]
            },
            "sourceRefs": [
              "Review issue: Trackers fired before consent interaction",
              "Signal: Pre-consent tracking detected",
              "Review issue: Pre-consent tracking incidents detected"
            ],
            "evidenceFlags": [
              "privacy.preconsent_tracking_detected",
              "privacy.tracking_before_consent_detected"
            ]
          }
        ],
        "evidenceHighlights": [
          "First pre-consent classified tracking request observation: 3.78s after scan start"
        ],
        "missingEvidenceNeeded": [],
        "trackingRequestTiming": {
          "version": "classified-request-timing.v1",
          "requests": [
            {
              "requestUrl": "https://region1.google-analytics.com/g/collect?redacted=1",
              "vendorName": "Google Analytics",
              "firstSeenMs": 3776,
              "evidenceRefs": [
                "net_1162"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "analytics"
            }
          ]
        },
        "selectedEvidenceReason": "Selected retained pre-consent request/vendor timing evidence; storage evidence is evaluated separately.",
        "weakerArtifactsIgnored": [],
        "preconsentTimingEvidence": {
          "thirdPartyTracking": {
            "trackingRequestTiming": {
              "version": "classified-request-timing.v1",
              "requests": [
                {
                  "requestUrl": "https://region1.google-analytics.com/g/collect?redacted=1",
                  "vendorName": "Google Analytics",
                  "firstSeenMs": 3776,
                  "evidenceRefs": [
                    "net_1162"
                  ],
                  "runtimePhase": "pre_consent",
                  "vendorCategory": "analytics"
                }
              ]
            },
            "preconsentThirdPartyTrackingObservedMs": [
              3776
            ],
            "firstPreconsentThirdPartyTrackingObservedMs": 3776,
            "firstPreconsentThirdPartyTrackingObservationBasis": "classified_request_timing.v1",
            "preconsentThirdPartyTrackingTimedObservationCount": 1
          }
        },
        "selectedEvidenceStrength": "strong",
        "selectedEvidenceArtifactId": "preConsentTrackingRequestEvidence",
        "preconsentThirdPartyTrackingObservedMs": [
          3776
        ],
        "firstPreconsentThirdPartyTrackingObservedMs": 3776,
        "firstPreconsentThirdPartyTrackingObservationBasis": "classified_request_timing.v1",
        "preconsentThirdPartyTrackingTimedObservationCount": 1
      },
      "rowId": "pre_consent_third_party_tracking",
      "rowLabel": "Pre-consent non-essential tracking",
      "rowNote": "Tracking-classified requests were observed before consent: Google Analytics. The first retained qualifying request was Google Analytics at 3.78s after scan start.",
      "statusBasis": "Tracking-classified requests were observed before consent: Google Analytics. The first retained qualifying request was Google Analytics at 3.78s after scan start.",
      "regulatoryConcernKind": "potential_gap",
      "status": "Gap observed"
    }
  },
  "evidenceRefs": [
    "Third-party tracking observed before recorded consent",
    "Review issue: Trackers fired before consent interaction",
    "Signal: Pre-consent tracking detected",
    "Review issue: Pre-consent tracking incidents detected",
    "Evidence flag: explicit_policy_snippet_retained",
    "Evidence flag: contradiction_runtime_artifact_retained"
  ],
  "findingId": "regulatory_gap__gdpr_eprivacy__pre_consent_third_party_tracking"
}

02Decline consent controlStarting pagePartial support from scan evidence; The retained consent interaction structure shows reject was not available on the first layer.Partial concernPartial concern

Affected pages

https://mistral.ai/ · Starting page

GDPR / ePrivacy: Decline consent control
Partial support from scan evidence; The retained consent interaction structure shows reject was not available on the first layer.

Recommended fixes

View supporting evidence ↓

Review the retained first-layer consent-control inventory. If it confirms no reject or necessary-only control, add a visible refusal action and retest regional and device variants.

JSON evidence

{
  "assessmentStatus": "review_signal",
  "checklistItemId": "reject_all_path_availability",
  "coverageArea": "Decline consent control",
  "evidenceState": "observed",
  "explanation": "Whether a first-layer reject, necessary-only, decline, refuse, or equivalent refusal option was observed on a sufficiently retained consent surface.",
  "note": "Whether a first-layer reject, necessary-only, decline, refuse, or equivalent refusal option was observed on a sufficiently retained consent surface.",
  "status": "Review signal",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "unified_finding",
    "concernPolicyKey": "gdpr_eprivacy_coverage.reject_all_path_availability.review_signal",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.reject_all_path_availability"
  },
  "statusBasis": "Selected retained same-surface reject-path or post-reject comparison evidence.",
  "retainedEvidence": {
    "status": "Review signal",
    "evidenceRefs": [
      "Reject button missing",
      "Signal: Reject button missing",
      "Evidence flag: explicit_policy_snippet_retained",
      "Evidence flag: contradiction_runtime_artifact_retained",
      "Evidence flag: privacy.dark_pattern_reject_button_missing",
      "Evidence strength: direct runtime"
    ],
    "findingEntities": [
      {
        "id": "reject_button_missing",
        "entities": {
          "findingSubtype": [
            "consent_governance_disclosure_gap"
          ],
          "consentSurfaceObserved": [
            "true"
          ],
          "consentSurfaceDecisionStates": [
            "consent_surface_observed",
            "reject_absent_first_layer"
          ],
          "consentActionableChoiceObserved": [
            "true"
          ],
          "consentGovernanceDisclosureEvidence": [
            "{\"concernId\":\"consent_governance_disclosure_gap\",\"relevanceTriggers\":{\"consentBannerObserved\":true},\"missingOrWeakDisclosureSignals\":{},\"supportingAnchors\":{\"cookiePolicyUrls\":[],\"observedConsentVendors\":[],\"observedControls\":[],\"observedTrackingVendors\":[],\"policyUrls\":[],\"preferenceCenterUrls\":[],\"runtimeAnchors\":[\"scan_runtime_artifacts.reject_path_depth_and_availability\"],\"textAnchors\":[]},\"coverage\":{}}"
          ]
        },
        "sourceRefs": [
          "Signal: Reject button missing"
        ],
        "evidenceFlags": [
          "explicit_policy_snippet_retained",
          "contradiction_runtime_artifact_retained",
          "privacy.dark_pattern_reject_button_missing"
        ]
      }
    ],
    "evidenceHighlights": [
      "The retained consent interaction structure shows reject was not available on the first layer.",
      "scan_runtime_artifacts.reject_path_depth_and_availability",
      "Consent governance disclosure note: retained public materials did not clearly explain how users can revisit, change, withdraw, retain, renew, expire, or understand consent choices."
    ],
    "missingEvidenceNeeded": [
      "Confirmed first-layer GDPR/ePrivacy cookie banner and same-surface accept/reject control inventory."
    ],
    "selectedEvidenceReason": "Selected retained same-surface reject-path or post-reject comparison evidence.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "limited",
    "selectedEvidenceArtifactId": "rejectPathDepthAndAvailability"
  },
  "projectedFindings": [
    {
      "id": "reject_button_missing",
      "label": "Reject button missing",
      "severity": "high"
    }
  ],
  "missingOrIncompleteSourceSignals": [],
  "groupedEvidence": [],
  "evidenceDetails": {
    "policyEvidenceDetails": {
      "assessmentStatus": "review_signal",
      "evidenceRefs": [
        "Reject button missing",
        "Signal: Reject button missing",
        "Evidence flag: explicit_policy_snippet_retained",
        "Evidence flag: contradiction_runtime_artifact_retained",
        "Evidence flag: privacy.dark_pattern_reject_button_missing",
        "Evidence strength: direct runtime"
      ],
      "explanation": "Whether a first-layer reject, necessary-only, decline, refuse, or equivalent refusal option was observed on a sufficiently retained consent surface.",
      "regulatoryAreaId": "gdpr_eprivacy",
      "regulatoryAreaTitle": "GDPR / ePrivacy",
      "regulatoryMapping": [],
      "missingOrIncompleteSourceSignals": [],
      "pipeline": {
        "projectionStage": "unified_finding",
        "concernPolicyKey": "gdpr_eprivacy_coverage.reject_all_path_availability.review_signal",
        "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
        "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.reject_all_path_availability"
      },
      "projectedFindings": [
        {
          "id": "reject_button_missing",
          "label": "Reject button missing",
          "severity": "high"
        }
      ],
      "retainedEvidence": {
        "status": "Review signal",
        "evidenceRefs": [
          "Reject button missing",
          "Signal: Reject button missing",
          "Evidence flag: explicit_policy_snippet_retained",
          "Evidence flag: contradiction_runtime_artifact_retained",
          "Evidence flag: privacy.dark_pattern_reject_button_missing",
          "Evidence strength: direct runtime"
        ],
        "findingEntities": [
          {
            "id": "reject_button_missing",
            "entities": {
              "findingSubtype": [
                "consent_governance_disclosure_gap"
              ],
              "consentSurfaceObserved": [
                "true"
              ],
              "consentSurfaceDecisionStates": [
                "consent_surface_observed",
                "reject_absent_first_layer"
              ],
              "consentActionableChoiceObserved": [
                "true"
              ],
              "consentGovernanceDisclosureEvidence": [
                "{\"concernId\":\"consent_governance_disclosure_gap\",\"relevanceTriggers\":{\"consentBannerObserved\":true},\"missingOrWeakDisclosureSignals\":{},\"supportingAnchors\":{\"cookiePolicyUrls\":[],\"observedConsentVendors\":[],\"observedControls\":[],\"observedTrackingVendors\":[],\"policyUrls\":[],\"preferenceCenterUrls\":[],\"runtimeAnchors\":[\"scan_runtime_artifacts.reject_path_depth_and_availability\"],\"textAnchors\":[]},\"coverage\":{}}"
              ]
            },
            "sourceRefs": [
              "Signal: Reject button missing"
            ],
            "evidenceFlags": [
              "explicit_policy_snippet_retained",
              "contradiction_runtime_artifact_retained",
              "privacy.dark_pattern_reject_button_missing"
            ]
          }
        ],
        "evidenceHighlights": [
          "The retained consent interaction structure shows reject was not available on the first layer.",
          "scan_runtime_artifacts.reject_path_depth_and_availability",
          "Consent governance disclosure note: retained public materials did not clearly explain how users can revisit, change, withdraw, retain, renew, expire, or understand consent choices."
        ],
        "missingEvidenceNeeded": [
          "Confirmed first-layer GDPR/ePrivacy cookie banner and same-surface accept/reject control inventory."
        ],
        "selectedEvidenceReason": "Selected retained same-surface reject-path or post-reject comparison evidence.",
        "weakerArtifactsIgnored": [],
        "selectedEvidenceStrength": "limited",
        "selectedEvidenceArtifactId": "rejectPathDepthAndAvailability"
      },
      "rowId": "reject_all_path_availability",
      "rowLabel": "Decline consent control",
      "rowNote": "Partial support from scan evidence; The retained consent interaction structure shows reject was not available on the first layer.",
      "statusBasis": "Partial support from scan evidence; The retained consent interaction structure shows reject was not available on the first layer.",
      "regulatoryConcernKind": "partial_rating",
      "status": "Review signal"
    }
  },
  "evidenceRefs": [
    "Reject button missing",
    "Signal: Reject button missing",
    "Evidence flag: explicit_policy_snippet_retained",
    "Evidence flag: contradiction_runtime_artifact_retained",
    "Evidence flag: privacy.dark_pattern_reject_button_missing",
    "Evidence strength: direct runtime"
  ],
  "findingId": "regulatory_gap__gdpr_eprivacy__reject_all_path_availability"
}

03Pre-consent storage classification reviewStarting pageCookies or browser storage were retained before consent. First retained item: axeptio_all_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot. Essentiality was not confirmed for every item.Partial concernPartial concern

Affected pages

https://mistral.ai/ · Starting page

GDPR / ePrivacy: Pre-consent storage classification review
Cookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.

Recommended fixes

View supporting evidence ↓

Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence. For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration. Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice.

JSON evidence

{
  "assessmentStatus": "review_signal",
  "checklistItemId": "pre_consent_cookies_storage",
  "coverageArea": "Pre-consent storage classification review",
  "evidenceState": "observed",
  "explanation": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "note": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "status": "Review signal",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_cookies_storage.review_signal",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_cookies_storage"
  },
  "statusBasis": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.",
        "For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.",
        "Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice."
      ]
    },
    "evidenceRefs": [
      "axeptio_all_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
      "axeptio_authorized_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
      "axeptio_cookies (mistral.ai): unknown, present in periodic pre-consent snapshot",
      "__cf_bm (mistral.ai): essential, first observed 0.731s after scan start",
      "Aggregate pre-consent storage count: 4",
      "Assessment reconciliation: reconciled"
    ],
    "cookiesSeenCount": 4,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected retained concrete cookie/storage evidence for storage timing; request-only tracking evidence is not used as storage proof.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "limited",
    "cookiesBeforeConsentCount": 0,
    "selectedEvidenceArtifactId": "preConsentCookieOrStorageEvidence.missing",
    "preConsentStorageAssessment": {
      "status": "partially_classified",
      "evidenceRows": [
        {
          "name": "__cf_bm",
          "party": "first_party",
          "domain": "mistral.ai",
          "category": "security",
          "storageType": "cookie",
          "essentiality": "essential",
          "timingEvidence": "before_consent_write",
          "exclusionReason": "functional_or_consent_storage",
          "firstObservedMs": 731,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "canonical_registry",
          "exactStorageIdentity": "[\"__cf_bm\",\".mistral.ai\",\"/\",null]"
        },
        {
          "name": "axeptio_cookies",
          "party": "first_party",
          "domain": "mistral.ai",
          "category": "unknown",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 3616,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"axeptio_cookies\",\"mistral.ai\",\"/\",null]"
        },
        {
          "name": "axeptio_authorized_vendors",
          "party": "first_party",
          "domain": "mistral.ai",
          "category": "unknown",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 3616,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"axeptio_authorized_vendors\",\"mistral.ai\",\"/\",null]"
        },
        {
          "name": "axeptio_all_vendors",
          "party": "first_party",
          "domain": "mistral.ai",
          "category": "unknown",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 3616,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"axeptio_all_vendors\",\"mistral.ai\",\"/\",null]"
        }
      ],
      "provenWriteCount": 0,
      "assessmentVersion": "pre-consent-storage-assessment-v1",
      "unclassifiedCount": 3,
      "reconciliationStatus": "reconciled",
      "snapshotPresenceCount": 3,
      "aggregateObservedCount": 4,
      "classifiedEssentialCount": 1,
      "classifiedNonEssentialCount": 0,
      "attributedPreConsentRecordCount": 4,
      "excludedFunctionalOrConsentCount": 1
    },
    "excludedEssentialOrFunctionalRows": [
      {
        "name": "__cf_bm",
        "party": "first_party",
        "domain": "mistral.ai",
        "category": "security",
        "storageType": "cookie",
        "essentiality": "essential",
        "timingEvidence": "before_consent_write",
        "exclusionReason": "functional_or_consent_storage",
        "firstObservedMs": 731,
        "initiatorDomain": null,
        "initiatorVendor": null,
        "essentialitySource": "canonical_registry",
        "exactStorageIdentity": "[\"__cf_bm\",\".mistral.ai\",\"/\",null]"
      }
    ],
    "preConsentStorageAssessmentStatus": "partially_classified",
    "rowLevelEssentialityEvidenceRetained": true,
    "firstPreconsentCookieOrStorageObservedMs": 731,
    "preConsentStorageClassificationLimitation": true,
    "preconsentCookieOrStorageExactTimingRetained": false,
    "eligibleNonEssentialCookieStorageFindingProjected": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": [],
  "groupedEvidence": [],
  "evidenceDetails": {
    "policyEvidenceDetails": {
      "assessmentStatus": "review_signal",
      "evidenceRefs": [
        "axeptio_all_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
        "axeptio_authorized_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
        "axeptio_cookies (mistral.ai): unknown, present in periodic pre-consent snapshot",
        "__cf_bm (mistral.ai): essential, first observed 0.731s after scan start",
        "Aggregate pre-consent storage count: 4",
        "Assessment reconciliation: reconciled"
      ],
      "explanation": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
      "regulatoryAreaId": "gdpr_eprivacy",
      "regulatoryAreaTitle": "GDPR / ePrivacy",
      "regulatoryMapping": [],
      "missingOrIncompleteSourceSignals": [],
      "pipeline": {
        "projectionStage": "coverage_policy",
        "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_cookies_storage.review_signal",
        "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
        "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_cookies_storage"
      },
      "projectedFindings": [],
      "retainedEvidence": {
        "remediation": {
          "kind": "steps",
          "steps": [
            "Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.",
            "For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.",
            "Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice."
          ]
        },
        "evidenceRefs": [
          "axeptio_all_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
          "axeptio_authorized_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
          "axeptio_cookies (mistral.ai): unknown, present in periodic pre-consent snapshot",
          "__cf_bm (mistral.ai): essential, first observed 0.731s after scan start",
          "Aggregate pre-consent storage count: 4",
          "Assessment reconciliation: reconciled"
        ],
        "cookiesSeenCount": 4,
        "missingEvidenceNeeded": [],
        "selectedEvidenceReason": "Selected retained concrete cookie/storage evidence for storage timing; request-only tracking evidence is not used as storage proof.",
        "weakerArtifactsIgnored": [],
        "selectedEvidenceStrength": "limited",
        "cookiesBeforeConsentCount": 0,
        "selectedEvidenceArtifactId": "preConsentCookieOrStorageEvidence.missing",
        "preConsentStorageAssessment": {
          "status": "partially_classified",
          "evidenceRows": [
            {
              "name": "__cf_bm",
              "party": "first_party",
              "domain": "mistral.ai",
              "category": "security",
              "storageType": "cookie",
              "essentiality": "essential",
              "timingEvidence": "before_consent_write",
              "exclusionReason": "functional_or_consent_storage",
              "firstObservedMs": 731,
              "initiatorDomain": null,
              "initiatorVendor": null,
              "essentialitySource": "canonical_registry",
              "exactStorageIdentity": "[\"__cf_bm\",\".mistral.ai\",\"/\",null]"
            },
            {
              "name": "axeptio_cookies",
              "party": "first_party",
              "domain": "mistral.ai",
              "category": "unknown",
              "storageType": "cookie",
              "essentiality": "unknown",
              "timingEvidence": "periodic_preconsent_snapshot",
              "exclusionReason": null,
              "firstObservedMs": 3616,
              "initiatorDomain": null,
              "initiatorVendor": null,
              "essentialitySource": "unknown",
              "exactStorageIdentity": "[\"axeptio_cookies\",\"mistral.ai\",\"/\",null]"
            },
            {
              "name": "axeptio_authorized_vendors",
              "party": "first_party",
              "domain": "mistral.ai",
              "category": "unknown",
              "storageType": "cookie",
              "essentiality": "unknown",
              "timingEvidence": "periodic_preconsent_snapshot",
              "exclusionReason": null,
              "firstObservedMs": 3616,
              "initiatorDomain": null,
              "initiatorVendor": null,
              "essentialitySource": "unknown",
              "exactStorageIdentity": "[\"axeptio_authorized_vendors\",\"mistral.ai\",\"/\",null]"
            },
            {
              "name": "axeptio_all_vendors",
              "party": "first_party",
              "domain": "mistral.ai",
              "category": "unknown",
              "storageType": "cookie",
              "essentiality": "unknown",
              "timingEvidence": "periodic_preconsent_snapshot",
              "exclusionReason": null,
              "firstObservedMs": 3616,
              "initiatorDomain": null,
              "initiatorVendor": null,
              "essentialitySource": "unknown",
              "exactStorageIdentity": "[\"axeptio_all_vendors\",\"mistral.ai\",\"/\",null]"
            }
          ],
          "provenWriteCount": 0,
          "assessmentVersion": "pre-consent-storage-assessment-v1",
          "unclassifiedCount": 3,
          "reconciliationStatus": "reconciled",
          "snapshotPresenceCount": 3,
          "aggregateObservedCount": 4,
          "classifiedEssentialCount": 1,
          "classifiedNonEssentialCount": 0,
          "attributedPreConsentRecordCount": 4,
          "excludedFunctionalOrConsentCount": 1
        },
        "excludedEssentialOrFunctionalRows": [
          {
            "name": "__cf_bm",
            "party": "first_party",
            "domain": "mistral.ai",
            "category": "security",
            "storageType": "cookie",
            "essentiality": "essential",
            "timingEvidence": "before_consent_write",
            "exclusionReason": "functional_or_consent_storage",
            "firstObservedMs": 731,
            "initiatorDomain": null,
            "initiatorVendor": null,
            "essentialitySource": "canonical_registry",
            "exactStorageIdentity": "[\"__cf_bm\",\".mistral.ai\",\"/\",null]"
          }
        ],
        "preConsentStorageAssessmentStatus": "partially_classified",
        "rowLevelEssentialityEvidenceRetained": true,
        "firstPreconsentCookieOrStorageObservedMs": 731,
        "preConsentStorageClassificationLimitation": true,
        "preconsentCookieOrStorageExactTimingRetained": false,
        "eligibleNonEssentialCookieStorageFindingProjected": false
      },
      "rowId": "pre_consent_cookies_storage",
      "rowLabel": "Pre-consent storage classification review",
      "rowNote": "Cookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.",
      "statusBasis": "Cookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.",
      "regulatoryConcernKind": "partial_rating",
      "status": "Review signal"
    }
  },
  "evidenceRefs": [
    "axeptio_all_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
    "axeptio_authorized_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
    "axeptio_cookies (mistral.ai): unknown, present in periodic pre-consent snapshot",
    "__cf_bm (mistral.ai): essential, first observed 0.731s after scan start",
    "Aggregate pre-consent storage count: 4",
    "Assessment reconciliation: reconciled"
  ],
  "findingId": "regulatory_gap__gdpr_eprivacy__pre_consent_cookies_storage"
}

