LLM Providers · LLM Provider / AI Assistant · Structural / no discrete incident
Moonshot AI (Kimi)
Headline
Kimi's privacy policy lists clipboard data among the categories it collects - the buffer that briefly holds whatever you last copied, which for most people routinely includes passwords, account numbers and two-factor…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Kimi's privacy policy lists clipboard data among the categories it collects - the buffer that briefly holds whatever you last copied, which for most people routinely includes passwords, account numbers and two-factor codes. There is no in-product toggle to opt out of model training; you have to contact customer service and ask. The Chinese-language version of the policy names the Beijing parent as operator and says personal information is stored inside mainland China; how the international service stores data was not verified this pass. Then April 2026 supplied the concrete case: Kimi reportedly handed one user's resume, including name, phone number and work history, to an unrelated user; one Chinese media account described the task as a PowerPoint translation. The OECD AI Incidents Monitor logged it as an AI incident on the strength of those reports and named a data isolation failure as one possible cause. The consumer liability cap is the lesser of fees paid or fifty dollars.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Chinese-law exposure regardless of corporate structure: the Chinese-language privacy policy at the linked URL names Beijing Moonshot AI Technology Co., Ltd. as the operator and states that personal information is stored inside mainland China (s. 5.1); a Singapore entity (MOONSHOT AI PTE. LTD.) has been reported as controller for the international service but was not verified this pass. The parent (Beijing Moonshot Technology Co., Ltd.), engineering team and infrastructure are Chinese, and China's National Intelligence Law (2017), Cybersecurity Law (2017) and Data Security Law (2021) reach the parent regardless of server location or offshore holding structure. INDEMNITY RUNS ONE WAY: user agrees to defend and hold Moonshot harmless for claims arising from inputs, outputs and use. No confirmed regulatory enforcement or litigation against Moonshot found this pass.
Data sharing
Privacy policy permits user prompts and uploaded content to be used to train and improve models, with NO documented in-product opt-out for consumers as of mid-2026 - the policy says users may contact customer service to ask that their content not be used for training, subject to identity verification (s. 2.4), rather than using a toggle. The Chinese-language policy at the linked URL states that personal information is stored inside the PRC and is not provided abroad without separate consent and compliance with Chinese law (s. 5.1); storage terms for the international service were not verified this pass. Policy also lists CLIPBOARD DATA among collected categories - the buffer that temporarily holds copied passwords, account numbers and verification codes. No explicit prohibition on sharing user prompts for third-party model training. Unilateral modification clause with no minimum notice period reported (terms page did not render for verification this pass).
Fees and billing
Free consumer product. Liability cap on the consumer site is reported as the LESSER of fees paid or $50 - so for a free user, effectively fifty dollars or nothing. Compare OpenAI's greater-of-12-months-or-$100. No copyright/output indemnity of the kind OpenAI, Anthropic, Google and Microsoft offer.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.kimi.com/user/agreement/userPrivacy?version=v2 | Not fetched yet | N |
| Terms of service https://www.kimi.com/user/agreement/userAgreement | Not fetched yet | N |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.