Where does this provider put your AI data — and who can compel its disclosure?
| Residency | Mainland China cn |
|---|---|
| Sovereignty | Mainland China cn |
| Endpoints | api.deepseek.com |
| Packages | @ai-sdk/deepseek (npm) |
| Regimes | PIPL |
| Cross-border references | PIPL cross-border transfer — Mainland China cross-border PI: CAC security assessment, standard contract, or certification (Provisions on Promoting and Regulating Cross-Border Data Flows, 2024). |
How does this provider treat the data you send it? Advisory statements about documented practices — not legal advice.
| Trains on customer API data by default | Opt-out available source — Privacy Policy (updated 2026-02-10), purposes section: personal data processed 'to improve and develop the Services and to train and improve our technology, such as our machine learning models and algorithms', with a described right to opt out of such use; no API-specific carve-out (retrieved 2026-08-22) |
|---|---|
| Retention (API inputs/outputs) | Personal data is collected, processed and stored in the People's Republic of China (controller: Hangzhou DeepSeek Artificial Intelligence Co., Ltd.). No fixed retention window is published: data is retained 'for as long as necessary to provide our Services and for the other purposes set out in this Privacy Policy', then destroyed, deleted or anonymised when no longer required. No zero-data-retention tier or enterprise no-train arrangement is documented. source — 'To provide you with our services, we directly collect, process and store your Personal Data in People's Republic of China'; retention 'for as long as necessary to provide our Services', destroyed/deleted/anonymised when no longer required (retrieved 2026-08-22) |
| Enterprise tier | No self-serve API opt-out mechanism or enterprise training carve-out is documented; the privacy policy describes a right to opt out of model-training use of your personal data at policy level. The Open Platform Terms of Service defer personal-data handling back to the privacy policy rather than exempting paid API traffic. source — Open Platform Terms of Service (effective 2026-04-29): personal-data handling defers to the Privacy Policy; no separate exemption for developer API inputs (retrieved 2026-08-22) |
| Entry last reviewed | 2026-08-22 |