04Accessibility issuesStarting pageReview automated accessibility findings and retained examples in Detailed evidence.ReviewReview

Affected pages

https://mistral.ai/ · Starting page

Keyboard navigation accessibility issue
Semantic labeling accessibility issue

Recommended fixes

View accessibility breakdown in Detailed evidence ↓

Fix the retained keyboard-related WCAG examples, verify controls are reachable and operable with Tab, Shift+Tab, Enter, Space, and Escape, then rerun the scan.
Repair labels, accessible names, role/ARIA usage, and semantic structure for the retained axe examples, then rerun the accessibility scan.

JSON evidence

{
  "presentationGroup": "accessibility",
  "groupedFindingIds": [
    "keyboard_navigation_accessibility_issue",
    "semantic_labeling_accessibility_issue"
  ],
  "findings": [
    {
      "correctionSteps": [
        "Fix the retained keyboard-related WCAG examples, verify controls are reachable and operable with Tab, Shift+Tab, Enter, Space, and Escape, then rerun the scan."
      ],
      "priority": "high",
      "evidence": [
        "Automated accessibility checks found failures on 1 tested page (1 element failure). Interactive controls were nested inside other interactive controls.",
        "CanonicalEvidenceBundle.json#accessibilityAudit",
        "Axe example: nested-interactive/wcag2a, wcag412 on https://mistral.ai/; selector .group\\/product-dropdown; nodes 1; impact serious; severity high; help: Interactive controls must not be nested.",
        "https://mistral.ai/"
      ],
      "evidenceJson": {
        "groupedEvidence": [],
        "evidenceDetails": {
          "counts": {
            "representativeAxePageCount": 1,
            "representativeAxeRuleCount": 1,
            "accessibilityExampleNodeCount": 1,
            "representativeAxeExampleCount": 1
          },
          "scanContext": {
            "pageUrl": "https://mistral.ai/",
            "scanMode": "initial_page_load"
          },
          "limitations": [
            "Automated scan does not determine legal status.",
            "Representative evidence is capped and should be reviewed with the full scan record before final conclusions."
          ],
          "evidenceSnippets": [
            "CanonicalEvidenceBundle.json#accessibilityAudit",
            "Axe example: nested-interactive/wcag2a, wcag412 on https://mistral.ai/; selector .group\\/product-dropdown; nodes 1; impact serious; severity high; help: Interactive controls must not be nested."
          ],
          "pageUrls": [
            "https://mistral.ai/"
          ],
          "sourceUrls": [
            "https://mistral.ai/"
          ],
          "sourceSignals": [
            "accessibility.audit.keyboard_navigation_accessibility_issue: Keyboard navigation accessibility issue"
          ],
          "evidenceFlags": [
            "representative_accessibility_examples_retained"
          ],
          "accessibilityEvidence": {
            "observed": true,
            "basis": "CanonicalEvidenceBundle.json#accessibilityAudit",
            "representativeExamplesRetained": 1,
            "representativeNodesRetained": 1,
            "affectedNodes": 1,
            "nodeCountBasis": "rule_node_occurrences",
            "pageCount": 1,
            "axeRuleId": "nested-interactive",
            "ruleCodes": [
              "nested-interactive"
            ],
            "impact": "serious",
            "impacts": [
              "serious"
            ],
            "severity": "high",
            "axeEvidence": [
              {
                "ruleId": "nested-interactive",
                "impact": "serious",
                "nodeCount": 1,
                "description": "Ensure interactive controls are not nested as they are not always announced by screen readers or can cause focus problems for assistive technologies",
                "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/nested-interactive?application=axeAPI",
                "pageUrl": "https://mistral.ai/",
                "representativeNodes": [
                  {
                    "selectors": [
                      ".group\\/product-dropdown"
                    ],
                    "failureSummary": "Fix any of the following: Element has focusable descendants",
                    "htmlSnippet": "<button class>"
                  }
                ],
                "representativeSelectors": [
                  ".group\\/product-dropdown"
                ]
              }
            ]
          }
        },
        "evidenceRefs": [
          "https://mistral.ai/",
          "https://www.w3.org/WAI/standards-guidelines/wcag/"
        ],
        "findingId": "keyboard_navigation_accessibility_issue"
      },
      "focus": "Accessibility",
      "id": "keyboard_navigation_accessibility_issue",
      "rank": 4,
      "status": "Observed",
      "summary": "Automated accessibility checks found failures on 1 tested page (1 element failure). Interactive controls were nested inside other interactive controls.",
      "title": "Keyboard navigation accessibility issue",
      "vendors": []
    },
    {
      "correctionSteps": [
        "Repair labels, accessible names, role/ARIA usage, and semantic structure for the retained axe examples, then rerun the accessibility scan."
      ],
      "priority": "high",
      "evidence": [
        "Automated accessibility checks found failures on 1 tested page (3 element failures). Buttons lacked discernible accessible names.",
        "CanonicalEvidenceBundle.json#accessibilityAudit",
        "Axe example: button-name/wcag2a, wcag412 on https://mistral.ai/; selector .outline; nodes 3; impact critical; severity high; help: Buttons must have discernible text.",
        "https://mistral.ai/"
      ],
      "evidenceJson": {
        "groupedEvidence": [],
        "evidenceDetails": {
          "counts": {
            "representativeAxePageCount": 1,
            "representativeAxeRuleCount": 1,
            "accessibilityExampleNodeCount": 3,
            "representativeAxeExampleCount": 1
          },
          "scanContext": {
            "pageUrl": "https://mistral.ai/",
            "scanMode": "initial_page_load"
          },
          "limitations": [
            "Automated scan does not determine legal status.",
            "Representative evidence is capped and should be reviewed with the full scan record before final conclusions."
          ],
          "evidenceSnippets": [
            "CanonicalEvidenceBundle.json#accessibilityAudit",
            "Axe example: button-name/wcag2a, wcag412 on https://mistral.ai/; selector .outline; nodes 3; impact critical; severity high; help: Buttons must have discernible text."
          ],
          "pageUrls": [
            "https://mistral.ai/"
          ],
          "sourceUrls": [
            "https://mistral.ai/"
          ],
          "sourceSignals": [
            "accessibility.audit.semantic_labeling_accessibility_issue: Semantic labeling accessibility issue"
          ],
          "evidenceFlags": [
            "representative_accessibility_examples_retained"
          ],
          "accessibilityEvidence": {
            "observed": true,
            "basis": "CanonicalEvidenceBundle.json#accessibilityAudit",
            "representativeExamplesRetained": 1,
            "representativeNodesRetained": 3,
            "affectedNodes": 3,
            "nodeCountBasis": "rule_node_occurrences",
            "pageCount": 1,
            "axeRuleId": "button-name",
            "ruleCodes": [
              "button-name"
            ],
            "impact": "critical",
            "impacts": [
              "critical"
            ],
            "severity": "high",
            "axeEvidence": [
              {
                "ruleId": "button-name",
                "impact": "critical",
                "nodeCount": 3,
                "description": "Ensure buttons have discernible text",
                "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/button-name?application=axeAPI",
                "pageUrl": "https://mistral.ai/",
                "representativeNodes": [
                  {
                    "selectors": [
                      ".outline"
                    ],
                    "failureSummary": "Fix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role=\"none\" or role=\"presentation\"",
                    "htmlSnippet": "<button class data-theme>"
                  },
                  {
                    "selectors": [
                      "button[data-theme]"
                    ],
                    "failureSummary": "Fix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role=\"none\" or role=\"presentation\"",
                    "htmlSnippet": "<button class data-theme>"
                  },
                  {
                    "selectors": [
                      "button[data-theme]"
                    ],
                    "failureSummary": "Fix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role=\"none\" or role=\"presentation\"",
                    "htmlSnippet": "<button class data-theme>"
                  }
                ],
                "representativeSelectors": [
                  ".outline",
                  "button[data-theme]"
                ]
              }
            ]
          }
        },
        "evidenceRefs": [
          "https://mistral.ai/",
          "https://www.w3.org/WAI/standards-guidelines/wcag/"
        ],
        "findingId": "semantic_labeling_accessibility_issue"
      },
      "focus": "Accessibility",
      "id": "semantic_labeling_accessibility_issue",
      "rank": 5,
      "status": "Observed",
      "summary": "Automated accessibility checks found failures on 1 tested page (3 element failures). Buttons lacked discernible accessible names.",
      "title": "Semantic labeling accessibility issue",
      "vendors": []
    }
  ]
}

Pre-consent page event timeline

Scan start

Public page observation began

0.73s

Cookie observed

Essential cookie · retained observation

0.73s

Pre-consent storage review

Classification review · first retained observation

2.49s

3P request

3P request first observed

3.78s

Analytics

Analytics first observed

3.78s

Non-essential request

Canonical pre-consent tracking concern observed

13.98s

Consent banner

accept: Observed · reject: Not observed · options: Observed

15.67s

Observation end

Retained scan window closed

Pre-consent supporting evidence

Services & Resources

Resource breakdowns

51 distinct resources = 47 requests + 4 cookies & storage. Services group these resources.

Type mix

Requests47
Cookies & storage4

Evidence mix

Non-essential3
Classification review3
Unknown purpose11
Contextual33
Essential1

Purpose mix

Unknown purpose47
Tag management2
Analytics1

Site relationship

First party43
Third party8

Services and their member resources
						Domain	Site relationship
1	Google Analytics	Analytics	Policy disclosure · Not found Google Analytics Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. https://legal.mistral.ai/terms/privacy-policy/?language=en-US Reviewed 2026-10-12T19:34:38.063Z · Complete retained text Evidence SHA-256: 5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba	Location details Google Analytics Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. 1 of 1 request events assessed; 1 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed US-controlled vendor; mechanism requires current vendor/legal verification. Registry reference date: 2026-07-23. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Google LLC Google identifies Mountain View, California as its headquarters. This does not identify a customer's regional Google contracting entity or Alphabet's headquarters. Sources checked 2026-09-07 Google company history Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	3.78s	region1.google-analytics.com	Third party	Captured on 1 page https://mistral.ai/
2	Google Tag Manager	Tag management	Policy disclosure · Not found Google Tag Manager Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. https://legal.mistral.ai/terms/privacy-policy/?language=en-US Reviewed 2026-10-12T19:34:38.063Z · Complete retained text Evidence SHA-256: 5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba	Location details Google Tag Manager Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. United States 172.253.116.97 · Google LLC · AS15169 Approximate server country · Source: proxy connect iplocate Country database: 2026-10-07 Network database: 2026-10-07 2 of 2 request events assessed; 0 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed US-controlled vendor; mechanism requires current vendor/legal verification. Registry reference date: 2026-07-23. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Google LLC Google identifies Mountain View, California as its headquarters. This does not identify a customer's regional Google contracting entity or Alphabet's headquarters. Sources checked 2026-09-07 Google company history Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	2.49s	www.googletagmanager.com	Third party	Captured on 1 page https://mistral.ai/
1	Cloudflare Bot Management	Security	Policy disclosure · Not found Cloudflare Bot Management Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. https://legal.mistral.ai/terms/privacy-policy/?language=en-US Reviewed 2026-10-12T19:34:38.063Z · Complete retained text Evidence SHA-256: 5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba	Location details Cloudflare Bot Management Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. Complete destination coverage is not available for this historical evidence. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Cloudflare, Inc. San Francisco is explicitly marked as headquarters; regional offices are listed separately. Sources checked 2026-09-07 About Cloudflare Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	0.73s	mistral.ai	First party	Captured on 1 page https://mistral.ai/

Unattributed resources (47)

3 distinct services, including child services and unattributed resources

Forms: no forms observed on the scanned pages.

Detailed evidence

Privacy & security ratingsStarting page

29 rows

1concern2Needs review17positive8contextual1limited

CertScore.ai can make mistakes. Verify all findings.

CMP details

13 checks · 10 limited

Limited

Consent platform not i...

Consent management audit · 13 criteria

Reject optionReject or an equivalent refusal option was available on the banner.Not observed

View consent choices ↓

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "reject",
    "label": "Option to reject cookies available",
    "status": "Not observed",
    "detail": "First-layer Reject or equivalent refusal control.",
    "sourceIds": [
      "consentControlAssessment.controls.reject"
    ]
  }
}

Correction steps

01Check the evidence for this item before making changes.

