DeepSeek – Is your Data Safe? Everything You Need to Know
In my previous article we examined how ChatGPT, Perplexity and Claude uses your data (AI data use). We also mentioned the potential risks of sharing confidential or proprietary information – and how to avoid these risks. It is clear that not all tools offer the same safeguards regarding data privacy, security, and legal protections. We will therefore continue comparing AI models. This week a focus on the AI model DeepSeek. See below our Article ‘DeepSeek – Is your Data Safe? Everything You Need to Know’.
DeepSeek was unknown to most people outside of the People’s Republic of China (“PRC“) until this week. In the course of one week it has however gained immensely in popularity. It is yet another AI-driven platform, but there are important differences with the other well-known AI models. DeepSeek is currently challenging AI models like ChatGPT and Gemini in capabilities unexpected until yesterday. In this article, we will explore DeepSeek’s Privacy Policy & Terms of Use. We will also handle issues such as personal data storage, AI model training and jurisdiction. If you’re wondering whether you can safely use DeepSeek for personal or professional tasks, read on to discover the key facts, risks and best practices.
This article has been written at the start of the broad use of DeepSeek. It is therefore work in progress, based on first information gathered.
What We’ll Cover
- DeepSeek Overview: Short explanation of the platform and why are people interested in it.
- Privacy Policy Highlights: Including details on storing personal data, especially full names and addresses.
- Location of Data: How and why user data may end up on servers in the People’s Republic of China.
- Terms of Use: Whether DeepSeek incorporates your content into training its AI models—and what that means for you.
- Data Privacy in China: The local regulatory environment and how it differs from GDPR or CCPA.
- Confidentiality: Potential risks if you’re handling sensitive or proprietary information.
- Final Advice: How to proceed if you’re considering using DeepSeek, plus some general cautionary steps.
1. DeepSeek Explained
New AI Model
DeepSeek is a cutting-edge large language model (LLM) similar to ChatGPT and Gemini. It is developed by a Chinese AI company with the full name ‘Hangzhou DeepSeek Artificial Intelligence Co., Ltd., and Beijing DeepSeek Artificial Intelligence Co., Ltd.’. It is designed to tackle a range of complex tasks with impressive efficiency according the latest tests. According to Google Gemini its powerful AI shines in several key areas:
- Math Whiz: DeepSeek excels at mathematical reasoning and problem-solving, often outperforming other models.
- Logic Master: DeepSeek handles complex, multi-step logical reasoning with ease.
- Code Conjurer: DeepSeek understands and generates code in various programming languages, making it a valuable tool for developers.
- Conversation Starter: DeepSeek is a natural language expert, capable of engaging in coherent and contextually relevant conversations.
- Global Communicator: DeepSeek is trained on diverse linguistic data, offering some level of multilingual support.
Consequences Stock Market
On 26 January 2025 there was even a big shake up in the stock market due to Deep Seek. US stocks plummeted as traders fled the tech sector and erased more than $1 trillion in market cap amid panic over the introduction of DeepSeek. The S&P 500 nearly 1.5% lower, while the tech-heavy Nasdaq Composite had shed more 3% by the end of the day. DeepSeek roiled stock futures after the AI model was said to outperform OpenAI’s ChatGPT in several tests. The losses gathered momentum after DeepSeek became the most downloaded app on Apple’s App Store in the US on 26 January.
Source: Business insider.
A Growing Global Market
As AI popularity expands worldwide, companies outside the U.S. and Europe (especially China) are developing their own solutions. DeepSeek is notable because it may offer high-speed performance and robust Chinese language capabilities. This makes it attractive to users with specialized language needs. However, these benefits come with a different legal framework, which can pose challenges for those used to Western data protection standards.
It has also been reported that DeepSeek is able to offer similar services and results as ChatGPT, Gemini, etc. for a fraction of the cost. This has greatly fueled popularity of the new AI model.
2. DeepSeek’s Privacy Policy: Personal Data Collection
Amongst others, according to a review of DeepSeek’s publicly accessible Privacy Policy, the platform collects a wide range of personal information. Qoute: “When you create an account, input content, contact us directly, or otherwise use the Services, you may provide some or all of the following information:
- Information When You Contact Us. When you contact us, we collect the information you send us, such as proof of identity or age, feedback or inquiries about your use of the Service or information about possible violations of our Terms of Service (our “Terms”) or other policies.
- Profile information. We collect information that you provide when you set up an account, such as your date of birth (where applicable), username, email address and/or telephone number, and password.
- User Input. When you use our Services, we may collect your text or audio input, prompt, uploaded files, feedback, chat history, or other content that you provide to our model and Services.
Additionally DeepSeek stores (i) Automatically Collected Information like technical information, usage information, cookies, payment information and (ii) information from other sources like login, signup or linked information.
Where Is Information Stored
DeepSeek explicitly states:
“The personal information we collect from you may be stored on a server located outside of the country where you live. We store the information we collect in secure servers located in the People’s Republic of China.
Where we transfer any personal information out of the country where you live, including for one or more of the purposes as set out in this Policy, we will do so in accordance with the requirements of applicable data protection laws.”
For many users – especially those in countries with stringent privacy regulations – this is significant. Your legal recourse to access, delete or restrict your data might be limited once it’s hosted on servers in the PRC.
