You also have the right to opt-out of direct marketing at any time. You can do this by following the instructions in the email (e.g. clicking "unsubscribe").

If you would like to exercise any of these rights, please use the contact details set out above.

We normally respond within one month, or up to three months if your request is complex. If your request is not associated with an account, then it's likely we will need to request further information to attempt to locate your personal information, if any, and verify you as the data subject.

If your request is in relation to training data, please first review our Model Training Privacy Notice . As we explain in that notice, as an enterprise AI company, Cohere does not intentionally collect personal information for training purposes. We are likely to require further information from you for this type of request, like about personal information that appears in a Cohere model output, screenshots or links to such outputs, and reasons why this information should not appear. We assess each request in accordance with applicable laws. Where a right is limited under applicable laws, we may decline a request in accordance with these lawful limitations.

If you have unresolved concerns, you can complain to the relevant data protection authority in your jurisdiction. In the UK, this will be the Information Commissioner. A list of authorities in the EEA can be found here .

Cohere is a Canadian company subject to Canadian federal privacy laws, and so personal information transferred from the UK or the EEA to Cohere in Canada is made pursuant to adequacy regulations (for the UK, see here ; for the EEA, see here ). To the extent Cohere further transfers personal information to sub-processors or affiliates for the purpose of providing the Website, Cohere Products, or in the process of developing its models, such transfers are subject to and protected by appropriate security measures in accordance with Canadian privacy laws. We also ensure our sub-processors are subject to appropriate transfer mechanisms recognized under UK and EU laws. Our cloud infrastructure provided by GCP in the United States, for instance, is protected under the EU-US Data Privacy Framework , including its UK extension. Controller-to-processor Standard Contractual Clause agreements are used as an alternative mechanism where the transfer is not otherwise subject to an adequacy determination or derogation under applicable laws. Users of the Platform or Cohere APIs can consult our list of sub-processors , which includes data processing locations.