Accept / Reject prominenceNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "prominence",
    "label": "Accept / Reject prominence comparison",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Category choicesNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "categories",
    "label": "Selection by categories available",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

CMP service listNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "services",
    "label": "Individual services identified in the CMP",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Privacy-policy linkA privacy-policy link or page was found.Observed

View privacy-policy discovery evidence ↓

Privacy link before consentNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "privacy_access",
    "label": "Privacy-policy link reachable before consent interaction",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Browser consent recordNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "consent_record",
    "label": "Client-side consent decision recorded",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Tracking after consent choicesAction evidence was insufficient to assess implementation.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "implementation",
    "label": "Tracking activity after consent choices",
    "status": "Not assessed",
    "detail": "The retained action evidence does not establish whether settings are implemented correctly. No implementation pass is inferred from an absence of findings.",
    "sourceIds": []
  }
}

Consent-cookie expiryNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "duration",
    "label": "Consent-cookie expiry observed",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Pre-consent cookie comparisonNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "declared_not_found",
    "label": "CMP cookie declarations compared with pre-consent capture",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Unmatched cookie namesNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "found_not_declared",
    "label": "Observed cookie names missing from CMP declarations",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Cookie detailsNot enough verified evidence was captured.Not assessed

View cookie-disclosure availability ↓

JSON evidence

{
  "scope": "starting_page",
  "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
  "assessmentSourceHash": "fnv1a-d6621b15",
  "criterion": {
    "id": "cookie_information",
    "label": "Information about cookies available (e.g., storage duration)",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Tracking & embeds

4 checks · 1 to review

Review

Pre-consent non-essential trackingTracking-classified requests were observed before consent: Google Analytics. The first retained qualifying request was Google Analytics at 3.78s after scan start.Potential gap

JSON evidence

First pre-consent classified tracking request observation: 3.78s after scan start

Full evidence JSON

{
  "assessmentStatus": "gap_observed",
  "checklistItemId": "pre_consent_third_party_tracking",
  "coverageArea": "Pre-consent non-essential tracking",
  "evidenceState": "observed",
  "explanation": "Analytics or performance-measurement requests fired before a recorded consent choice, including Google Analytics. Review whether the retained evidence reflects non-essential measurement rather than strictly necessary site operation.",
  "note": "Analytics or performance-measurement requests fired before a recorded consent choice, including Google Analytics. Review whether the retained evidence reflects non-essential measurement rather than strictly necessary site operation.",
  "status": "Gap observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "unified_finding",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_third_party_tracking.gap_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_third_party_tracking"
  },
  "statusBasis": "Classified non-essential tracking request timing evidence was retained before a recorded consent action.",
  "retainedEvidence": {
    "status": "Gap observed",
    "evidenceRefs": [
      "First pre-consent classified tracking request observation: 3.78s after scan start",
      "Third-party tracking observed before recorded consent",
      "Review issue: Trackers fired before consent interaction",
      "Signal: Pre-consent tracking detected",
      "Review issue: Pre-consent tracking incidents detected",
      "Evidence flag: explicit_policy_snippet_retained"
    ],
    "findingEntities": [
      {
        "id": "preconsent_tracking",
        "entities": {
          "runtimeVendors": [
            "Google Analytics"
          ],
          "runtimeRequestUrls": [
            "https://region1.google-analytics.com/g/collect?v=[redacted]&tid=[redacted]&gtm=[redacted]&_p=[redacted]&gcs=[redacted]&gcd=[redacted]&npa=[redacted]&dma_cps=[redacted]&dma=[redacted]&gdid=[redacted]&_eu=[redacted]&are=[redacted]&cid=[redacted]&frm=[redacted]&ibt=[redacted]&ngs=[redacted]",
            "https://www.googletagmanager.com/gtm.js?id=GTM-TX82W9W8",
            "https://static.axept.io/sdk.js",
            "https://www.googletagmanager.com/gtag/js?id=G-V0SRTQLQ82&cx=c&gtm=4e6a80",
            "https://static.axept.io/behavior-detection.min.js"
          ],
          "observedRuntimeVendors": [
            "Google Analytics"
          ],
          "observedTrackingVendors": [
            "Google Analytics"
          ],
          "preconsent_tracker_vendors": [
            "Google Analytics"
          ]
        },
        "sourceRefs": [
          "Review issue: Trackers fired before consent interaction",
          "Signal: Pre-consent tracking detected",
          "Review issue: Pre-consent tracking incidents detected"
        ],
        "evidenceFlags": [
          "privacy.preconsent_tracking_detected",
          "privacy.tracking_before_consent_detected"
        ]
      }
    ],
    "evidenceHighlights": [
      "First pre-consent classified tracking request observation: 3.78s after scan start"
    ],
    "missingEvidenceNeeded": [],
    "trackingRequestTiming": {
      "version": "classified-request-timing.v1",
      "requests": [
        {
          "requestUrl": "https://region1.google-analytics.com/g/collect?redacted=1",
          "vendorName": "Google Analytics",
          "firstSeenMs": 3776,
          "evidenceRefs": [
            "net_1162"
          ],
          "runtimePhase": "pre_consent",
          "vendorCategory": "analytics"
        }
      ]
    },
    "selectedEvidenceReason": "Selected retained pre-consent request/vendor timing evidence; storage evidence is evaluated separately.",
    "weakerArtifactsIgnored": [],
    "preconsentTimingEvidence": {
      "thirdPartyTracking": {
        "trackingRequestTiming": {
          "version": "classified-request-timing.v1",
          "requests": [
            {
              "requestUrl": "https://region1.google-analytics.com/g/collect?redacted=1",
              "vendorName": "Google Analytics",
              "firstSeenMs": 3776,
              "evidenceRefs": [
                "net_1162"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "analytics"
            }
          ]
        },
        "preconsentThirdPartyTrackingObservedMs": [
          3776
        ],
        "firstPreconsentThirdPartyTrackingObservedMs": 3776,
        "firstPreconsentThirdPartyTrackingObservationBasis": "classified_request_timing.v1",
        "preconsentThirdPartyTrackingTimedObservationCount": 1
      }
    },
    "selectedEvidenceStrength": "strong",
    "selectedEvidenceArtifactId": "preConsentTrackingRequestEvidence",
    "preconsentThirdPartyTrackingObservedMs": [
      3776
    ],
    "firstPreconsentThirdPartyTrackingObservedMs": 3776,
    "firstPreconsentThirdPartyTrackingObservationBasis": "classified_request_timing.v1",
    "preconsentThirdPartyTrackingTimedObservationCount": 1
  },
  "projectedFindings": [
    {
      "id": "preconsent_tracking",
      "label": "Third-party tracking observed before recorded consent",
      "severity": "high"
    }
  ],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the listed tracking requests, initiating integrations, and purposes against the retained pre-consent timing.
2Gate consent-dependent tracking at the tag or integration and verify that essential traffic remains separately classified.
3Retest the same page in fresh sessions before consent, after Reject, and after Accept; compare the listed endpoints and retain the results.

Third-party iframes before consentNo third-party iframes were detected before a consent choice.Not observed

JSON evidence

retained pre-consent iframe inventory

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "third_party_iframe_pre_consent",
  "coverageArea": "3rd party iframes before consent",
  "evidenceState": "not_observed",
  "explanation": "Whether retained scanner evidence showed known 3rd party iframe embeds before a recorded consent action.",
  "note": "Whether retained scanner evidence showed known 3rd party iframe embeds before a recorded consent action.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.third_party_iframe_pre_consent.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.third_party_iframe_pre_consent"
  },
  "statusBasis": "Retained iframe inventory did not show known 3rd party iframe embeds before a recorded consent action.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained pre-consent iframe inventory"
    ],
    "missingEvidenceNeeded": [],
    "preConsentIframeCount": 0,
    "iframeObservationCount": 0,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Social/media services before consentNo social or media services loaded before a consent choice.Not observed

JSON evidence

retained pre-consent embedded-content inventory

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "social_media_embed_pre_consent",
  "coverageArea": "Social/media embeds or plugins loaded before consent",
  "evidenceState": "not_observed",
  "explanation": "Whether retained network/runtime evidence showed a social, video, media embed, social pixel, or plugin provider loading before a recorded consent action.",
  "note": "Whether retained network/runtime evidence showed a social, video, media embed, social pixel, or plugin provider loading before a recorded consent action.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.social_media_embed_pre_consent.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.social_media_embed_pre_consent"
  },
  "statusBasis": "Retained embedded-content checks did not show a social/media embed, plugin, widget, or pixel provider request before consent. Plain outbound links are not treated as evidence for this row.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained pre-consent embedded-content inventory"
    ],
    "placeholderDetected": false,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "socialMediaEmbedObservationCount": 0
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Third-party embeds before consentNo third-party embeds were detected before a consent choice.Not observed

JSON evidence

EmbeddedContentObservationCount: 0

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "embedded_content_pre_consent",
  "coverageArea": "Embedded third-party services before consent",
  "evidenceState": "not_observed",
  "explanation": "Whether retained scanner evidence showed iframe, embed, widget, or visibly integrated third-party services before a recorded consent action. This row does not represent all background analytics or network requests.",
  "note": "Whether retained scanner evidence showed iframe, embed, widget, or visibly integrated third-party services before a recorded consent action. This row does not represent all background analytics or network requests.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.embedded_content_pre_consent.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.embedded_content_pre_consent"
  },
  "statusBasis": "Iframe/runtime checks completed for the tested context and did not retain a concrete 3rd party embedded-content iframe before consent.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained pre-consent embedded-content inventory"
    ],
    "missingEvidenceNeeded": [],
    "preConsentIframeCount": 0,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "embeddedContentObservationCount": 0
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Policies & disclosures

12 checks · 2 limited

Limited

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: Not retained.

Open policy source

Excerpt: Retention. on. Undertaking activities to verify or maintain the quality or safety of the Mistral AI Products, and to improve, upgrade, or enhance the Mistral AI Products. 10. Changes to this Privacy Policy We may amend this Privacy Policy from time to time as our products continuously evolve. Make sure to check this Privacy Policy frequently. On this page

Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "privacy_notice_availability",
  "coverageArea": "Privacy notice link/surface discovered",
  "evidenceState": "observed",
  "explanation": "Whether a reachable privacy notice or privacy policy link/surface was retained. This row does not by itself confirm that substantive notice content was available.",
  "note": "Whether a reachable privacy notice or privacy policy link/surface was retained. This row does not by itself confirm that substantive notice content was available.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.privacy_notice_availability.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.privacy_notice_availability"
  },
  "statusBasis": "Privacy notice evidence was retained in public policy-surface evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Excerpt: Retention. on. Undertaking activities to verify or maintain the quality or safety of the Mistral AI Products, and to improve, upgrade, or enhance the Mistral AI Products. 10. Changes to this Privacy Policy We may amend this Privacy Policy from time to time as our products continuously evolve. Make sure to check this Privacy Policy frequently. On this page",
      "Evidence: privacy policy surface retained",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "policySurfaceSummary": {
      "scanStartedAt": "2026-10-12T19:34:22.395Z",
      "observedTopics": [
        "cookies",
        "analytics",
        "advertising",
        "targeted_advertising",
        "sale_or_share",
        "notice_at_collection",
        "profiling_or_automated_decision_making",
        "third_party_disclosures",
        "vendor_list",
        "consent_withdrawal",
        "data_retention",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories",
        "data_subject_rights",
        "international_transfers",
        "dpo_contact",
        "supervisory_authority",
        "ai_features",
        "contact_privacy"
      ],
      "cookiePolicyUrls": [],
      "cookieDisclosures": [],
      "mentionedControls": [
        "consent_withdrawal"
      ],
      "privacyPolicySize": {
        "url": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
        "completeness": "complete",
        "documentFormat": "text",
        "compressedBytes": 1370617,
        "measurementScope": "selected_usable_privacy_policy",
        "decompressedBytes": 1370617
      },
      "privacyPolicyUrls": [
        "https://legal.mistral.ai/terms/privacy-policy?language=en-US"
      ],
      "cookie_disclosures": [],
      "policySectionCount": 20,
      "policySurfaceCount": 3,
      "cookiePolicyPresent": false,
      "scannedPageLanguage": "en",
      "privacyPolicyPresent": true,
      "policyPrimaryLanguage": "en",
      "policyLastUpdatedTexts": [],
      "policyTextCoverageMode": "section_targeted",
      "retainedPolicySections": [
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To provide and maintain the Mistral AI Products provided to you under the condition",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms. Categories of personal data: Your Civil Identity Data Your Account Data Your Contract Data Your Technical Data Your Input, Output and Feedback Your Usage Data. Please note that we use part of your IP address to make your experience better, such as, for instance, to provide you with more accurate Outputs depending on where you use our Mistral AI Products. You can opt-out of this processing at any time through your user preferences on your Mistral AI Account.. Lawful basis: The performance of the contract between you and Mistral AI"
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To enhance your experience on Vibe via the Memory feature (now becoming Knowledge B",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To enhance your experience on Vibe via the Memory feature (now becoming Knowledge Base) by providing you more relevant and personalized answers based on your past interactions with Vibe. For more information about Knowledge Base, see our Help Center .. Categories of personal data: Your Input. As the Memory feature is becoming Knowledge Base, your previous Memories will be retained in Knowledge Base. Lawful basis: Our legitimate interest to provide you with an enhanced and personalized service. Your explicit consent for any sensitive data contained in your Memories (Knowledge Base will not seek to store sensitive data included in your Input) You can: Turn off the feature at all times through your settings Access, add, delete or edit your Memories or your Knowledge Base at all time through your settings. For more details about the controls you have on Knowledge Base, please see our Help Center ."
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — Debugging",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: Debugging. Categories of personal data: Your Input, Output and Feedback. Lawful basis: The performance of the contract between you and Mistral AI."
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To create and administer your Mistral AI Account",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To create and administer your Mistral AI Account. Categories of personal data: Your Civil Identity Data Your Account Data Your Contract Data. Lawful basis: The performance of the contract between you and Mistral AI."
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To provide customer support, including debugging and fixing errors reported by you",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To provide customer support, including debugging and fixing errors reported by you. Categories of personal data: Your Civil Identity Data Your Contact Data Your Feedback Your Input and Output. Lawful basis: The performance of the contract between you and Mistral AI."
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To manage the security and integrity of the Mistral AI Products",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To manage the security and integrity of the Mistral AI Products. Categories of personal data: Your Civil Identity Data Your Account Data Your Technical Data Your Contact Data Your Usage Data. Lawful basis: To comply with our legal obligations. Our legitimate interests in managing the security and integrity of the Mistral AI Products."
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To communicate with you, including to send you newsletters or non-marketing communi",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To communicate with you, including to send you newsletters or non-marketing communications about the Mistral AI Products. Categories of personal data: Your Civil Identity Data Your Contact Data. Lawful basis: Your consent, for marketing communications. The performance of the agreement, for all non-marketing communication (e.g. to send you notifications about changes to our terms)."
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To improve the Mistral AI Products or develop new products (but excluding model tra",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To improve the Mistral AI Products or develop new products (but excluding model training), such as to conduct research or to make aggregated or anonymous datasets or statistics. Categories of personal data: Your Civil Identity Data Your Feedback Your Input and Output Aggregated or anonymous datasets or statistics. Lawful basis: Our legitimate interest in continuously improving the Mistral AI Products and to introduce new features."
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To train our artificial intelligence models (large language models) to answer quest",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To train our artificial intelligence models (large language models) to answer questions, generate text, translate, summarize and correct text, classify text, analyze feelings, etc. according to context, Inputs (e-mails, letters, reports, computer code, etc.) and Outputs.. Categories of personal data: Personal data included in the data publicly available on the Internet, despite our efforts to filter out such personal data Your Input and Output, subject to your opt-out. Your Feedback.. Lawful basis: Our legitimate interest in developing and providing state-of-the-art large language models as part of the Mistral AI Products."
        },
        {
          "charEnd": 446961,
          "heading": "Why we use your personal data | Categories of personal data | Lawful basis — To manage and enforce our Terms of Service and licenses, including moderation and a",
          "quality": "partial",
          "charStart": 440296,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Why we use your personal data: To manage and enforce our Terms of Service and licenses, including moderation and abuse monitoring. Categories of personal data: Your Civil Identity Data Your Account Data Your Contact Data Your Input and Output Your Feedback. Lawful basis: The performance of the contract between you and Mistral AI."
        },
        {
          "charEnd": 453046,
          "heading": "Access.",
          "quality": "strong",
          "charStart": 452566,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center."
        },
        {
          "charEnd": 454330,
          "heading": "Objection.",
          "quality": "strong",
          "charStart": 453856,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "You have the right to object to the processing of your personal data. This right does not apply when we have a legal obligation to process your personal data. We’ve introduced a user control which allows you to object to the use of your input and output data for model training directly from your account. For more information, please refer to our Help Center."
        },
        {
          "charEnd": 455181,
          "heading": "Lodge a complaint.",
          "quality": "partial",
          "charStart": 454990,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL)."
        },
        {
          "charEnd": 436263,
          "heading": "1. Who collects your data?",
          "quality": "strong",
          "charStart": 435116,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are. Mistral AI is a French company incorporated in Paris, under number 952 418 325, having its registered offices at 15 rue des Halles, 75001 Paris (“ We ”, “ Us ” or “ Mistral AI ”). How to contact us: By sending us a letter at Mistral AI: Mistral AI, 15 rue des Halles, 75001 Paris, France. For any other concerns, please consult our Help Center and the relevant contact forms. How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France."
        },
        {
          "charEnd": 436263,
          "heading": "How to contact our Data Protection Officer (DPO):",
          "quality": "partial",
          "charStart": 435956,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France."
        },
        {
          "charEnd": 450547,
          "heading": "5. How long do we keep your personal data?",
          "quality": "strong",
          "charStart": 447285,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "We store your personal data only as long as needed for the purposes described in Section 3 of this Privacy Policy. You will find the main applicable retention periods below, for illustrative purposes: Data we use to provide Vibe to you: we keep your Input and Output until you delete your account or until you delete the conversation from Vibe. Data we use to provide our APIs to you: Except for specific APIs, we keep your Input and Output for the period necessary to generate the Output and then for thirty (30) rolling days to monitor abuse (unless zero data retention is activated). If you use our Agents API, we keep your Input and Output until you terminate your account. If you use our Fine-Tuning API, we keep your fine-tuning data until you delete it from Mistral AI Studio or until you terminate your account. Non-essential cookies data: only as long as you consent to their use. Your contact data (used for marketing operations): only as long as you are subscribed to our newsletter. Leads identity and contact data: for 3 years from collection. Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below."
        },
        {
          "charEnd": 451752,
          "heading": "6. Who do we share your personal data with?",
          "quality": "strong",
          "charStart": 450547,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "We may share your personal data on a need-to-know basis with the following parties: Our Team Members. Authorized members of our teams who need to access your personal data, strictly to perform their jobs Financial Institutions. Banks and other financial organizations Regulatory Authorities. Such as the French data protection authority (CNIL) Legal and Professional services. When appropriate, we may share data with competent courts, mediators, accountants, auditors, lawyers, bailiffs, and debt collection agencies. Additionally, we may share all or part of your personal data with our service providers. Before engaging with any provider which handles customer data, our security team conducts audits to ensure they meet our privacy and security standards, in accordance with our certifications.We sign a dedicated data protection agreement with each of these providers. Our main providers are listed on our Trust Center ."
        },
        {
          "charEnd": 452474,
          "heading": "7. Do we transfer Your Personal Data Outside of the European Union?",
          "quality": "strong",
          "charStart": 451752,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "We prioritize selecting providers within the European Union that strictly adhere to the GDPR. However, in exceptional cases, we may opt for non-EU providers that meet our high standards of data security and Personal Data protection. We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR. Additionally, we attach the most recent version of the European Commission’s Standard Contractual Clauses to all such contracts."
        },
        {
          "charEnd": 456202,
          "heading": "8. Your rights",
          "quality": "strong",
          "charStart": 452474,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "You can exercise the following rights : Access. You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center. Portability. You have the right to obtain and transfer your personal data you provided to another entity. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center. Rectification. You have the right to ask us to update or correct your personal data. Deletion. You have the right to delete and/or ask us to delete your personal data. We’ve introduced a user control which allows you to delete your account at all times. For more information, please refer to our Help Center. Objection. You have the right to object to the processing of your personal data. This right does not apply when we have a legal obligation to process your personal data."
        },
        {
          "charEnd": 1503,
          "heading": "data controller",
          "quality": "strong",
          "charStart": 544,
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "textExcerpt": "In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are. Mistral AI is a French company incorporated in Paris, under number 952 418 325, having its registered offices at 15 rue des Halles, 75001 Paris (“ We ”, “ Us ” or “ Mistral AI ”). How to contact us: By sending us a letter at Mistral AI: Mistral AI, 15 rue des Halles, 75001 Paris, France. For any other concerns, please consult our Help Center and the relevant contact forms. How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France. 2. What data do we collect? 2.1."
        }
      ],
      "cookieDisclosurePresent": true,
      "policyCookieDisclosures": [],
      "privacyPolicyDiscovered": true,
      "processingErrorObserved": false,
      "observedPolicyTopicHints": [
        "cookies",
        "analytics",
        "advertising",
        "targeted_advertising",
        "sale_or_share",
        "notice_at_collection",
        "profiling_or_automated_decision_making",
        "third_party_disclosures",
        "vendor_list",
        "consent_withdrawal",
        "data_retention",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories",
        "data_subject_rights",
        "international_transfers",
        "dpo_contact",
        "supervisory_authority",
        "ai_features",
        "contact_privacy"
      ],
      "policyDocumentProvenance": [
        {
          "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "policyTitle": "Privacy Policy",
          "artifactRefs": [
            "policy_excerpt_ed86901_a11a1bab",
            "policy_surface_text_ed86901_4ac9bde8"
          ],
          "effectiveDate": null,
          "observationId": "policy_surface_ed86901",
          "discoveryMethod": "footer_link",
          "documentHeading": "1. Who collects your data?",
          "lastUpdatedText": null,
          "detectedLanguage": "en",
          "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
          "targetRelationship": "target_controller",
          "translationApplied": false,
          "documentOwnerEntity": "legal.mistral.ai",
          "ownershipConfidence": 0.98,
          "translationTargetLanguage": null,
          "directlyLinkedFromScannedPage": true
        }
      ],
      "policy_cookie_disclosures": [],
      "article13DisclosureSignals": [
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "matchedTerm": "personal-data retention period or criterion",
          "evidenceText": "Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "data_retention",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_data_retention",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "selectedPolicySectionExcerpt": "Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below.",
          "selectedPolicySectionHeading": "5. How long do we keep your personal data?",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "matchedTerm": "enumerated data-subject rights disclosure",
          "evidenceText": "You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "data_subject_rights",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_data_subject_rights",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "selectedPolicySectionExcerpt": "You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center.",
          "selectedPolicySectionHeading": "8. Your rights",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "matchedTerm": "international or cross-border transfer disclosure",
          "evidenceText": "We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "international_transfers",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_international_transfers",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "selectedPolicySectionExcerpt": "We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR.",
          "selectedPolicySectionHeading": "7. Do we transfer Your Personal Data Outside of the European Union?",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.82,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "matchedTerm": "right to lodge a complaint",
          "evidenceText": "You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL).",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "supervisory_authority",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_supervisory_authority",
            "match_strength_equivalent",
            "variant_requires_privacy_context"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "selectedPolicySectionExcerpt": "You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL).",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "matchedTerm": "data protection officer",
          "evidenceText": "How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France.",
          "matchStrength": "direct",
          "matchedLocale": "en",
          "disclosureType": "dpo_contact",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_dpo_contact",
            "match_strength_direct"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "selectedPolicySectionExcerpt": "How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France.",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "evidenceText": "In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are.",
          "disclosureType": "controller_contact",
          "evidenceSource": "deterministic",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "supportingContactContext": null,
          "selectedPolicySectionExcerpt": "In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are.",
          "selectedPolicySectionHeading": "data controller"
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "matchedTerm": "use your personal data",
          "evidenceText": "Why we use your personal data: To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms.",
          "matchStrength": "direct",
          "matchedLocale": "en",
          "disclosureType": "processing_purposes",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_processing_purposes",
            "match_strength_direct"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "selectedPolicySectionExcerpt": "Why we use your personal data: To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms.",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.88,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "matchedTerm": "section-bound legal basis",
          "evidenceText": "Lawful basis: Our legitimate interest to provide you with an enhanced and personalized service.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "legal_basis",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_legal_basis",
            "match_strength_equivalent",
            "variant_section_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "selectedPolicySectionExcerpt": "Lawful basis: Our legitimate interest to provide you with an enhanced and personalized service.",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "matchedTerm": "named recipient or meaningful recipient category",
          "evidenceText": "Additionally, we may share all or part of your personal data with our service providers.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "recipients_or_vendor_categories",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_recipients_or_vendor_categories",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "selectedPolicySectionExcerpt": "Additionally, we may share all or part of your personal data with our service providers.",
          "selectedPolicySectionHeading": "6. Who do we share your personal data with?",
          "sourceCandidateProductionCredit": false
        }
      ],
      "policyTextExtractionHealth": {
        "policyUrls": [
          "https://legal.mistral.ai/terms/privacy-policy?language=en-US"
        ],
        "nanoInvoked": false,
        "contractVersion": "certscore.policy-text-extraction-health.v2",
        "policyTextQuality": {
          "usable": true,
          "codeSignalCount": 0,
          "codeSymbolRatio": 0.0001745733862872605,
          "policyTermCount": 16,
          "alphabeticWordRatio": 0.8042071197411004,
          "accessChallengeSignalCount": 0,
          "naturalLanguageSentenceCount": 169
        },
        "policyUrlRetained": true,
        "extractedTextLength": 22913,
        "policySurfaceObserved": true,
        "detectedPolicyLanguage": "en",
        "minimumTextLengthRequired": 500,
        "policyTextExtractionStatus": "ok",
        "verifiedPolicyDocumentCount": 1,
        "detectedPolicyLanguageSource": "policy_surface",
        "supportedGdprTransparencyLocales": [
          "en",
          "de",
          "fr",
          "es",
          "it",
          "nl",
          "pl",
          "pt",
          "ru",
          "ja",
          "zh",
          "ar",
          "sv",
          "ro",
          "cs",
          "el",
          "hu",
          "da",
          "fi",
          "sk",
          "bg",
          "hr",
          "nb",
          "sl",
          "lt",
          "lv",
          "et",
          "uk",
          "tr",
          "fa",
          "vi",
          "id",
          "ko",
          "th",
          "he",
          "sr",
          "ca",
          "hi",
          "az",
          "gl"
        ],
        "gdprTransparencyLanguageSupported": true,
        "policyTextEvidenceProjectionStatus": "verified_complete",
        "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
      },
      "privacyPolicyEvidencePaths": [],
      "discoveredPrivacyPolicyUrls": [
        "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
        "https://legal.mistral.ai/terms/privacy-policy",
        "https://legal.mistral.ai/terms/applicant-privacy-policy"
      ],
      "article13CoverageAssessments": [
        {
          "topic": "automated_decision_making_or_profiling",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete",
            "material_linked_policy_supplements_not_fully_evaluated"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "controller_contact",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "data_retention",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "data_subject_rights",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "dpo_contact",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "international_transfers",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "legal_basis",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "processing_purposes",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "recipients_or_vendor_categories",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "supervisory_authority",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        }
      ],
      "dedicatedCookiePolicyPresent": false,
      "policyTextEvidenceProjection": {
        "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
        "documents": [
          {
            "finalUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
            "artifactId": "policy_surface_text_ed86901_4ac9bde8",
            "artifactUri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/auxiliary/policy_surface_text_ed86901_4ac9bde8.txt",
            "contentType": "text/html; charset=UTF-8",
            "documentRole": "policy_document",
            "requestedUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
            "observationId": "policy_surface_ed86901",
            "redirectChain": [
              "https://legal.mistral.ai/terms/privacy-policy?language=en-US"
            ],
            "artifactSha256": "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba",
            "documentFormat": "text",
            "limitationKeys": [
              "policy_section_inventory_bounded",
              "policy_section_text_bounded"
            ],
            "contentCoverage": {
              "status": "truncated",
              "limitationKeys": [
                "policy_section_inventory_bounded",
                "policy_section_text_bounded"
              ],
              "sourceTextChars": 22913,
              "retainedSectionCount": 20,
              "extractedSectionCount": 58,
              "retainedTableRowCount": 0
            },
            "artifactFileName": "policy_surface_text_ed86901_4ac9bde8.txt",
            "extractionStatus": "complete",
            "artifactSizeBytes": 22985,
            "retainedTextChars": 22913,
            "documentFetchState": "fetched",
            "retainedTextSha256": "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba",
            "targetRelationship": "target_controller",
            "documentOwnerEntity": "legal.mistral.ai",
            "ownershipConfidence": 0.98,
            "documentTextCoverage": {
              "status": "complete",
              "limitationKeys": [],
              "sourceTextChars": 22913,
              "retainedTextChars": 22913
            },
            "documentEvaluationState": "usable",
            "documentRoleReasonCodes": [
              "multiple_substantive_disclosure_signals_retained"
            ],
            "governingPolicySelection": {
              "rank": 1,
              "score": 85,
              "state": "primary",
              "reasonCodes": [
                "highest_ranked_eligible_governing_policy",
                "target_controller_document",
                "policy_content_coverage_truncated",
                "complete_policy_text_retention",
                "multiple_substantive_disclosure_signals_retained"
              ],
              "contractVersion": "governing_policy_selection.v1"
            },
            "artifactVerificationStatus": "verified",
            "gdprTransparencyTopicCoverageDiagnostics": [
              {
                "topic": "controller_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba",
                "evidenceSectionSha256": "a015122a5061540ffe4528f347cf2ca76afcad8549f7d7f2cea1eff245b6f6c0",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "canonical_topic_window"
              },
              {
                "topic": "processing_purposes",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "e1ec4d85c06fc71a46bce146f2928cd847121109f78be89ad387eec039040694",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_table_row"
              },
              {
                "topic": "legal_basis",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "d8503d6144bc7b55f223ae9243f3bf98ee6f8882506ce0685f8a190a4db57ff8",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_table_row"
              },
              {
                "topic": "recipients_or_vendor_categories",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "4c9bb3c909d004c603301dfbdd18b0d01d537651896c3c379888fb2262f92925",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "data_retention",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "bd68bb75bcf338fc94308c119e3dfdbccb703029c8a8718392dd2d2615d262cd",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "data_subject_rights",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "f8876766a468a2695c801631d5569104d076dd3940600821d1543755511c88c9",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_labeled_block"
              },
              {
                "topic": "international_transfers",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "a12fb75d8ac27412736052fa07ead13800e8ee99803dc55d2e1dcbb5e03b3307",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "dpo_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "93eca63b6a255339ecf5030c5cbc78b1e7e203b5735fd056b926a05b8311d011",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "supervisory_authority",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "36bbad3511eab0f03e5c123ca5645f7b0c1e1c191def8b92919c48b352290fe1",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_labeled_block"
              },
              {
                "topic": "automated_decision_making_or_profiling",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              }
            ]
          }
        ],
        "generatedAt": "2026-10-12T19:34:38.063Z",
        "sourceBundle": {
          "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/CanonicalEvidenceBundle.json",
          "sha256": "935d00b34755f0f175d8cdf7fdea470e078f55d8f2713273f2177642a0f58592",
          "sizeBytes": 899430,
          "schemaVersion": "certscore.v2.alpha.1",
          "verificationStatus": "verified"
        },
        "limitationKeys": [
          "policy_section_inventory_bounded",
          "policy_section_text_bounded"
        ],
        "contractVersion": "certscore.policy-text-evidence-projection.v1",
        "projectionStatus": "verified_complete"
      },
      "privacyPolicyEvaluationState": "fetched_usable",
      "legalFrameworkValidityMatches": [],
      "missingExpectedPolicySections": [
        "Your privacy controls",
        "Exporting and deleting your information",
        "Retaining your information",
        "Compliance and cooperation with regulators",
        "European requirements",
        "Data transfers"
      ],
      "policy_text_extraction_health": {
        "policyUrls": [
          "https://legal.mistral.ai/terms/privacy-policy?language=en-US"
        ],
        "nanoInvoked": false,
        "contractVersion": "certscore.policy-text-extraction-health.v2",
        "policyTextQuality": {
          "usable": true,
          "codeSignalCount": 0,
          "codeSymbolRatio": 0.0001745733862872605,
          "policyTermCount": 16,
          "alphabeticWordRatio": 0.8042071197411004,
          "accessChallengeSignalCount": 0,
          "naturalLanguageSentenceCount": 169
        },
        "policyUrlRetained": true,
        "extractedTextLength": 22913,
        "policySurfaceObserved": true,
        "detectedPolicyLanguage": "en",
        "minimumTextLengthRequired": 500,
        "policyTextExtractionStatus": "ok",
        "verifiedPolicyDocumentCount": 1,
        "detectedPolicyLanguageSource": "policy_surface",
        "supportedGdprTransparencyLocales": [
          "en",
          "de",
          "fr",
          "es",
          "it",
          "nl",
          "pl",
          "pt",
          "ru",
          "ja",
          "zh",
          "ar",
          "sv",
          "ro",
          "cs",
          "el",
          "hu",
          "da",
          "fi",
          "sk",
          "bg",
          "hr",
          "nb",
          "sl",
          "lt",
          "lv",
          "et",
          "uk",
          "tr",
          "fa",
          "vi",
          "id",
          "ko",
          "th",
          "he",
          "sr",
          "ca",
          "hi",
          "az",
          "gl"
        ],
        "gdprTransparencyLanguageSupported": true,
        "policyTextEvidenceProjectionStatus": "verified_complete",
        "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
      },
      "retainedPolicySectionHeadings": [
        "Why we use your personal data | Categories of personal data | Lawful basis — To provide and maintain the Mistral AI Products provided to you under the condition",
        "Why we use your personal data | Categories of personal data | Lawful basis — To enhance your experience on Vibe via the Memory feature (now becoming Knowledge B",
        "Why we use your personal data | Categories of personal data | Lawful basis — Debugging",
        "Why we use your personal data | Categories of personal data | Lawful basis — To create and administer your Mistral AI Account",
        "Why we use your personal data | Categories of personal data | Lawful basis — To provide customer support, including debugging and fixing errors reported by you",
        "Why we use your personal data | Categories of personal data | Lawful basis — To manage the security and integrity of the Mistral AI Products",
        "Why we use your personal data | Categories of personal data | Lawful basis — To communicate with you, including to send you newsletters or non-marketing communi",
        "Why we use your personal data | Categories of personal data | Lawful basis — To improve the Mistral AI Products or develop new products (but excluding model tra",
        "Why we use your personal data | Categories of personal data | Lawful basis — To train our artificial intelligence models (large language models) to answer quest",
        "Why we use your personal data | Categories of personal data | Lawful basis — To manage and enforce our Terms of Service and licenses, including moderation and a",
        "Access.",
        "Objection.",
        "Lodge a complaint.",
        "1. Who collects your data?",
        "How to contact our Data Protection Officer (DPO):",
        "5. How long do we keep your personal data?",
        "6. Who do we share your personal data with?",
        "7. Do we transfer Your Personal Data Outside of the European Union?",
        "8. Your rights",
        "data controller"
      ],
      "selectedPrivacyPolicyDocument": {
        "documentUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
        "observationId": "policy_surface_ed86901",
        "traversalDepth": 0,
        "parentSurfaceUrl": null,
        "parentObservationId": null,
        "selectionReasonCodes": []
      },
      "article13_coverage_assessments": [
        {
          "topic": "automated_decision_making_or_profiling",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete",
            "material_linked_policy_supplements_not_fully_evaluated"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "controller_contact",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "data_retention",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "data_subject_rights",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "dpo_contact",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "international_transfers",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "legal_basis",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "processing_purposes",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "recipients_or_vendor_categories",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        },
