Kimi AI and privacy: what to check on company data

Kimi AI's privacy should be assessed by product and treatment, distinguishing global app, API platform and related services. The public policies consulted include the use of content for improvement and training; they do not authorize to promise "no training for all" or "data always in the European Union". Enterprise conditions require specific reading. Global Privacy App, API Privacy and Zero Data Retention.

For an SME the initial question is concrete: what material do you want to load and what result do you need? A public product card, contact list, and staff document do not have the same meaning. Even a file without personal data may contain margins, confidential prices or information subject to confidentiality obligations.

This guide reports what has been verified to the 9 October 2026 and indicates what remains to be achieved before business use. For product functions you can start from What is Kimi AI. Here the goal is to make a documented decision on the path of the data, without attributing an automatic conformity to the brand.

Which company processes data in the app and APIs?

The global app privacy policy, updated on 13 August 2026, indicates NOVASCENT PRIVATE LIMITED as provider and controller. Global terms identify this company as registered to Singapore. Do not confuse such a venue with a proof that any data is stored exclusively in that country. Privacy app and Global Terms.

The API platform instead needs an updated policy on 30 April 2025, which identifies MOONSHOT TO PTE. LTD., Singapore, and declares secure servers in Singapore and international transfers. The text was still reachable from the current documentation at the verification: the oldest date should be preserved, not replaced with an invented date. Kimi OpenPlatform Privacy Policy.

The table summarizes the app policy and API, without unifying contracts. The fact that a brand uses multiple entities alone does not prove a criticality: it means that the company must identify the correct counterpart, product and conditions.

The Guide to Kimi API explains the technical separation of endpoints. Also Kimi Code should be evaluated in its own path: do not transfer a promise read for chat to an agent working on the repository.

What content can be used for training?

The app's global policy includes prompt content, files, audio, images, videos and generated material, and contemplates service improvement and training. Uploading a document and only asking for a summary does not automatically reduce the treatment to the short text of the answer. User Content in the app policy.

Global terms provide an opt-out path via contact to the media. They describe it as perspective: it concerns future use and does not require removal from already completed cycles. Before loading reserved material, you get confirmation of the choice applied to your account and keep the reference. Opt-out in app terms.

The general API policy also includes improvement and training. ZDR documentation instead declares no default training on enterprise data. They are different perimeters: the second statement does not allow to extend the promise to every developer and to every key. Privacy API and ZDR conditions.

An answer from the model to the question “Do you use my data?” is not a contractual verification. The model could summarize old conditions or related to another product. The source must be the applicable text and, for options activated on request, a service confirmation.

Where do the data end up and how much is kept?

The policy app includes transfers and storage outside the user's country, as well as shares with subjects in the categories described. It does not demonstrate an EU residence or an exclusively Chinese location. Avoid using a historical FAQ from another market to infer the behavior of the global app. Transfers in the policy app.

Retention does not have a unique duration for the whole service. You need to distinguish conversation content, uploaded documents, account information, logs, and copies in the business process. A request for deletion at one point does not prove that all copies already created elsewhere have disappeared. The policy app describes retention and rights criteria, without offering a single universal count. Conservation and Rights.

If you use a workflow, add the executions and logs of the automation system to the drawing. The text can go from the form to n8n, from the model to the management software and from there to an exported file. Provider privacy is a part of this chain, not a description of the whole process. The Guide to Kimi AI with n8n shows where to introduce control and validation.

What does Zero Data Retention really cover?

The platform guide describes ZDR available on request for enterprise customers. The request and response content is deleted after the response, except for legal obligations. It is not presented as the automatic setting of each API account. Verify activation, product and applicable conditions before basing a process on this warranty. Zero Data Retention Guide.

The exclusions are decisive: ZDR is not guaranteed for images and videos sent via direct upload; security logs and billing remain outside the perimeter; third-party models, connectors and plugins are not covered. Even an integration with unchanged APIs and billing can therefore have components that store data. Official ZDR limits.

Do not interpret ZDR as "no trace of the service" or "GDPR solved". Reduces one aspect of content preservation, within the documented perimeter. It does not choose the legal basis of your processing and does not delete copies that your software saves on behalf of the company.

What verifications does the GDPR require in the business case?

