Kimi

Trains on inputs by default with no opt-out

User Content including prompts, audio, images, videos, and files is processed to provide and improve the Services, including training and optimizing the models, with the legal basis given as legitimate interests or consent depending on jurisdiction. The policy names no general training opt-out toggle. That absence sets the training dealbreaker flag.

Full data-subject rights

The policy grants explicit rights of access, rectification, erasure, restriction, data portability in a structured machine-readable format, objection, and consent withdrawal, with requests routed to membership@moonshot.ai.

Does not sell, sharing enumerated

It states the company does not sell personal information and lists processor categories such as hosting, payment, analytics, and security partners, though it does not link a named sub-processor list or DPA.

Vague retention and no named transfer safeguard

Retention is held only for as long as necessary with no day-count, deletion on account closure carries no timeline number, and international transfers cite appropriate safeguards and adequate protection without naming SCCs, adequacy, or DPF.