        {
          "topic": "supervisory_authority",
          "status": "observed",
          "sourceUrls": [
            "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_ed86901"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": [
            "https://legal.mistral.ai/terms/privacy-policy",
            "https://legal.mistral.ai/terms/applicant-privacy-policy"
          ]
        }
      ],
      "discoveredPrivacyPolicyDetails": [
        {
          "url": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "status": "fetched",
          "documentFetchState": "fetched",
          "fetchFailureReason": null,
          "linkObservationState": "observed",
          "documentEvaluationState": "usable"
        },
        {
          "url": "https://legal.mistral.ai/terms/privacy-policy",
          "status": "observed",
          "documentFetchState": "not_attempted",
          "fetchFailureReason": null,
          "linkObservationState": "observed",
          "documentEvaluationState": "not_attempted"
        },
        {
          "url": "https://legal.mistral.ai/terms/applicant-privacy-policy",
          "status": "observed",
          "documentFetchState": "not_attempted",
          "fetchFailureReason": null,
          "linkObservationState": "observed",
          "documentEvaluationState": "not_attempted"
        }
      ],
      "article13DisclosureTypesPartial": [],
      "discoveredPrivacyPolicyStatuses": [
        "fetched",
        "observed"
      ],
      "gdprTransparencyEvidenceProfile": "gdpr_transparency_multilingual_article13_v1",
      "policy_text_evidence_projection": {
        "scanId": "4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53",
        "documents": [
          {
            "finalUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
            "artifactId": "policy_surface_text_ed86901_4ac9bde8",
            "artifactUri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/auxiliary/policy_surface_text_ed86901_4ac9bde8.txt",
            "contentType": "text/html; charset=UTF-8",
            "documentRole": "policy_document",
            "requestedUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
            "observationId": "policy_surface_ed86901",
            "redirectChain": [
              "https://legal.mistral.ai/terms/privacy-policy?language=en-US"
            ],
            "artifactSha256": "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba",
            "documentFormat": "text",
            "limitationKeys": [
              "policy_section_inventory_bounded",
              "policy_section_text_bounded"
            ],
            "contentCoverage": {
              "status": "truncated",
              "limitationKeys": [
                "policy_section_inventory_bounded",
                "policy_section_text_bounded"
              ],
              "sourceTextChars": 22913,
              "retainedSectionCount": 20,
              "extractedSectionCount": 58,
              "retainedTableRowCount": 0
            },
            "artifactFileName": "policy_surface_text_ed86901_4ac9bde8.txt",
            "extractionStatus": "complete",
            "artifactSizeBytes": 22985,
            "retainedTextChars": 22913,
            "documentFetchState": "fetched",
            "retainedTextSha256": "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba",
            "targetRelationship": "target_controller",
            "documentOwnerEntity": "legal.mistral.ai",
            "ownershipConfidence": 0.98,
            "documentTextCoverage": {
              "status": "complete",
              "limitationKeys": [],
              "sourceTextChars": 22913,
              "retainedTextChars": 22913
            },
            "documentEvaluationState": "usable",
            "documentRoleReasonCodes": [
              "multiple_substantive_disclosure_signals_retained"
            ],
            "governingPolicySelection": {
              "rank": 1,
              "score": 85,
              "state": "primary",
              "reasonCodes": [
                "highest_ranked_eligible_governing_policy",
                "target_controller_document",
                "policy_content_coverage_truncated",
                "complete_policy_text_retention",
                "multiple_substantive_disclosure_signals_retained"
              ],
              "contractVersion": "governing_policy_selection.v1"
            },
            "artifactVerificationStatus": "verified",
            "gdprTransparencyTopicCoverageDiagnostics": [
              {
                "topic": "controller_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba",
                "evidenceSectionSha256": "a015122a5061540ffe4528f347cf2ca76afcad8549f7d7f2cea1eff245b6f6c0",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "canonical_topic_window"
              },
              {
                "topic": "processing_purposes",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "e1ec4d85c06fc71a46bce146f2928cd847121109f78be89ad387eec039040694",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_table_row"
              },
              {
                "topic": "legal_basis",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "d8503d6144bc7b55f223ae9243f3bf98ee6f8882506ce0685f8a190a4db57ff8",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_table_row"
              },
              {
                "topic": "recipients_or_vendor_categories",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "4c9bb3c909d004c603301dfbdd18b0d01d537651896c3c379888fb2262f92925",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "data_retention",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "bd68bb75bcf338fc94308c119e3dfdbccb703029c8a8718392dd2d2615d262cd",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "data_subject_rights",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "f8876766a468a2695c801631d5569104d076dd3940600821d1543755511c88c9",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_labeled_block"
              },
              {
                "topic": "international_transfers",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "a12fb75d8ac27412736052fa07ead13800e8ee99803dc55d2e1dcbb5e03b3307",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "dpo_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "93eca63b6a255339ecf5030c5cbc78b1e7e203b5735fd056b926a05b8311d011",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "supervisory_authority",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "4b34ccc5af0b040b10f3c8f45f9b110254e4df81febb1053585c71a890edfae1",
                "evidenceSectionSha256": "36bbad3511eab0f03e5c123ca5645f7b0c1e1c191def8b92919c48b352290fe1",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_labeled_block"
              },
              {
                "topic": "automated_decision_making_or_profiling",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              }
            ]
          }
        ],
        "generatedAt": "2026-10-12T19:34:38.063Z",
        "sourceBundle": {
          "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/CanonicalEvidenceBundle.json",
          "sha256": "935d00b34755f0f175d8cdf7fdea470e078f55d8f2713273f2177642a0f58592",
          "sizeBytes": 899430,
          "schemaVersion": "certscore.v2.alpha.1",
          "verificationStatus": "verified"
        },
        "limitationKeys": [
          "policy_section_inventory_bounded",
          "policy_section_text_bounded"
        ],
        "contractVersion": "certscore.policy-text-evidence-projection.v1",
        "projectionStatus": "verified_complete"
      },
      "privacyPolicyTextCharacterCount": 22913,
      "retainedCookiePolicyTextExcerpt": "",
      "validatedDisclosureTypesPartial": [],
      "article13DisclosureTypesObserved": [
        "data_retention",
        "data_subject_rights",
        "international_transfers",
        "supervisory_authority",
        "dpo_contact",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories"
      ],
      "retainedArticle13SectionEvidence": [
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "data_retention",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "extractionLimitation": "selected_policy_section_truncated_by_retention_limit",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below.",
          "selectedPolicySectionHeading": "5. How long do we keep your personal data?"
        },
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "data_subject_rights",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center.",
          "selectedPolicySectionHeading": "Access."
        },
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "international_transfers",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR.",
          "selectedPolicySectionHeading": "7. Do we transfer Your Personal Data Outside of the European Union?"
        },
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "supervisory_authority",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL).",
          "selectedPolicySectionHeading": "Lodge a complaint."
        },
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "dpo_contact",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France.",
          "selectedPolicySectionHeading": "How to contact our Data Protection Officer (DPO):"
        },
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "controller_contact",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are.",
          "selectedPolicySectionHeading": "data controller"
        },
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "processing_purposes",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "Why we use your personal data: To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms.",
          "selectedPolicySectionHeading": "Why we use your personal data | Categories of personal data | Lawful basis — To provide and maintain the Mistral AI Products provided to you under the condition"
        },
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "legal_basis",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "Lawful basis: Our legitimate interest to provide you with an enhanced and personalized service.",
          "selectedPolicySectionHeading": "Why we use your personal data | Categories of personal data | Lawful basis — To enhance your experience on Vibe via the Memory feature (now becoming Knowledge B"
        },
        {
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "coverageArea": "recipients_or_vendor_categories",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
          "selectedPolicySectionExcerpt": "Additionally, we may share all or part of your personal data with our service providers.",
          "selectedPolicySectionHeading": "6. Who do we share your personal data with?"
        }
      ],
      "retainedPrivacyPolicyTextExcerpt": "Terms AI Models AI Systems Contents On this page Welcome to Mistral AI! We know that your privacy is important, and we're committed to protecting it. This Privacy Policy explains, in a clear and simple way, how we collect, use, and protect your personal data when you use our generative AI Mistral AI Products such as Vibe or Mistral AI Studio (the \" Mistral AI Products \"). Scope of this Privacy Policy. This Privacy Policy does not apply if you use our Mistral AI Products to process personal data in the context of your business activities. In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are. Mistral AI is a French company incorporated in Paris, under number 952 418 325, having its registered offices at 15 rue des Halles, 75001 Paris (“ We ”, “ Us ” or “ Mistral AI ”). How to contact us: By sending us a letter at Mistral AI: Mistral AI, 15 rue des Halles, 75001 Paris, France. For any other concerns, please consult our Help Center and the relevant contact forms. How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France. 2. What data do we collect? 2.1. Data you provide directly to us Category of personal data When do we collect your personal data ? Civil Identity, such as your first and last name. Account data, such as the means to retrieve your password and to verify your account. Contact Data, such as your email address. Contract Data, such as the Mistral AI Product your subscribe to. When you create your Mistral AI Account and subscribe to a Mistral AI Product. Contact Data, such as your email address. When you subscribe to receive our communications. Payment and billing information, such as your invoices or your billing address. When you subscribe to a paid Mistral AI Product “ Input ”, any data provided by you or accessed by Mistral AI through integrations or services you have connected to generate an Output, such as prompts, content or fine-tuning data. “Feedback”, any information you provide when you rate an Output, such as “thumbs up” or “thumbs down\", and the associated Input and Output. When you use the Mistral AI Products 2.2. Personal data generated when you use the Mistral AI Products Category of personal data When do we collect your personal data ? “ Technical Data ”, any log or technical data that your browser and device automatically send when you use the Mistral AI Products, such as your IP address or the type of network protocol you use. Cookies listed here. \" Usage Data \", any data that relates to how you use the Mistral AI Products. “Output”, any content generated by the Mistral AI Products based on your Input. When you use the Mistral AI Products 2.3. Personal data that is indirectly provided to us Data publicly available on the Internet. Our artificial intelligence models are trained on data that is publicly available on the Internet by third parties, which may contain personal data, even if we use good practices to filter out such personal data. Data provided by third-parties: Hugging Face. If you download our artificial intelligence models on Hugging Face, we collect your username and email address to enforce our license and send you communications about our new models. Third-Party Content. When you use certain features that interact with third party Mistral AI Products, such as Web Search or verified news on Vibe, we may display content from third parties on Vibe, such as links, thumbnails, or snippets (the \" Third Party Content \"). This content is displayed to help you understand the Output better. If you include personal data in your Input, personal data might also appear in the Third-Party Content. We do not use this Third-Party Content to train our models. Training Datasets. In some cases, we access datasets provided by third parties for our model training purposes. These datasets may include personal data (even if such third parties and Mistral AI use good practices to filter out such personal data), proprietary data, or public data. 3. Why do we use your personal data? Why we use your personal data Categories of personal data Lawful basis To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms Your Civil Identity Data Your Account Data Your Contract Data Your Technical Data Your Input, Output and Feedback Your Usage Data. Please note that we use part of your IP address to make your experience better, such as, for instance, to provide you with more accurate Outputs depending on where you use our Mistral AI Products. You can opt-out of this processing at any time through your user preferences on your Mistral AI Account. The performance of the contract between you and Mistral AI To enhance your experience on Vibe via the Memory feature (now becoming Knowledge Base) by providing you more relevant and personalized answers based on your past interactions with Vibe. For more information about Knowledge Base, see our Help Center . Your Input. As the Memory feature is becoming Knowledge Base, your previous Memories will be retained in Knowledge Base Our legitimate interest to provide you with an enhanced and personalized service. Your explicit consent for any sensitive data contained in your Memories (Knowledge Base will not seek to store sensitive data included in your Input) You can: Turn off the feature at all times through your settings Access, add, delete or edit your Memories or your Knowledge Base at all time through your settings. For more details about the controls you have on Knowledge Base, please see our Help Center . Debugging Your Input, Output and Feedback The performance of the contract between you and Mistral AI. To create and administer your Mistral AI Account Your Civil Identity Data Your Account Data Your Contract Data The performance of the contract between you and Mistral AI. To provide customer support, including debugging and fixing errors reported by you Your Civil Identity Data Your Contact Data Your Feedback Your Input and Output The performance of the contract between you and Mistral AI. To manage the security and integrity of the Mistral AI Products Your Civil Identity Data Your Account Data Your Technical Data Your Contact Data Your Usage Data To comply with our legal obligations. Our legitimate interests in managing the security and integrity of the Mistral AI Products. To communicate with you, including to send you newsletters or non-marketing communications about the Mistral AI Products Your Civil Identity Data Your Contact Data Your consent, for marketing communications. The performance of the agreement, for all non-marketing communication (e.g. to send you notifications about changes to our terms). To improve the Mistral AI Products or develop new products (but excluding model training), such as to conduct research or to make aggregated or anonymous datasets or statistics Your Civil Identity Data Your Feedback Your Input and Output Aggregated or anonymous datasets or statistics Our legitimate interest in continuously improving the Mistral AI Products and to introduce new features. To train our artificial intelligence models (large language models) to answer questions, generate text, translate, summarize and correct text, classify text, analyze feelings, etc. according to context, Inputs (e-mails, letters, reports, computer code, etc.) and Outputs. Personal data included in the data publicly available on the Internet, despite our efforts to filter out such personal data Your Input and Output, subject to your opt-out. Your Feedback. Our legitimate interest in developing and providing state-of-the-art large language models as part of the Mistral AI Products. To manage and enforce our Terms of Service and licenses, including moderation and abuse monitoring Your Civil Identity Data Your Account Data Your Contact Data Your Input and Output Your Feedback The performance of the contract between you and Mistral AI. To manage our commercial relationship with you, including to process payments and manage billing Your Civil Identity Data Your Account Data Your Contact Data Your Payment and Billing information The performance of the agreement between you and Mistral AI. Our legal obligations. To investigate and resolve disputes between you and Mistral AI If applicable and depending on the dispute: Your Civil Identity Your Account Data Your Contact Data Your Contract Data Your Technical Data Your Usage Data Your Input, Output and Feedback Any other data necessary for the investigation or resolution of the dispute. Our legitimate interest in protecting and exercising our legal rights. The performance of the Agreement between you and Mistral AI. To reply to your requests to exercise your rights on your personal data Your Civil Identity Data Your Account Data Your Contact Data Any other personal data included in your privacy request Our legal obligation to reply to your requests. 4. Cookies When you visit our website, we use cookies (small text files stored on your device) to enhance your experience on the Mistral AI Products. For more information about the way we use cookies, please see our Cookie Policy . 5. How long do we keep your personal data? We store your personal data only as long as needed for the purposes described in Section 3 of this Privacy Policy. You will find the main applicable retention periods below, for illustrative purposes: Data we use to provide Vibe to you: we keep your Input and Output until you delete your account or until you delete the conversation from Vibe. Data we use to provide our APIs to you: Except for specific APIs, we keep your Input and Output for the period necessary to generate the Output and then for thirty (30) rolling days to monitor abuse (unless zero data retention is activated). If you use our Agents API, we keep your Input and Output until you terminate your account. If you use our Fine-Tuning API, we keep your fine-tuning data until you delete it from Mistral AI Studio or until you terminate your account. Non-essential cookies data: only as long as you consent to their use. Your contact data (used for marketing operations): only as long as you are subscribed to our newsletter. Leads identity and contact data: for 3 years from collection. Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below. Please note that the categories of personal data we retain longer will not be accessed or used by any member of our teams during their legal keeping periods, except to fulfill our legal obligations or in case of dispute or litigation (e.g. to recover an unpaid invoice). Once the legal retention periods have expired, we will permanently delete these categories of data. Your Civil Identity Data (your first and last name, etc.): for 5 years after the termination of your Mistral AI account. Account Data (such as the phone number or email address you provided to verify or change your account password, etc.): for 1 year after you delete your account. Technical data (such as the types of protocols used to connect to our service, etc.): for 1 rolling year from the date of connection, for each operation contributing to the operation of connection. Invoices and related correspondence: for 10 years from the close of the relevant financial yea Contracts, commercial licenses to use our Models and contact details relating to both: we keep your data for the duration of the contract and for 5 years following the termination of the contract. Data relating to dispute resolution: until the appeal period ends, provided that we may keep such data longer for archival purpose. Data relating to your privacy requests: for the duration of processing the request and for 6 years following the request. Technical support data: We keep your data until your request is processed and for 5 years for record-keeping. 6. Who do we share your personal data with? We may share your personal data on a need-to-know basis with the following parties: Our Team Members. Authorized members of our teams who need to access your personal data, strictly to perform their jobs Financial Institutions. Banks and other financial organizations Regulatory Authorities. Such as the French data protection authority (CNIL) Legal and Professional services. When appropriate, we may share data with competent courts, mediators, accountants, auditors, lawyers, bailiffs, and debt collection agencies. Additionally, we may share all or part of your personal data with our service providers. Before engaging with any provider which handles customer data, our security team conducts audits to ensure they meet our privacy and security standards, in accordance with our certifications.We sign a dedicated data protection agreement with each of these providers. Our main providers are listed on our Trust Center . 7. Do we transfer Your Personal Data Outside of the European Union? We prioritize selecting providers within the European Union that strictly adhere to the GDPR. However, in exceptional cases, we may opt for non-EU providers that meet our high standards of data security and Personal Data protection. We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR. Additionally, we attach the most recent version of the European Commission’s Standard Contractual Clauses to all such contracts. 8. Your rights You can exercise the following rights : Access. You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center. Portability. You have the right to obtain and transfer your personal data you provided to another entity. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center. Rectification. You have the right to ask us to update or correct your personal data. Deletion. You have the right to delete and/or ask us to delete your personal data. We’ve introduced a user control which allows you to delete your account at all times. For more information, please refer to our Help Center. Objection. You have the right to object to the processing of your personal data. This right does not apply when we have a legal obligation to process your personal data. We’ve introduced a user control which allows you to object to the use of your input and output data for model training directly from your account. For more information, please refer to our Help Center. Consent withdrawal. You have the right to withdraw your consent to the processing of your personal data at any time. Limitation. You have the right to ask us to freeze the processing of your personal data. Automated decision. You have the right to not be subject to an automated decision (including profiling) and to appeal such a decision. Mistral AI does not engage in profiling or automated decision-making in the processing of personal data. Post mortem. You have the right to tell us how you would like us to process your personal data after your death. Lodge a complaint. You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL). We will take every step to make sure we reply to your requests. However, when your request concerns the training of our models, it’s important to note that your rights have technical limitations and fulfilling your requests might involve a complex technical process. You can exercise these rights at all times: By using the user controls which are available from your Mistral AI Account settings and which allow you to: delete your account at all times, obtain a copy of your data, object to the use of your input and output data for model training. For more information on these user controls, please refer to our Help Center . By using the “Privacy Requests” contact form available here. By sending us a letter at Mistral AI, Attn: Privacy Team, Mistral AI, 15 rue des Halles, 75001 Paris, France. 9. Additional Disclosures for U.S. Users If you reside in California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, or Virginia, this section applies to you. This section serves as our California notice at collection. Consumer Rights . Depending on the U.S. state where you reside and applicable exceptions, you may be entitled to exercise the following rights in relation to your personal data: (a) the right to know information about how we process your personal data and to access a copy of your personal data; (b) the right to request that we delete your personal data; (c) the right to request that we correct your personal data; (d) the right to be free from discrimination for exercising your rights; and (e) the right to appeal Mistral AI’s decision regarding your request. No Sale, Sharing, or Targeted Advertising. Mistral AI has not “sold,” “shared,” or engaged in “targeted advertising” with (as those terms are defined under U.S. state privacy laws) any personal data of consumers in the preceding 12 months, including of any consumer that we know is under 18 years old. Sensitive Personal Data. To the extent you voluntarily provide any sensitive personal data to Mistral AI, we will only process such data as permitted by applicable law and, for clarity, not in a way that gives rise to a right to limit under those laws. Exercising Your Rights. You may exercise any available rights through the process described below. Please note that some types of requests require your successful completion of identity verification steps before we can fulfill the request. Directly with Mistral AI. You may submit a request to exercise your rights by emailing us here or through our online form . We require evidence of your identity to process your request, which may include authenticating your account with us depending on the nature of your request. Through an Authorized Agent. You may exercise your available rights through an authorized agent that you appoint. Your authorized agent will be required to submit evidence of your authorization and your identity. Depending on the nature of your request and the evidence provided, we may also require you to independently verify your identity with us, including authenticating your account for the Mistral AI Products. Appealing a Decision. You may appeal our response to your request by emailing us here with the subject line “US Rights Response Appeal”. Retention. We retain your personal data as described in Section 5 (How long do we keep your personal data?) above. Training Information. We use and have used a mix of proprietary and third-party data to train the artificial intelligence models used in the Mistral AI Products for improved performance, which can include information in a variety of formats (such as text or images) from publicly available datasets and internet sources, non-public third-party databases, your use of our products (to the extent permitted by our applicable terms), internally generated data, curated datasets, and synthetic data. Such collection and training began in 2023, is ongoing, and is used to improve our artificial intelligence models. In some cases, this includes cleaning, processing, or modifying such datasets to optimize their effectiveness prior to use in the training process. Our training datasets may include aggregated consumer information. Additional Information. The following details supplement the above information in Section 2 (What data do we collect?), Section 3 (Why do we use your personal data?), and Section 6 (Who do we share your personal data with?) using terminology of applicable state law: Disclosure Category Details Sources of personal data Provided directly by you. Generated when you use the Mistral AI Products. Data publicly available on the Internet. Data provided by third parties (e.g., third-party content and training datasets). Categories of personal data that Mistral AI collects about consumers Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. Internet or other electronic network activity information, including information regarding your interaction with the Mistral AI Products and our website. Commercial information, such as purchase history and your payment and billing information. Audio, electronic, visual, or similar information. Categories of personal data Mistral AI discloses about consumers for a business purpose Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. Internet or other electronic network activity information, including information regarding your interaction with the Mistral AI Products and our website. Commercial information, such as products you subscribe to and your payment and billing information. Audio, electronic, visual, or similar information. Mistral AI’s business or commercial purposes for collecting personal data Helping to ensure the security and integrity of the Mistral AI Products. Debugging to identify and repair errors that impair existing intended functionality. Short-term, transient use. Performing services related to a consumer’s use of the Mistral AI Products, such as maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing analytic services, providing storage, or similar services. Providing advertising and marketing services. Undertaking internal research for technological development and demonstration. Undertaking activities to verify or maintain the quality or safety of the Mistral AI Products, and to improve, upgrade, or enhance the Mistral AI Products. 10. Changes to this Privacy Policy We may amend this Privacy Policy from time to time as our products continuously evolve. Make sure to check this Privacy Policy frequently. On this page",
      "validatedDisclosureTypesObserved": [
        "data_retention",
        "data_subject_rights",
        "international_transfers",
        "supervisory_authority",
        "dpo_contact",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories"
      ],
      "privacyNoticeAvailabilityObserved": true,
      "evaluatedPrivacyPolicySurfaceCount": 1,
      "discardedArticle13DisclosureSignals": [
        {
          "source": "deterministic",
          "confidence": 0.88,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "evidenceText": "information, such as products you subscribe to and your payment and billing information. Audio, electronic, visual, or similar information. Mistral AI’s business or commercial purposes for collecting personal data Helping to ensure the security and integrity of the Mistral AI Products.",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "processing_purposes"
        },
        {
          "source": "deterministic",
          "confidence": 0.68,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "evidenceText": "we keep your personal data? We store your personal data only as long as needed for the purposes described in Section 3 of this Privacy Policy. You will find the main applicable retention periods below, for illustrative purposes: Data we use to provide Vibe to you: we keep your Input and Output until you delete your",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "data_retention"
        },
        {
          "source": "deterministic",
          "confidence": 0.66,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "evidenceText": "or automated decision-making in the processing of personal data. Post mortem. You have the right to tell us how you would like us to process your personal data after your death. Lodge a complaint.",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "supervisory_authority"
        },
        {
          "source": "deterministic",
          "confidence": 0.76,
          "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
          "evidenceText": "the right to withdraw your consent to the processing of your personal data at any time. Limitation. You have the right to ask us to freeze the processing of your personal data. Automated decision. You have the right to not be subject to an automated decision (including profiling) and to appeal such a decision.",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "automated_decision_making_or_profiling"
        }
      ],
      "staleLegalFrameworkReferenceObserved": false,
      "policyEvidenceProvenanceContractVersion": "certscore.policy-evidence-provenance.v1",
      "gdprTransparencyProductionEvidenceEnabled": true,
      "gdprTransparencyProductionEvidenceDiagnostics": {
        "sourceCandidateCount": 9,
        "candidateDispositions": [
          {
            "topic": "dpo_contact",
            "confidence": 0.9,
            "disposition": "accepted",
            "matchStrength": "direct",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_ed86901"
          },
          {
            "topic": "processing_purposes",
            "confidence": 0.9,
            "disposition": "accepted",
            "matchStrength": "direct",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_ed86901"
          },
          {
            "topic": "controller_contact",
            "confidence": 0.9,
            "disposition": "diagnostic_only",
            "matchStrength": "direct",
            "matchedLocale": "en",
            "rejectionReason": "candidate_topic_invariants_failed",
            "sourceObservationId": "policy_surface_ed86901"
          },
          {
            "topic": "supervisory_authority",
            "confidence": 0.82,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_ed86901"
          },
          {
            "topic": "international_transfers",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_ed86901"
          },
          {
            "topic": "legal_basis",
            "confidence": 0.88,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_ed86901"
          },
          {
            "topic": "data_retention",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_ed86901"
          },
          {
            "topic": "recipients_or_vendor_categories",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_ed86901"
          },
          {
            "topic": "data_subject_rights",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_ed86901"
          }
        ],
        "acceptedCandidateCount": 8,
        "rejectedCandidateCount": 1,
        "discardedCandidateCount": 0,
        "diagnosticCandidateCount": 1,
        "productionCreditSignalCount": 8
      }
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Legal basisIncludes legal grounds for using personal data.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: Not retained.