The GDPR distinguishes purposes, legal basis and measures of processing. The principles include minimization, limitation of conservation and accountability; it is not enough that the service is accessible from Italy. The company needs to be able to explain why that data is needed and how the processing was evaluated. Principles of processing, Privacy Guarantor.

When a provider processes data on behalf of the controller as the controller, the Article 28 requires a contract or other legal act with specific content. Do not automatically deduct this role from the sole purchase of an account: verify the purposes of the provider and the applicable agreement. For transfers to third countries, the conditions of the Chapter V, not just the declared venue. GDPR text, Articles 28 and 44 et seq..

For your project then collect elements about roles, purposes, data categories, sub-suppliers, transfers and measures. In the public documentation read for this guide we have not verified a specific DPA for your case, the clauses applicable to your transfers or a contractually guaranteed EU residence. This absence of verification does not amount to declaring any use illegal: it indicates what is missing to decide.

If you process personnel data, special categories or information related to professional obligations, please involve the privacy contact person before using real data. The evaluation concerns the concrete process; a generic consent entered in the form does not replace all other conditions. Legal basis and special categories, Guarantor.

How to prepare a document with less data?

Start with the task. If you have to compare clauses, extract the relevant ones and replace the parts with controlled labels. If you need to evaluate the structure of a sheet, use synthetic headings and lines. If you need to rewrite a public text, submit the public version instead of an internal draft with comments.

The reduction must be done before sending. Asking the model “ignores personal data” does not prevent the text from already being received. Keep internally the necessary matches to re-enter names or references in the result, without sending them if the job does not require them.

I covered the name in the PDF: can I upload it?

Check that the original text does not remain selectable under the box. Verify signatures, addresses, metadata, comments, and attachments. Even the content can make a person recognizable. For the pilot you prefer an excerpt reconstructed with synthetic data and verify the final file, instead of relying only on the appearance of the page.

Do not automatically call an anonymous document from which you took the name. The practical question is whether the remaining details still allow you to link the text to someone. In the guide to Business Data and Privacy AI find criteria to distinguish public, confidential and personal content.

Two Italian scenarios to choose the perimeter

Hypothetical scenario: administrative study in Turin. The team wants to use Kimi to reorder an internal procedure related to staff documents. The first attempt does not require real paychecks: you can provide the description of the process and a synthetic form, without names, wages or health information.

The result is used to evaluate clarity of instructions, missing fields, and order of verifications. If the firm later wants to analyze individual documents, the project changes: first it collects service conditions, purposes and necessary measures with the privacy contact person. The success of the synthetic test does not automatically authorize that new treatment.

Hypothetical scenario: furniture manufacturer in Vicenza. The salesman wants to compare product descriptions published in the catalog. It can start with that material, keeping out negotiated prices, customer contacts and notes on negotiations. The result is checked before being included in a proposal.

If the process evolves into an agent consulting the CRM, they must also change permissions and data perimeter. The agent can only read what the user is allowed to use; submitting a proposal requires a separate confirmation. The design is described in the guide to Kimi Agents for Companies.

Cases are hypothetical and show progression: synthetic or public material to assess utility; conditions and controls verified before expanding treatment.

What mistakes to avoid in choosing the service?

The first is to confuse opt-out, retention and localization. Excluding training does not prove that data remains in the EU; reducing retention alone does not solve the transfer assessment.

The second is to consider the owner of the output synonymous with confidentiality. Global terms recognize rights to input and output within the limits of the law, but this is different from the purposes of processing and does not guarantee originality of the result. Output rights in terms.

The third is to allow personal accounts without knowing which product, plan and setting employees use. The fourth is to verify only the model and ignore plugins, logs and exports. A business procedure must make the full path visible. For a larger picture see AI and corporate privacy.

How to get to a decision that can be used by the team?

Prepare a card for the use case: purpose, necessary data, chosen product, preserved conditions, accesses, created copies and responsibilities. Explicitly mark missing documents. Those who work must know what material they can send and who to turn to when they encounter content outside the perimeter.

Once evidence is gathered, it approves precise use and reviews the card when changing product, integration, or data categories. If you want to turn these verifications into an operational choice for your team, Giallo helps define how to introduce AI into business processes. The decision starts from the data and the work to be done.