DeepSeek

Data-handling profile

Trains on input

Yes, on all tiers

Retention

Retains chat inputs, device identifiers, IP addresses, and keystroke patterns for as long as the account is active (or longer for stated 'legitimate business interests'); no published anonymization or minimal-retention policy. Data may be used for model training by default with limited opt-out controls; enterprise-grade zero-retention requires local/self-hosted deployment.

Data region

China

Certifications

none listed

DPA available

No

Breach history

Jan 2025: Italy's Garante banned DeepSeek from processing Italian users' data after finding its privacy policy inadequate and confirming personal data storage in China without GDPR-compliant safeguards; formal investigation opened. Separately, an exposed ClickHouse database (reported Jan 2025) briefly leaked chat histories and API keys.

EU AI Act

China-based data residency subject to PRC National Intelligence/Data Security Laws; banned/restricted by multiple EU regulators (Italy) over GDPR non-compliance, indicating high EU AI Act and cross-border transfer risk.

Sources

• https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
• https://www.twobirds.com/en/insights/2025/the-garante-imposes-a-definitive-limitation-on-the-processing-of-italian-users%E2%80%99-personal-data
• https://www.euronews.com/next/2025/01/31/deepseek-ai-blocked-by-italian-authorities-as-others-member-states-open-probes
• https://ai-regulation.com/deepseek-one-year-later-regulatory-storm-global-surge/

Every fact above is drawn from the vendor's public documentation, reviewed by a human, and version-stamped. Monitored daily for changes.

Change history

No material changes recorded since monitoring began.