Open policy source

Lawful basis: Our legitimate interest to provide you with an enhanced and personalized service.

Matched disclosure snippet: Lawful basis: Our legitimate interest to provide you with an enhanced and personalized service.

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "legal_basis_disclosure_observed",
  "coverageArea": "Legal basis disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence included a canonical legal-basis disclosure signal.",
  "note": "Whether retained privacy-policy evidence included a canonical legal-basis disclosure signal.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.legal_basis_disclosure_observed.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.legal_basis_disclosure_observed"
  },
  "statusBasis": "Legal basis disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Legal basis disclosure",
      "Excerpt: Lawful basis: Our legitimate interest to provide you with an enhanced and personalized service.",
      "Locale: en",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.88,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "Lawful basis: Our legitimate interest to provide you with an enhanced and personalized service.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "legal_basis",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_legal_basis",
        "match_strength_equivalent",
        "variant_section_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "legal_basis",
      "originKey": "gdpr_transparency.article13.legal_basis",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.legal_basis",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Data retentionDescribes when personal data is kept or deleted.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: 5. How long do we keep your personal data?.

Open policy source

Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below.

Matched disclosure snippet: Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed be…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "retention_disclosure_observed",
  "coverageArea": "Retention disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence included a data-retention disclosure signal.",
  "note": "Whether retained privacy-policy evidence included a data-retention disclosure signal.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.retention_disclosure_observed.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.retention_disclosure_observed"
  },
  "statusBasis": "Retention disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Retention disclosure",
      "Excerpt: Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below.",
      "Locale: en",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "Sometimes, we may keep your data longer to comply with our legal obligations and/or for legal proceedings, as detailed below.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "data_retention",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_data_retention",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "selectedPolicySectionHeading": "5. How long do we keep your personal data?"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "sectionHeading": "5. How long do we keep your personal data?",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "data_retention",
      "originKey": "gdpr_transparency.article13.data_retention",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.data_retention",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Controller and contact detailsThis disclosure could not be confirmed from the saved policy evidence.Not confirmed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: Not retained.

Open policy source

unprojected controller/contact disclosure candidate

Excerpt: In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are.

Policy URL: https://legal.mistral.ai/terms/privacy-policy/?language=en-US

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "controller_contact_disclosure",
  "coverageArea": "Controller/contact disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence included a controller, privacy contact, or equivalent contact point.",
  "note": "Whether retained privacy-policy evidence included a controller, privacy contact, or equivalent contact point.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.controller_contact_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.controller_contact_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. A retained candidate was rejected by the canonical projection and remains available for audit; this result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the controller identity and contact details; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "evidenceRefs": [
      "Evidence: unprojected controller/contact disclosure candidate",
      "Excerpt: In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are.",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
    ],
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "retainedCandidate": {
      "source": "deterministic",
      "status": "observed",
      "confidence": 0.9,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are.",
      "disclosureType": "controller_contact",
      "evidenceSource": "deterministic",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy/?language=en-US",
      "supportingContactContext": null,
      "selectedPolicySectionExcerpt": "In this case, you are the data controller, and Mistral AI is the data processor processing on your behalf. 1. Who collects your data? Mistral AI. In the context of this Privacy Policy, Mistral AI is the data controller. This means that Mistral AI is the entity that decides how and why your personal data is collected and used. Who we are.",
      "selectedPolicySectionHeading": "data controller"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "retained_candidate_not_production_projectable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://legal.mistral.ai/terms/privacy-policy?language=en-US"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0001745733862872605,
        "policyTermCount": 16,
        "alphabeticWordRatio": 0.8042071197411004,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 169
      },
      "policyUrlRetained": true,
      "extractedTextLength": 22913,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "controller_contact",
      "status": "observed",
      "sourceUrls": [
        "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
      ],
      "reasonCodes": [
        "row_specific_disclosure_observed"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_ed86901"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": [
        "https://legal.mistral.ai/terms/privacy-policy",
        "https://legal.mistral.ai/terms/applicant-privacy-policy"
      ]
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the controller identity and contact details; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Data use purposesDescribes purposes for using personal data.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: Not retained.

Open policy source

Why we use your personal data: To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms.

Matched disclosure snippet: Why we use your personal data: To provide and maintain the Mistral AI Products provided to you under the conditions set f…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "processing_purposes_disclosure",
  "coverageArea": "Processing purposes disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described the purposes for processing personal data.",
  "note": "Whether retained privacy-policy evidence described the purposes for processing personal data.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.processing_purposes_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.processing_purposes_disclosure"
  },
  "statusBasis": "Processing purposes disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Processing purposes disclosure",
      "Excerpt: Why we use your personal data: To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms.",
      "Locale: en",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.9,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "Why we use your personal data: To provide and maintain the Mistral AI Products provided to you under the conditions set forth in our Terms of Service and any applicable Additional Terms.",
      "matchStrength": "direct",
      "matchedLocale": "en",
      "disclosureType": "processing_purposes",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_processing_purposes",
        "match_strength_direct"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "processing_purposes",
      "originKey": "gdpr_transparency.article13.processing_purposes",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.processing_purposes",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Recipients and vendor categoriesIdentifies recipients or types of organizations that may receive personal data.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: 6. Who do we share your personal data with?.

Open policy source

Additionally, we may share all or part of your personal data with our service providers.

Matched disclosure snippet: Additionally, we may share all or part of your personal data with our service providers.

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "recipients_vendor_categories_disclosure",
  "coverageArea": "Recipients/vendor categories disclosed",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described recipient, vendor, or 3rd party categories.",
  "note": "Whether retained privacy-policy evidence described recipient, vendor, or 3rd party categories.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.recipients_vendor_categories_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.recipients_vendor_categories_disclosure"
  },
  "statusBasis": "Recipients/vendor categories disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Recipients/vendor categories disclosure",
      "Excerpt: Additionally, we may share all or part of your personal data with our service providers.",
      "Locale: en",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "Additionally, we may share all or part of your personal data with our service providers.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "recipients_or_vendor_categories",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_recipients_or_vendor_categories",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "selectedPolicySectionHeading": "6. Who do we share your personal data with?"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "sectionHeading": "6. Who do we share your personal data with?",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "recipients_or_vendor_categories",
      "originKey": "gdpr_transparency.article13.recipients_or_vendor_categories",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.recipients_or_vendor_categories",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Privacy rightsDescribes rights people have over their personal data.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: 8. Your rights.

Open policy source

You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center.

Matched disclosure snippet: You have the right to know if we process your personal data. You also have the right to request a copy of such personal d…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "data_subject_rights_disclosure",
  "coverageArea": "Data subject rights disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described data subject rights or a rights request path.",
  "note": "Whether retained privacy-policy evidence described data subject rights or a rights request path.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.data_subject_rights_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.data_subject_rights_disclosure"
  },
  "statusBasis": "Data subject rights disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Data subject rights disclosure",
      "Excerpt: You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center.",
      "Locale: en",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "You have the right to know if we process your personal data. You also have the right to request a copy of such personal data and to obtain further information about the way we process your personal data. We've introduced a user control which allows you to export your data at all times from your Mistral AI account. For more information, please refer to our Help Center.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "data_subject_rights",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_data_subject_rights",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "selectedPolicySectionHeading": "8. Your rights"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "sectionHeading": "8. Your rights",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "data_subject_rights",
      "originKey": "gdpr_transparency.article13.data_subject_rights",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.data_subject_rights",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

International data transfersAddresses transfers of personal data to other countries.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: 7. Do we transfer Your Personal Data Outside of the European Union?.

