A Practical Guide to DeepSeek Privacy in 2026

If you type a question into the DeepSeek chatbot, where does that text actually go, who can read it, and can you stop it being used to train future models? Those are the three questions most people mean when they ask about DeepSeek privacy, and the honest answers are more nuanced than either the “it’s a Chinese data vacuum” headlines or the “it’s just another AI app” defences suggest. This guide walks through what DeepSeek’s own Privacy Policy (last updated 10 February 2026) and Terms of Use (last updated 27 March 2026) say it collects, where that data is processed, the regulatory action against the company since January 2025, and the practical steps that reduce your exposure if you still want to use the product. You’ll leave knowing exactly which trade-offs you’re making.

The short answer on DeepSeek privacy

DeepSeek’s Privacy Policy (10 February 2026) says its services are provided and controlled by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., with its registered address in China. It states that “to provide you with our services, we directly collect, process and store your Personal Data in People’s Republic of China”, which may be outside the country where you live. Its Terms of Use (27 March 2026) are governed by the laws of the People’s Republic of China (mainland), with disputes going to a court with jurisdiction over the company’s registered office.

That single fact — data stored in China, under a Chinese company’s policies — is what drives almost every regulatory action and every enterprise ban you have read about. Everything else in this guide is detail around that core trade-off.

What data DeepSeek actually collects

The current Privacy Policy, last updated 10 February 2026, is broad. It sorts what it collects into three buckets:

1. Data you provide

• Account details: email address and/or telephone number and password, plus date of birth and username where applicable.
• User input: text input, voice input, prompts, uploaded files, photos, feedback, chat history and other content you give the model.
• What you send when you contact DeepSeek, such as proof of identity or age, contact details and your inquiry.
• Payment information if you use the paid developer platform: the policy says DeepSeek collects payment order and transaction data when you use paid services on its open platform, to provide order placement, payment, customer service and after-sales support. It adds that this does not apply to the DeepSeek App.

2. Data collected automatically

The policy lists device and network data (device model, operating system, IP address, device identifiers and system language), service, diagnostic and performance data such as crash reports and performance logs, and log data about the features you use and the actions you take. DeepSeek assigns you a device ID and user ID and, where you log in from several devices, uses them to identify your activity across devices for log-in and security. It also derives your approximate location from your IP address — for security, and to answer location-related questions — and uses cookies on its websites; the policy says cookies do not apply to the DeepSeek App.

3. Data from third parties

DeepSeek may receive personal data from other sources: if you sign up or log in with a third-party service such as Apple or Google, it may collect data such as an access token from that service; it receives security data from partners to fight fraud and abuse; and it says it may obtain publicly available personal data from online sources to train its models and provide its services. On the sharing side, the policy names service providers (including analytics, communications and safety-monitoring providers, and third-party search APIs that receive your input keywords), entities in its corporate group (for storage, content delivery, security, research and development, foundation model training, analytics and support), parties to a corporate transaction, and law enforcement or other parties with legal rights.

What the policy says DeepSeek does not do

The same policy also sets some limits. It says DeepSeek will not extract voiceprints, facial-recognition data or other biometric identifiers from your voice inputs or photos, and will not obtain your precise geolocation by other means without your explicit consent. It states that DeepSeek does not engage in targeted advertising, does not “sell” personal data and does not use it for profiling that has legal or similarly significant effects. And it says the services are not designed to process sensitive personal data — such as health, religious beliefs, biometric data or children’s data — and asks you not to provide it. These are DeepSeek’s own statements of policy; the policy is the commitment, not an independent audit.

Where your conversations go

Every message you send to the DeepSeek chat or DeepSeek app falls under the Privacy Policy’s statement that DeepSeek collects, processes and stores personal data in the People’s Republic of China. That has two concrete implications:

1. Chinese law applies to the stored data. The policy says DeepSeek may access, preserve and share personal data with law enforcement agencies, public authorities or other third parties where it believes in good faith that this is necessary to comply with applicable law, legal process or government requests, “in accordance with the due process prescribed by law”. The Terms of Use add that, for suspected illegal activity, relevant records are retained and reported to the competent authorities.
2. European users get a supplemental clause. The policy’s section for the EEA, Switzerland and the UK sets out legal bases for each purpose and rights including access, rectification, erasure, restriction, portability, objection and complaints to a local data protection authority. It names Prighter Group as DeepSeek’s privacy representative for the EU and UK ([email protected]); otherwise, requests go to [email protected].

The API is a different privacy story

Almost every privacy critique of DeepSeek is about the consumer app and web chat. The developer API differs in ways that matter here.

First, the Privacy Policy draws a line around developer products: it says the processing of personal data collected from end users of downstream applications that developers build on DeepSeek’s open platform is not covered by DeepSeek’s policy — the developer operating the application is the controller and must disclose its own data-protection policies to its users. If you build on the API, your own privacy notice has to cover your users.

Second, the API is stateless: DeepSeek does not keep the conversation for you between calls — your client resends the conversation history with every request to POST /chat/completions at https://api.deepseek.com. That changes the privacy calculus: the web app keeps your chat history with your account, while an API integration you build yourself decides what gets sent in each request. It does not change where requests are processed, and DeepSeek’s policies do not describe a separate retention rule for API requests.

