Vendors · Questionnaire · Xiaomi
Read Xiaomi’s own answers to nine buyer questions
Xiaomi MiMo API Open Platform, under its privacy policy for use in China. Each answer quotes Xiaomi’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
No for the text content a user gives, unless the user gives prior consent
Without your prior consent, Xiaomi will not use the text content provided by you for model training or any other purposes.
The statement names text content only. The same section says Xiaomi collects “text, image, video, and audio information” to run the API and Xiaomi MiMo Code services. Xiaomi MiMo Privacy Policy, kept 4 Nov 2026 · sha256 8ed89989df48
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for Xiaomi.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
No fixed period: kept as long as its purposes need or law requires, with exceptions
We retain your personal information for the period necessary to fulfill the purposes for which it was collected as described in this Privacy Policy, or as required by applicable laws and regulations.
The policy speaks of personal information and names no period for prompts or outputs. The same paragraph keeps data longer for public interest, research or statistical purposes, and the policy says deleted data may not leave backups at once. Xiaomi MiMo Privacy Policy, kept 4 Nov 2026 · sha256 8ed89989df48
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Not published in the pages kept
Searched: Xiaomi MiMo Privacy Policy; Rate Limit.
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
Personal information is stored in China, for use of the service within China
This agreement applies to your use of Xiaomi MiMo services within the territory of the People's Republic of China. Accordingly, your personal information will be stored within the territory of the People's Republic of China.
For use outside China, the page says a different privacy policy “applicable to services outside the People's Republic of China” governs. Xiaomi MiMo Privacy Policy, kept 4 Nov 2026 · sha256 8ed89989df48
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Some services use third-party service providers that get some personal information; none named here
Some of our services are provided by third-party service providers. To this end, we need to provide some of your personal information to these third-party service providers.
Xiaomi MiMo Privacy Policy, kept 4 Nov 2026 · sha256 8ed89989df48
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: Xiaomi MiMo Privacy Policy; Rate Limit.
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
No answer kept
Xiaomi MiMo links no status page or history feed. The page.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Not read
This site reads no retirement page for Xiaomi.
- Xiaomi, Xiaomi MiMo Privacy Policy, kept 4 Nov 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.