Open policy source

We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR.

Matched disclosure snippet: We take the necessary steps to ensure that all contracts with service providers who process personal data outside the Eur…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "international_transfers_disclosure",
  "coverageArea": "International transfer disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described international transfers or transfer-relevant endpoint/vendor context.",
  "note": "Whether retained privacy-policy evidence described international transfers or transfer-relevant endpoint/vendor context.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.international_transfers_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.international_transfers_disclosure"
  },
  "statusBasis": "International transfer disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: International transfer disclosure",
      "Excerpt: We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR.",
      "Locale: en",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "We take the necessary steps to ensure that all contracts with service providers who process personal data outside the European Union have adequate safeguards in compliance with Article 46 of the GDPR.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "international_transfers",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_international_transfers",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "selectedPolicySectionHeading": "7. Do we transfer Your Personal Data Outside of the European Union?"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "sectionHeading": "7. Do we transfer Your Personal Data Outside of the European Union?",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "international_transfers",
      "originKey": "gdpr_transparency.article13.international_transfers",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.international_transfers",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

DPO contact (if applicable)Provides contact details for a data protection officer.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: Not retained.

Open policy source

How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France.

Matched disclosure snippet: How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "dpo_contact_point_disclosure",
  "coverageArea": "DPO contact point (where applicable)",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence identified a designated data protection officer or equivalent statutory DPO contact. A generic privacy mailbox is credited under controller/contact disclosure and does not by itself establish a DPO designation.",
  "note": "Whether retained privacy-policy evidence identified a designated data protection officer or equivalent statutory DPO contact. A generic privacy mailbox is credited under controller/contact disclosure and does not by itself establish a DPO designation.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.dpo_contact_point_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.dpo_contact_point_disclosure"
  },
  "statusBasis": "DPO contact point (where applicable) evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: DPO contact point (where applicable)",
      "Excerpt: How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France.",
      "Locale: en",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.9,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "How to contact our Data Protection Officer (DPO): By using the “Privacy Requests” contact form available here By sending us a letter at Mistral AI, Attn: DPO, Mistral AI, 15 rue des Halles, 75001 Paris, France.",
      "matchStrength": "direct",
      "matchedLocale": "en",
      "disclosureType": "dpo_contact",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_dpo_contact",
        "match_strength_direct"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "dpo_contact",
      "originKey": "gdpr_transparency.article13.dpo_contact",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.dpo_contact",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Complaints to a regulatorExplains the right to complain to a data protection authority.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: Not retained.

Open policy source

You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL).

Matched disclosure snippet: You have the right to lodge a complaint before the competent data protection authority, including the French data protect…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "supervisory_authority_complaint_disclosure",
  "coverageArea": "Supervisory authority complaint",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence referenced a right to complain to a supervisory authority.",
  "note": "Whether retained privacy-policy evidence referenced a right to complain to a supervisory authority.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.supervisory_authority_complaint_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.supervisory_authority_complaint_disclosure"
  },
  "statusBasis": "Supervisory authority complaint disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Supervisory authority complaint disclosure",
      "Excerpt: You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL).",
      "Locale: en",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.82,
      "surfaceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "evidenceText": "You have the right to lodge a complaint before the competent data protection authority, including the French data protection authority (the CNIL).",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "supervisory_authority",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_supervisory_authority",
        "match_strength_equivalent",
        "variant_requires_privacy_context"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "supervisory_authority",
      "originKey": "gdpr_transparency.article13.supervisory_authority",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.supervisory_authority",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Profiling and automated decisionsThis disclosure could not be confirmed from the saved policy evidence.Not confirmed

JSON evidence

Policy source

Captured page title: Privacy Policy — https://legal.mistral.ai/terms/privacy-policy?language=en-US

Document heading: 1. Who collects your data?

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:34:31.579Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "automated_decision_making_profiling_disclosure",
  "coverageArea": "Profiling / automated decisions disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether adapter-approved Article 13 evidence retained automated decision-making or profiling disclosure context for review.",
  "note": "Whether adapter-approved Article 13 evidence retained automated decision-making or profiling disclosure context for review.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.automated_decision_making_profiling_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.automated_decision_making_profiling_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the applicable automated decision-making or profiling disclosures; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://legal.mistral.ai/terms/privacy-policy?language=en-US",
      "policyTitle": "Privacy Policy",
      "artifactRefs": [
        "policy_excerpt_ed86901_a11a1bab",
        "policy_surface_text_ed86901_4ac9bde8"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "1. Who collects your data?",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:34:31.579Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "legal.mistral.ai",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://legal.mistral.ai/terms/privacy-policy?language=en-US"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0001745733862872605,
        "policyTermCount": 16,
        "alphabeticWordRatio": 0.8042071197411004,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 169
      },
      "policyUrlRetained": true,
      "extractedTextLength": 22913,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "automated_decision_making_or_profiling",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://legal.mistral.ai/terms/privacy-policy/?language=en-US"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete",
        "material_linked_policy_supplements_not_fully_evaluated"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_ed86901"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "5dd82c66ab86b30cf09dd9d8de487c91f63f0bb749e558c1196c1c632c13d7ba"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": [
        "https://legal.mistral.ai/terms/privacy-policy",
        "https://legal.mistral.ai/terms/applicant-privacy-policy"
      ]
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the applicable automated decision-making or profiling disclosures; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Cookie disclosureA cookie policy or disclosure notice was found.Observed

JSON evidence

cookie policy or cookie disclosure surface retained

Not confirmed: granular named-cookie inventory

Not confirmed: cookie preference interface

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "cookie_notice_policy_availability",
  "coverageArea": "Cookie notice / cookie policy availability",
  "evidenceState": "observed",
  "explanation": "Whether a cookie notice, cookie policy, cookie settings surface, or equivalent cookie disclosure surface was retained.",
  "note": "Whether a cookie notice, cookie policy, cookie settings surface, or equivalent cookie disclosure surface was retained.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.cookie_notice_policy_availability.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.cookie_notice_policy_availability"
  },
  "statusBasis": "A durable cookie disclosure surface was retained in the tested context; a granular named-cookie inventory or preference interface was not confirmed.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: cookie policy or cookie disclosure surface retained",
      "Not confirmed: granular named-cookie inventory",
      "Not confirmed: cookie preference interface",
      "Policy URL: https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "cookiePolicyUrls": [
      "https://legal.mistral.ai/terms/privacy-policy?language=en-US"
    ],
    "cookiePolicyPresent": true,
    "cookieNoticeObserved": true,
    "observedPolicyTopics": [
      "cookies",
      "analytics",
      "advertising",
      "targeted_advertising",
      "sale_or_share",
      "notice_at_collection"
    ],
    "missingEvidenceNeeded": [],
    "observedPolicyControls": [
      "consent_withdrawal"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "preferenceInterfaceConfirmed": false,
    "granularCookieInventoryConfirmed": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Accessibility (WCAG)

2 issues · 1 to review

Review

WCAG 2.2 A/AA automated checks on the starting page.

axe-core 4.11.3 · 62 rules evaluated

Coverage is limited: 1 check needs manual review.

Button names3 elements affectedIssues found

Controls need an accessible name describing their action.

Impact: Critical

WCAG criteria: 4.1.2

WCAG guidance & remediation ↗

Examples (3 of 3)

.outline

Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role="none" or role="presentation"

<button class data-theme>

Show more examples (2)

button[data-theme]

<button class data-theme>

button[data-theme]

<button class data-theme>

JSON evidence

{
  "accessibilityRule": {
    "ruleId": "button-name",
    "impact": "critical",
    "tags": [
      "cat.name-role-value",
      "wcag2a",
      "wcag412",
      "section508",
      "section508.22.a",
      "TTv5",
      "TT6.a",
      "EN-301-549",
      "EN-9.4.1.2",
      "ACT",
      "RGAAv4",
      "RGAA-11.9.1"
    ],
    "help": "Buttons must have discernible text",
    "description": "Ensure buttons have discernible text",
    "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/button-name?application=axeAPI",
    "nodeCount": 3,
    "representativeNodes": [
      {
        "selectors": [
          ".outline"
        ],
        "htmlSnippet": "<button class data-theme>",
        "failureSummary": "Fix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role=\"none\" or role=\"presentation\""
      },
      {
        "selectors": [
          "button[data-theme]"
        ],
        "htmlSnippet": "<button class data-theme>",
        "failureSummary": "Fix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role=\"none\" or role=\"presentation\""
      },
      {
        "selectors": [
          "button[data-theme]"
        ],
        "htmlSnippet": "<button class data-theme>",
        "failureSummary": "Fix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role=\"none\" or role=\"presentation\""
      }
    ]
  }
}

Correction steps

01Add meaningful button text or an accessible label to each flagged control. Check that the announced name describes its action.

Nested interactive controls1 element affectedIssues found

Interactive controls should have separate, predictable focus targets.

Impact: Serious

WCAG criteria: 4.1.2

WCAG guidance & remediation ↗

Examples (1 of 1)

.group\/product-dropdown

Element has focusable descendants

<button class>

JSON evidence

{
  "accessibilityRule": {
    "ruleId": "nested-interactive",
    "impact": "serious",
    "tags": [
      "cat.keyboard",
      "wcag2a",
      "wcag412",
      "TTv5",
      "TT6.a",
      "EN-301-549",
      "EN-9.4.1.2",
      "RGAAv4",
      "RGAA-7.1.1"
    ],
    "help": "Interactive controls must not be nested",
    "description": "Ensure interactive controls are not nested as they are not always announced by screen readers or can cause focus problems for assistive technologies",
    "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/nested-interactive?application=axeAPI",
    "nodeCount": 1,
    "representativeNodes": [
      {
        "selectors": [
          ".group\\/product-dropdown"
        ],
        "htmlSnippet": "<button class>",
        "failureSummary": "Fix any of the following: Element has focusable descendants"
      }
    ]
  }
}

Correction steps

01Move the nested button or link outside its interactive parent. Retest each control's keyboard focus and activation.

Checks needing manual review

Low text contrast4 elements to reviewReview

Text must have sufficient contrast against its background.

Impact: Serious

WCAG criteria: 1.4.3

WCAG guidance & remediation ↗

Examples (4 of 4)

.md\:w-2xl

Element's background color could not be determined because it is overlapped by another element

Contrast ratio: 0; required: 3.

<p class></p>

Show more examples (3)

.lg\:gap-10.gap-6.flex-col > .text-h2

Element's background color could not be determined because it's partially obscured by another element

Contrast ratio: 0; required: 3.

<h2 class><br></h2>

.js-media.data-\[active\=\"false\"\]\:opacity-0[data-active] > .lg\:grid.grid-cols-7.grid-rows-2 > .col-span-4.row-span-2 > .size-full.border.justify-center > .text-white.items-start.z-2 > .lg\:p-6.p-4:nth-child(1) > .text-h4.text-current.font-mistral

Element's background color could not be determined due to a background image

Contrast ratio: 0; required: 3.

<p class></p>

Element's background color could not be determined due to a background image

Contrast ratio: 0; required: 4.5.

<p class></p>

JSON evidence

{
  "accessibilityRule": {
    "ruleId": "color-contrast",
    "impact": "serious",
    "tags": [
      "cat.color",
      "wcag2aa",
      "wcag143",
      "TTv5",
      "TT13.c",
      "EN-301-549",
      "EN-9.1.4.3",
      "ACT",
      "RGAAv4",
      "RGAA-3.2.1"
    ],
    "help": "Elements must meet minimum color contrast ratio thresholds",
    "description": "Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds",
    "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/color-contrast?application=axeAPI",
    "nodeCount": 4,
    "representativeNodes": [
      {
        "selectors": [
          ".md\\:w-2xl"
        ],
        "htmlSnippet": "<p class></p>",
        "failureSummary": "Fix any of the following: Element's background color could not be determined because it is overlapped by another element",
        "colorContrast": {
          "contrastRatio": 0,
          "requiredContrastRatio": 3,
          "fontSize": "42.0pt (56px)",
          "fontWeight": "normal"
        }
      },
      {
        "selectors": [
          ".lg\\:gap-10.gap-6.flex-col > .text-h2"
        ],
        "htmlSnippet": "<h2 class><br></h2>",
        "failureSummary": "Fix any of the following: Element's background color could not be determined because it's partially obscured by another element",
        "colorContrast": {
          "contrastRatio": 0,
          "requiredContrastRatio": 3,
          "fontSize": "42.0pt (56px)",
          "fontWeight": "normal"
        }
      },
      {
        "selectors": [
          ".js-media.data-\\[active\\=\\\"false\\\"\\]\\:opacity-0[data-active] > .lg\\:grid.grid-cols-7.grid-rows-2 > .col-span-4.row-span-2 > .size-full.border.justify-center > .text-white.items-start.z-2 > .lg\\:p-6.p-4:nth-child(1) > .text-h4.text-current.font-mistral"
        ],
        "htmlSnippet": "<p class></p>",
        "failureSummary": "Fix any of the following: Element's background color could not be determined due to a background image",
        "colorContrast": {
          "contrastRatio": 0,
          "requiredContrastRatio": 3,
          "fontSize": "24.0pt (32px)",
          "fontWeight": "normal"
        }
      },
      {
        "selectors": [
          ".js-media.data-\\[active\\=\\\"false\\\"\\]\\:opacity-0[data-active] > .lg\\:grid.grid-cols-7.grid-rows-2 > .col-span-4.row-span-2 > .size-full.border.justify-center > .text-white.items-start.z-2 > .text-body-large.lg\\:p-6.p-4"
        ],
        "htmlSnippet": "<p class></p>",
        "failureSummary": "Fix any of the following: Element's background color could not be determined due to a background image",
        "colorContrast": {
          "contrastRatio": 0,
          "requiredContrastRatio": 4.5,
          "fontSize": "15.0pt (20px)",
          "fontWeight": "normal"
        }
      }
    ]
  }
}

Correction steps

01Check the text against its actual background. If it falls below the required ratio, adjust the colors and retest.

Cookies & tracking

3 checks · 1 to review

Review

Pre-consent storage classification reviewCookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.Partial concern

JSON evidence

axeptio_all_vendors (mistral.ai): unknown, present in a check performed before consent

axeptio_authorized_vendors (mistral.ai): unknown, present in a check performed before consent

axeptio_cookies (mistral.ai): unknown, present in a check performed before consent

Full evidence JSON

{
  "assessmentStatus": "review_signal",
  "checklistItemId": "pre_consent_cookies_storage",
  "coverageArea": "Pre-consent storage classification review",
  "evidenceState": "observed",
  "explanation": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "note": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "status": "Review signal",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_cookies_storage.review_signal",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_cookies_storage"
  },
  "statusBasis": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.",
        "For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.",
        "Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice."
      ]
    },
    "evidenceRefs": [
      "axeptio_all_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
      "axeptio_authorized_vendors (mistral.ai): unknown, present in periodic pre-consent snapshot",
      "axeptio_cookies (mistral.ai): unknown, present in periodic pre-consent snapshot",
      "__cf_bm (mistral.ai): essential, first observed 0.731s after scan start",
      "Aggregate pre-consent storage count: 4",
      "Assessment reconciliation: reconciled"
    ],
    "cookiesSeenCount": 4,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected retained concrete cookie/storage evidence for storage timing; request-only tracking evidence is not used as storage proof.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "limited",
    "cookiesBeforeConsentCount": 0,
    "selectedEvidenceArtifactId": "preConsentCookieOrStorageEvidence.missing",
    "preConsentStorageAssessment": {
      "status": "partially_classified",
      "evidenceRows": [
        {
          "name": "__cf_bm",
          "party": "first_party",
          "domain": "mistral.ai",
          "category": "security",
          "storageType": "cookie",
          "essentiality": "essential",
          "timingEvidence": "before_consent_write",
          "exclusionReason": "functional_or_consent_storage",
          "firstObservedMs": 731,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "canonical_registry",
          "exactStorageIdentity": "[\"__cf_bm\",\".mistral.ai\",\"/\",null]"
        },
        {
          "name": "axeptio_cookies",
          "party": "first_party",
          "domain": "mistral.ai",
          "category": "unknown",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 3616,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"axeptio_cookies\",\"mistral.ai\",\"/\",null]"
        },
        {
          "name": "axeptio_authorized_vendors",
          "party": "first_party",
          "domain": "mistral.ai",
          "category": "unknown",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 3616,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"axeptio_authorized_vendors\",\"mistral.ai\",\"/\",null]"
        },
        {
          "name": "axeptio_all_vendors",
          "party": "first_party",
          "domain": "mistral.ai",
          "category": "unknown",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 3616,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"axeptio_all_vendors\",\"mistral.ai\",\"/\",null]"
        }
      ],
      "provenWriteCount": 0,
      "assessmentVersion": "pre-consent-storage-assessment-v1",
      "unclassifiedCount": 3,
      "reconciliationStatus": "reconciled",
      "snapshotPresenceCount": 3,
      "aggregateObservedCount": 4,
      "classifiedEssentialCount": 1,
      "classifiedNonEssentialCount": 0,
      "attributedPreConsentRecordCount": 4,
      "excludedFunctionalOrConsentCount": 1
    },
    "excludedEssentialOrFunctionalRows": [
      {
        "name": "__cf_bm",
        "party": "first_party",
        "domain": "mistral.ai",
        "category": "security",
        "storageType": "cookie",
        "essentiality": "essential",
        "timingEvidence": "before_consent_write",
        "exclusionReason": "functional_or_consent_storage",
        "firstObservedMs": 731,
        "initiatorDomain": null,
        "initiatorVendor": null,
        "essentialitySource": "canonical_registry",
        "exactStorageIdentity": "[\"__cf_bm\",\".mistral.ai\",\"/\",null]"
      }
    ],
    "preConsentStorageAssessmentStatus": "partially_classified",
    "rowLevelEssentialityEvidenceRetained": true,
    "firstPreconsentCookieOrStorageObservedMs": 731,
    "preConsentStorageClassificationLimitation": true,
    "preconsentCookieOrStorageExactTimingRetained": false,
    "eligibleNonEssentialCookieStorageFindingProjected": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.
2For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.
3Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice.