The API is OpenAI-compatible (with an Anthropic-compatible interface at https://api.deepseek.com/anthropic), so privacy-conscious teams can route through logging proxies, redact personal data before it leaves the network, and pin which fields ever reach the provider. See the DeepSeek API best practices for concrete patterns.

Training data: can you opt out?

Yes, with caveats. The Privacy Policy (10 February 2026) says DeepSeek uses personal data to train and improve its models, and lists — among the rights that may be available to you depending on where you live — “the right to opt-out of using your Personal Data for training our models or optimizing our technologies”, exercised by emailing [email protected]. The Terms of Use (27 March 2026) say DeepSeek may, to a minimal extent and only after secure encryption and strict de-identification, use inputs and outputs to provide, maintain, develop or improve its services, and that you can opt out by turning off “Improve the model for everyone”.

Look for that setting in the web chat or app after logging in; labels can change between versions. If you cannot find it, the email route in the Privacy Policy is the documented fallback.

Regulatory status: a moving target

DeepSeek has drawn regulatory attention since its app surged in January 2025, and its Terms of Use say DeepSeek makes no warranty that its services are or will remain available in certain jurisdictions.

On Italy specifically, the nuance matters. The Garante’s press release of 30 January 2025 says it ordered, urgently and with immediate effect, a limitation on the processing of Italian users’ data after finding the companies’ reply to its questions entirely insufficient: they had said they did not operate in Italy and that European law did not apply to them. The order itself notes that the app was no longer available in Apple’s and Google’s Italian stores by 30 January 2025, while the web service was still reachable.

For a country-by-country snapshot that we keep current, see DeepSeek availability by country and the running coverage on DeepSeek US restrictions.

How DeepSeek compares to Western alternatives on data handling

It would be misleading to treat DeepSeek’s data list as unique: any hosted chatbot has to process your conversations and some device data to work, so the useful comparison is each provider’s own policy, read side by side — see DeepSeek vs ChatGPT for a direct feature comparison. Two points stand out in DeepSeek’s documents:

• Jurisdiction of storage. DeepSeek’s Privacy Policy says personal data is collected, processed and stored in the People’s Republic of China, its Terms of Use are governed by mainland Chinese law, and its law-enforcement clause covers government requests under applicable law and legal process. If your organisation needs data kept in a specific jurisdiction, that is the deciding factor.
• Advertising and sharing. The current policy states that DeepSeek does not engage in targeted advertising or sell personal data. It does share data with service providers (including analytics providers) and with entities in its corporate group, including for foundation model training — so read those sections before you decide what to type.

Five ways to reduce your DeepSeek privacy exposure

1. Run the weights locally. DeepSeek’s current releases, DeepSeek-V4.1-Flash-1017 and DeepSeek-V4-Pro-0813, are MIT-licensed open weights, and smaller distilled R1 models are available for modest hardware. If you have the hardware (or rent GPUs), see install DeepSeek locally or running DeepSeek on Ollama. No chats leave your network.
2. Use the API, not the app, for sensitive workflows. The stateless API lets you control your own logging, redact PII before sending, and pin traffic to your backend. Start with the DeepSeek API getting started guide.
3. Flip the training opt-out. Turn off “Improve the model for everyone”, the setting the Terms of Use name; if you cannot find it, email [email protected].
4. Avoid sensitive inputs entirely. DeepSeek’s own policy says its services are not designed to process sensitive personal data and asks you not to provide it. Client records, health data, regulated secrets, and anything covered by NDA should not be pasted into any consumer chatbot — DeepSeek included. Review what your organisation allows with a pragmatic is DeepSeek safe walkthrough.
5. Delete your account if you stop using it. Walk through the steps in delete DeepSeek account. The Privacy Policy says data used to provide the service is kept for as long as you have an account and that a deleted account cannot be reactivated; the Terms of Use say DeepSeek may still retain certain data as required by law.

Who should and shouldn’t use DeepSeek

Reasonable fit

• Hobby use, casual writing help, code snippets with no proprietary context.
• Self-hosted deployments of the open weights for teams that want the capability without the data flow.
• API-only integrations where you control what crosses the wire and you’ve reviewed the terms.

Avoid

• Regulated industries (healthcare, finance, legal) using the consumer app without a bespoke deployment.
• Government, defence, and critical-infrastructure workloads — several US states already restrict it on government devices.
• Anything involving EU personal data under GDPR if you cannot demonstrate a lawful transfer mechanism.

For a roundup of privacy-first options, see our DeepSeek alternatives shortlist and the broader set of DeepSeek beginner guides.

Bottom line

DeepSeek privacy is a classic trade-off. You get frontier-tier capability at low prices in exchange for sending your inputs to servers in China, under a policy that permits broad data collection, sharing within DeepSeek’s corporate group, and use of your data for model training unless you opt out. That trade is acceptable for some workloads and unacceptable for others. If you must use the hosted service, flip the training opt-out, avoid sensitive content, and prefer the API over the app. If the jurisdiction is the blocker, the open weights are there — that is genuinely the exit hatch.