DeepSeek Chat

The Terms state that users retain whatever rights they have in their Inputs, which is user-favorable. Users remain fully responsible for the legality of what they submit.

DeepSeek assigns any rights it may have in the Outputs to the user, and permits broad reuse including commercial and model-training uses. The Terms warn that Outputs may not be unique and others may receive similar results.

By default DeepSeek uses user Inputs and Outputs to develop and improve its models and technology, and the privacy policy confirms User Input is a data category processed for model training. Opt-out is possible by turning off a setting, but training use is on by default, and the EEA legal basis table relies on legitimate interests. This default-on training of user prompts is high risk for proprietary or confidential data.

Users can delete chat history and their account, and the policy describes data-subject deletion rights. However, retention periods are described only generally ("as long as necessary" / "as long as you have an account") with no concrete schedules or deletion SLAs, and the vendor reserves the right to retain data to comply with law or to process violations. Account deletion is also irreversible.

DeepSeek shares personal data with service providers, its corporate group (including for foundation model training), search API partners, and in corporate transactions and legal-request scenarios. It states it does not sell data or engage in targeted advertising, which is favorable. Disclosure is reasonably detailed, but sharing with the corporate group for model training and the broad legal-request provisions warrant caution.

The documents provide concrete opt-out mechanisms: a toggle to stop model-training use ("Improve the model for everyone"), a stated right to opt out of training/optimization, cookie management, and standard data-subject rights exercised via email. These are explicit and meaningful even if training is on by default.

Against the universal baseline (plus consumer_general COPPA and developer_infra frameworks), the documents claim only a GDPR/UK-GDPR Article 27 representative appointment via Prighter — not a substantive compliance certification. No SOC 2, ISO 27001/27018, NIST, or EU AI Act attestations are named, and there are no third-party audit reports. The reliance on PRC data storage with no recognized security certification is a significant gap for professional use.

DeepSeek references a published "Model Mechanism and Training Methods" / "Model Principles and Training Methods" disclosure to explain its model and generation mechanisms, which is more transparency than many consumer tools offer. However, there is no enterprise audit capability, no logging/audit access for customers, and the disclosure document itself was not supplied for review.

The policy commits to "commercially reasonable" technical, administrative, and physical safeguards and periodic review, and the Terms reference anti-crawling measures and cyber-security efforts. However, no specifics are given (no mention of encryption at rest/in transit, penetration testing, bug bounty, or a trust center), no breach history is disclosed, and the vendor disclaims responsibility for transmission security. The lack of named controls is a transparency gap.

No enterprise agreement was supplied, so no distinct enterprise data-handling posture can be confirmed. The documents reference paid services in the "open platform" and separate developer/API terms where the developer becomes the controller, but no free-vs-paid data distinction is detailed for the chat product. The silence on enterprise carve-outs (e.g., no-training commitments) means paid users cannot assume better treatment.

DeepSeek reserves the right to use technical means to review user behavior for legal and compliance purposes, including risk-filtering and illegal-content databases, and to monitor interactions and usage. The policy does not explicitly state that staff read prompt content, but the review and safety-monitoring provisions imply inputs may be accessed. This is disclosed but broad.

Disputes are governed by PRC law with jurisdiction at DeepSeek's registered office, and the vendor broadly reserves the right to disclose personal data (including IP addresses) to law enforcement, public authorities, courts, and copyright holders. Data is stored in China, which heightens exposure to government data requests under PRC legal process. No current litigation is disclosed, but the combined provisions create material regulatory exposure for sensitive data.

DeepSeek collects a substantial range of PII: account data (email/phone, DOB, password), full user input content and uploaded files/photos/voice, device identifiers, IP address, approximate location, and usage logs. It explicitly states the Services are not intended for sensitive personal data and that it will not extract biometric identifiers from voice/photos, which is a mitigating control. Because free-text prompts and uploaded files can nonetheless contain SPI, and data is stored in China, the collection is significant despite the disclosed controls.

Both documents are very recent relative to the analysis date (Terms last updated March 27, 2026; Privacy Policy Feb 10, 2026) and they substantively address the AI capabilities the product ships, including model training, Inputs/Outputs, search integration, and third-party sign-in. The product surface confirms Google/Apple login and cookie use, which the policy covers. Coverage of current AI capabilities plus sub-12-month recency supports a green rating.

Two documents were supplied — the Terms of Use and the Privacy Policy — and they are consistent with each other on the key issues: both describe Inputs/Outputs, the opt-out from model training, the shared-link/URL feature with the same precautionary language, and the same controller entity. No material or critical contradictions were found between the two documents.