Session recordingNo session-recording service was detected during this scan.Not observed

JSON evidence

retained session replay / fingerprinting coverage summary

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "session_replay_fingerprinting_review",
  "coverageArea": "Session replay signal",
  "evidenceState": "not_observed",
  "explanation": "No eligible session replay, behavioral recording, or fingerprinting-like signal was observed in the tested context.",
  "note": "No eligible session replay, behavioral recording, or fingerprinting-like signal was observed in the tested context.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.session_replay_fingerprinting_review.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.session_replay_fingerprinting_review"
  },
  "statusBasis": "Runtime vendor/fingerprinting checks completed for the tested context, and no eligible replay or fingerprinting finding was projected.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: retained session replay / fingerprinting coverage summary"
    ],
    "sessionReplayCount": 0,
    "missingEvidenceNeeded": [],
    "sessionReplayObserved": false,
    "fingerprintingObserved": false,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "sessionReplayRuntimeCoverageRetained": true,
    "fingerprintingRuntimeCoverageRetained": true
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Device fingerprintingNo device-fingerprinting activity was detected during this scan.Not observed

JSON evidence

retained fingerprinting/browser API coverage summary

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "device_identification_fingerprinting_signal_observed",
  "coverageArea": "Device identification / fingerprinting signal",
  "evidenceState": "not_observed",
  "explanation": "Whether browser/device entropy, fingerprinting, or identifier-like device collection signals were observed in retained runtime evidence.",
  "note": "Whether browser/device entropy, fingerprinting, or identifier-like device collection signals were observed in retained runtime evidence.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.device_identification_fingerprinting_signal_observed.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.device_identification_fingerprinting_signal_observed"
  },
  "statusBasis": "Runtime fingerprinting/device-identification checks completed for the tested context and did not retain an eligible signal.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained fingerprinting/browser API coverage summary"
    ],
    "missingEvidenceNeeded": [],
    "fingerprintingObserved": false,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "runtimeEvidenceRetained": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "fingerprintingRuntimeCoverageRetained": true
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Connection security

5 checks · 1 limited

Limited

HTTPS deliveryThe scanned page used HTTPS.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_https_delivery",
  "coverageArea": "HTTPS delivery for scanned pages",
  "evidenceState": "observed",
  "explanation": "Whether the retained scanned page was served over HTTPS.",
  "note": "Whether the retained scanned page was served over HTTPS.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_https_delivery.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_https_delivery"
  },
  "statusBasis": "The scanned page was served over HTTPS in the retained transport observation.",
  "retainedEvidence": {
    "finalUrl": "https://mistral.ai/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://mistral.ai/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://mistral.ai/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://mistral.ai/",
      "https://mistral.ai/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=WE1, O=Google Trust Services",
        "subject": "CN=mistral.ai",
        "validTo": "Jan  7 23:08:23 2027 GMT",
        "inputUrl": "https://mistral.ai/",
        "validFrom": "Oct  9 22:08:41 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 3
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

HTTPS certificateThe website's HTTPS certificate passed validation.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_tls_certificate",
  "coverageArea": "Valid SSL/TLS certificate",
  "evidenceState": "observed",
  "explanation": "Whether a strict TLS probe verified the HTTPS origin certificate separately from the normal scanner runtime.",
  "note": "Whether a strict TLS probe verified the HTTPS origin certificate separately from the normal scanner runtime.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_tls_certificate.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_tls_certificate"
  },
  "statusBasis": "Retained certificate validation verified the HTTPS origin certificate. Retained certificate evidence: https://mistral.ai/ presented CN=mistral.ai certificate valid Oct 9, 2026–Jan 7, 2027.",
  "retainedEvidence": {
    "finalUrl": "https://mistral.ai/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://mistral.ai/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://mistral.ai/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://mistral.ai/",
      "https://mistral.ai/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=WE1, O=Google Trust Services",
        "subject": "CN=mistral.ai",
        "validTo": "Jan  7 23:08:23 2027 GMT",
        "inputUrl": "https://mistral.ai/",
        "validFrom": "Oct  9 22:08:41 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 3
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

HTTP-to-HTTPS redirectHTTP redirected to HTTPS.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_http_redirect",
  "coverageArea": "HTTP redirects to HTTPS",
  "evidenceState": "observed",
  "explanation": "Whether an explicit HTTP-origin probe redirected to HTTPS.",
  "note": "Whether an explicit HTTP-origin probe redirected to HTTPS.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_http_redirect.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_http_redirect"
  },
  "statusBasis": "The explicit HTTP-origin probe redirected to HTTPS.",
  "retainedEvidence": {
    "finalUrl": "https://mistral.ai/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://mistral.ai/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://mistral.ai/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://mistral.ai/",
      "https://mistral.ai/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=WE1, O=Google Trust Services",
        "subject": "CN=mistral.ai",
        "validTo": "Jan  7 23:08:23 2027 GMT",
        "inputUrl": "https://mistral.ai/",
        "validFrom": "Oct  9 22:08:41 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 3
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Mixed contentNo insecure HTTP resources were found on the scanned HTTPS page.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_mixed_content",
  "coverageArea": "Mixed content",
  "evidenceState": "observed",
  "explanation": "Whether HTTP subresources were observed or blocked on a retained HTTPS page.",
  "note": "Whether HTTP subresources were observed or blocked on a retained HTTPS page.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_mixed_content.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_mixed_content"
  },
  "statusBasis": "No mixed-content HTTP subresources were retained for the scanned HTTPS page.",
  "retainedEvidence": {
    "finalUrl": "https://mistral.ai/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://mistral.ai/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://mistral.ai/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://mistral.ai/",
      "https://mistral.ai/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=WE1, O=Google Trust Services",
        "subject": "CN=mistral.ai",
        "validTo": "Jan  7 23:08:23 2027 GMT",
        "inputUrl": "https://mistral.ai/",
        "validFrom": "Oct  9 22:08:41 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 3
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Form transport securityCould not be fully evaluated using scan evidence; No forms found on the starting page. Form transport was not assessed.Limited

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "transport_security_form_transport",
  "coverageArea": "Observed form transport",
  "evidenceState": "not_testable",
  "explanation": "Whether observed forms resolved to HTTPS transport without submitting form data.",
  "note": "Whether observed forms resolved to HTTPS transport without submitting form data.",
  "status": "Not testable",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_form_transport.not_testable",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_form_transport"
  },
  "statusBasis": "No forms found on the starting page. Form transport was not assessed.",
  "retainedEvidence": {
    "finalUrl": "https://mistral.ai/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://mistral.ai/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://mistral.ai/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://mistral.ai/",
      "https://mistral.ai/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "missing",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=WE1, O=Google Trust Services",
        "subject": "CN=mistral.ai",
        "validTo": "Jan  7 23:08:23 2027 GMT",
        "inputUrl": "https://mistral.ai/",
        "validFrom": "Oct  9 22:08:41 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 3
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1The scan could not fully evaluate Observed form transport, so improve access to the relevant page or feature before treating this as a confirmed issue.
2Resolve any blocked or unavailable page or path noted in the evidence details.
3Confirm the relevant page, policy, or user-choice control is reachable without authentication or bot challenge.
4Rerun the scan with the same location and settings so the result can be compared consistently.
5Keep a short internal record of what changed so the next scan can be compared with the same page and settings.

Global Privacy Control

Response not determined

Limited

GPC comparisonThe paired scan could not determine whether classified tracking activity changed with GPC.Limited

With GPC enabled, we observed 1 classified tracking request, including 1 collection request.

Baseline → GPC

First 1,000 ms after each document commit

Observed requests	Baseline	GPC
Advertising / marketing	0	0
Analytics / session replay	0	0

How we measured this

Page request: Sec-GPC 1; browser setting: true.

47 retained request attempts; 52 retained requests with Sec-GPC.

GPC signal delivery was verified. Neither passive lane reached the required 250 ms quiet period within the existing capture cap, so no response conclusion was made.

JSON evidence

{
  "assessment": {
    "contractVersion": "certscore.gpc-response-assessment.v3",
    "generatedAt": "2026-10-12T19:34:37.940Z",
    "status": "indeterminate",
    "findingTitle": "GPC response",
    "scoreEffect": "none",
    "legalInterpretation": "not_assessed",
    "comparison": {
      "comparable": false,
      "protocol": "passive_baseline_with_sec_gpc",
      "baselineArtifact": {
        "lane": "runtime_evidence",
        "sha256": "7469eed4654981eaa240b4dafaca55123a76a408deb08cfc017d55c06f57ebb8",
        "sizeBytes": 512737,
        "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/lanes/runtime_evidence/CanonicalEvidenceBundle.json"
      },
      "gpcArtifact": {
        "lane": "gpc_observation",
        "sha256": "2596fbfd538418136fde493a8f947bb96f36b196e96b9fbea42f04e24d525d51",
        "sizeBytes": 546115,
        "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/lanes/gpc_observation/CanonicalEvidenceBundle.json"
      },
      "enabledProof": {
        "secGpcHeaderValue": "1",
        "requestsWithSecGpc": 52,
        "requestEventIds": [
          "net_431",
          "net_435",
          "net_437",
          "net_439",
          "net_441",
          "net_443",
          "net_445",
          "net_447",
          "net_449",
          "net_453",
          "net_455",
          "net_461",
          "net_463",
          "net_465",
          "net_467",
          "net_469",
          "net_471",
          "net_473",
          "net_475",
          "net_477",
          "net_479",
          "net_481",
          "net_483",
          "net_485",
          "net_489",
          "net_491",
          "net_501",
          "net_512",
          "net_514",
          "net_516",
          "net_518",
          "net_520",
          "net_522",
          "net_524",
          "net_526",
          "net_528",
          "net_530",
          "net_532",
          "net_534",
          "net_536",
          "net_548",
          "net_550",
          "net_558",
          "net_571",
          "net_573",
          "net_575",
          "net_577",
          "net_586",
          "net_588",
          "net_590",
          "net_592",
          "net_594"
        ],
        "navigatorGlobalPrivacyControl": true
      },
      "delivery": {
        "status": "verified",
        "baseline": {
          "contractVersion": "certscore.gpc-signal-observation.v1",
          "expectedEnabled": false,
          "documentUrlSha256": "aa1786bb9025867eec7132b6762a1e883596f6f6653f155be8c7e9e8c7b5bac9",
          "contextConfigSha256": "7a20ef851f83cb76f7294dc01169581c10ca30d0e11e444c9ec76cbcd4fd1bb3",
          "capturedAtMs": 3572,
          "documentStartedAtMs": 634,
          "frameCount": 1,
          "frames": [
            {
              "documentUrlSha256": "aa1786bb9025867eec7132b6762a1e883596f6f6653f155be8c7e9e8c7b5bac9",
              "mainFrame": true,
              "navigatorValue": false
            }
          ],
          "workerCount": 0,
          "limitationKeys": []
        },
        "gpc": {
          "contractVersion": "certscore.gpc-signal-observation.v1",
          "expectedEnabled": true,
          "documentUrlSha256": "aa1786bb9025867eec7132b6762a1e883596f6f6653f155be8c7e9e8c7b5bac9",
          "contextConfigSha256": "7a20ef851f83cb76f7294dc01169581c10ca30d0e11e444c9ec76cbcd4fd1bb3",
          "prototypeCaptureBinding": {
            "captureId": "0a1bf4ce-0387-4f1c-bec1-a59d8715fbd3",
            "documentIdentitySource": "cdp_loader_id",
            "documentToken": "61B7810040F32E18843A362DB14676E3"
          },
          "prototypeSessionSha256": "94b6281b65c66525543b5c758872433c56bf6b9c0338c471d06a71ed28d3773f",
          "capturedAtMs": 3284,
          "documentStartedAtMs": 634,
          "frameCount": 1,
          "frames": [
            {
              "documentUrlSha256": "aa1786bb9025867eec7132b6762a1e883596f6f6653f155be8c7e9e8c7b5bac9",
              "mainFrame": true,
              "navigatorValue": true
            }
          ],
          "workerCount": 0,
          "limitationKeys": []
        }
      },
      "coverage": {
        "status": "limited",
        "comparedThroughMs": 2650
      },
      "responseBasis": "insufficient_evidence",
      "deltas": {
        "cookies": {
          "baselineCount": 5,
          "gpcCount": 5,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "[\"__cf_bm\",\".mistral.ai\",\"/\"]",
            "[\"__cf_bm\",\"mistral.ai\",\"/\"]",
            "[\"axeptio_all_vendors\",\"mistral.ai\",\"/\"]",
            "[\"axeptio_authorized_vendors\",\"mistral.ai\",\"/\"]",
            "[\"axeptio_cookies\",\"mistral.ai\",\"/\"]"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 5,
          "samplesTruncated": false
        },
        "webStorage": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        },
        "trackers": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        },
        "advertisingOrMeasurementActivity": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        },
        "advertisingOrMarketingActivity": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        },
        "consentOrCmpBehavior": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        }
      },
      "evidenceRefs": [
        "net_431",
        "net_435",
        "net_437",
        "net_439",
        "net_441",
        "net_443",
        "net_445",
        "net_447",
        "net_449",
        "net_453",
        "net_455",
        "net_461",
        "net_463",
        "net_465",
        "net_467",
        "net_469",
        "net_471",
        "net_473",
        "net_475",
        "net_477",
        "net_479",
        "net_481",
        "net_483",
        "net_485",
        "net_489",
        "net_491",
        "net_501",
        "net_512",
        "net_514",
        "net_516",
        "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/lanes/gpc_observation/CanonicalEvidenceBundle.json",
        "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/lanes/runtime_evidence/CanonicalEvidenceBundle.json"
      ],
      "limitationKeys": [
        "baseline_settle_not_completed",
        "gpc_settle_not_completed"
      ]
    },
    "observation": {
      "contractVersion": "certscore.gpc-bounded-observation.v1",
      "scope": "main_document_and_retained_http_requests",
      "status": "complete",
      "sourceSha256": "2596fbfd538418136fde493a8f947bb96f36b196e96b9fbea42f04e24d525d51",
      "sessionSha256": "94b6281b65c66525543b5c758872433c56bf6b9c0338c471d06a71ed28d3773f",
      "documentUrlSha256": "aa1786bb9025867eec7132b6762a1e883596f6f6653f155be8c7e9e8c7b5bac9",
      "delivery": {
        "httpHeaderRetained": true,
        "mainNavigatorReadbackRetained": true,
        "fullContextVerified": true
      },
      "semanticProbe": "unavailable",
      "registration": {
        "basis": "current_recorded_state",
        "sale": "unknown",
        "sharing": "unknown",
        "cmpGpcSignal": "unknown",
        "causedByGpc": "not_established"
      },
      "acknowledgment": {
        "observed": false,
        "captureComplete": true
      },
      "requests": {
        "count": 47,
        "blockedBeforeTransmissionCount": 0,
        "complete": true,
        "fromMs": 584,
        "documentCommittedAtMs": 728,
        "throughMs": 3422,
        "classifiedCount": 1,
        "collectionCount": 1,
        "evidenceIds": [
          "net_577"
        ],
        "samplesTruncated": false
      },
      "limitationKeys": [],
      "scoreEffect": "none",
      "legalInterpretation": "not_assessed"
    }
  },
  "evidenceRefs": [
    "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/lanes/runtime_evidence/CanonicalEvidenceBundle.json",
    "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/4ae8cca1-0b70-46b6-9ece-8f5d1dc8fb53/lanes/gpc_observation/CanonicalEvidenceBundle.json",
    "net_431",
    "net_435",
    "net_437",
    "net_439",
    "net_441",
    "net_443",
    "net_445",
    "net_447",
    "net_449",
    "net_453",
    "net_455",
    "net_461",
    "net_463",
    "net_465",
    "net_467",
    "net_469",
    "net_471",
    "net_473",
    "net_475",
    "net_477",
    "net_479",
    "net_481",
    "net_483",
    "net_485",
    "net_489",
    "net_491",
    "net_501",
    "net_512",
    "net_514",
    "net_516"
  ]
}

Loading report

Executive overview

Assessment highlights

Top issues on this page

Pre-consent page event timeline

Services & Resources

Type mix

Evidence mix

Purpose mix

Site relationship

Policy disclosure · Not found

Policy disclosure · Not found

Policy disclosure · Not found

Detailed evidence

CMP details

Consent management audit · 13 criteria

Consent choices

Tracking & embeds

Policies & disclosures

Accessibility (WCAG)

Cookies & tracking

Connection security

Global Privacy Control

Baseline → GPC