From https://platform.kimi.ai/docs/agreement/modeluse

> We may use Content to provide, maintain, develop, support, and improve the Services, comply with applicable law, enforce our terms and policies, and keep the Services safe and secure. Customer who requires restrictions on the use of Customer Content for training or improving Moonshot AI models may contact Moonshot AI to discuss available enterprise arrangements or separate written agreements. Unless otherwise expressly agreed in writing, Customer Content may be used for the foregoing purposes.

Notably, unlike Claude, there is not an opt-out option for the model training part. The TOS explicitly allows Kimi to train on your code.

Simplest way is to signup to OpenRouter and filter out all non ZDR (zero data retention) providers. Paying "API rates" however can prove expensive compared to coding plans (for instance, MiniMax $20/mo coding plan allows 1.7b tokens; depending on input/output/cache ratio, it is worth $200 to $500+), except for Hy3, DeepSeek v4 Pro, and MiMo v2.5 Pro (whose API rates are cheap and/or discounted already).

If you're looking to not have to deal with Chinese providers, AtlasCode ($20/mo), OpenCode Go ($10/mo), and Cline Pass ($10/mo) provide 2x to 6x usage for some of the popular open weights (depending on the model).

Personally, I subscribe to Z.ai ($17/mo), and pay API rates for MiMo v2.5, Hy3, Qwen 3.7 Plus, & DeepSeek v4 to the original providers (Xiaomi, Tencent, Alibaba, & DeepSeek).

Need to wait until "western" providers start hosting it.

> What's the data governance and privacy controls on using Kimi K3 if I subscribe to their coding plans?

If you can’t figure it out from their website, perhaps it is a red flag?