How Is This Data Stored and Processed?
While the Privacy Policy mentions “secure servers,” it is not clear how they deal with specific practices such as:
- Encryption: Are your data and prompts encrypted at rest or in transit?
- Third-Party Sharing: How widely is your data shared for analytics or collaboration?
- Data Deletion: What happens if you decide to close your account or remove certain information?
- Data Security: How are the servers protected against e.g. cyberattacks.
If you’re accustomed to GDPR (EU Data Privacy Regulation) or CCPA (California Data Privacy Regulation), you may be disappointed by the lack of clearly defined user rights (like the right to be forgotten or the right to data portability). It remains to be seen how these matters are covered by DeepSeek. Especially from a regulatory point of view – data privacy, data security and now also AI (see the EU AI Act).
There are many more aspects that are very interesting in the DeepSeek Privacy Policy, but for the purposes of this article this would be too much information to touch on all aspects.
3. DeepSeek’s Terms of Use: Model Training & Governing Law
DeepSeek’s Terms of Use do mention that the AI model will only use your Inputs in specific cases. It is however not exactly clear how broad this should be read. See part below in blue. The terms also offer a way for its customers to inform DeepSeek that they refuse DeepSeek to allow to use their Input data.
Potential Risks for Confidential Information
When adding client documents, proprietary research, or any private data as always be mindful. As far as we are aware at this moment:
- No Guarantee of Confidentiality: There is no explicit promise to keep sensitive data confidential.
- Future AI Outputs: The model might inadvertently reveal or be influenced by your confidential info.
- Irreversible Submission: As DeepSeek’s Terms of Use do not mention how long DeepSeek will store your data, this will allow indefinite use of your data.
- Unclear use of Input: it is not exactly clear how and in which cases your Inputs will be used to create Outputs or to train the model. It is likely and we should assume that DeepSeek uses your Input to train their AI model.
Governing Law and Jurisdiction
Next, let’s review the terms regarding governing law and jurisdiction, meaning the laws that govern the use of DeepSeek and where you will need to go to court in case of litigation with DeepSeek. DeepSeek clarifies this as follows in the Terms of Use:
9. Governing Law and Jurisdiction
9.1 The establishment, execution, interpretation, and resolution of disputes under these Terms shall be governed by the laws of the People’s Republic of China in the mainland.
9.2 If negotiation fails in resolving disputes, either Party may file a lawsuit with a court having jurisdiction over the location of Hangzhou DeepSeek Artificial Intelligence Co., Ltd.
This means:
- The laws of the People’s Republic of China govern all legal disputes.
- Chinese courts in Hangzhou, PRC, will handle any lawsuits.
- Even though it is stated in the terms that DeepSeek will comply with applicable laws, research still needs to be done whether they will comply with GDPR, CCPA or other foreign regulations.
4. Data Privacy in China
In the EU and US there have been large initiatives since 2018 with respect to extensive legislation relating to the protection of data privacy and data security. In the coming years there will even be more regulations in connection hereto. See our article ‘Six New EU Regulations – like the AI Act – Explained‘.
Regulatory Differences
While China has its Personal Information Protection Law (PIPL), it doesn’t mirror the scope or depth of frameworks like GDPR or CCPA or the other regulations mentioned above – as far as we are aware but we are not lawyers or legal advisors versed in PRC laws.
Implications for International Users
If you reside outside China:
- Limited Recourse: You might find it harder to challenge data privacy & security issues in a Chinese court.
- Compliance Gaps: The data privacy and data security protections you are used to under EU or U.S. law may not apply here.
- Cross-Border Transfers: Even if the Privacy Policy mentions meeting local regulations, these could be PRC regulations that differ significantly from your home country’s standards.
5. Which Data Not to Share in AI Models
As we stated in our article with respect ChatGPT, Gemini and Perplexity, apply common sense and caution when adding data to any online AI model. This could be different for local models – depending on the security measures taken by the AI model.
Avoid sharing for example:
- Confidential details (client, business or family member names, private letters, contracts & strategies).
- Personally identifiable information (PII) (addresses, phone numbers, medical records).
- Proprietary or business-critical data (unreleased products, prices, financials).
- Sensitive materials (health info, internal memos, or business & personal).
- Data protected by Applicable Law (copyright, illegal data, government data).
If you must work with potentially sensitive text, we recommend considering the following:
- anonymizing the data first,
- using an enterprise-level AI solution where the Terms of Use prohibit using your content for model training. This doe not seem to be possible for DeepSeek, or
- an ‘on-premise’ AI model that anonymizes data.
6. Bringing It All Together
DeepSeek represents an interesting expansion of the AI landscape, especially for those who require strong Chinese language capabilities or want to explore AI solutions outside typical Western providers. However, its legal environment, data storage location, and governing jurisdiction all point to a platform that may not uphold the same privacy or confidentiality standards you’d expect under GDPR or CCPA.
This doesn’t mean DeepSeek is without merit. You should approach it with open eyes and informed caution. If you have critical confidentiality needs or work in a heavily regulated sector, it is wise to look elsewhere or secure a specialized enterprise agreement that explicitly addresses data protection concerns. For casual or non-sensitive uses, DeepSeek could be a helpful AI resource. As always, be mindful of what you submit and how it could be stored and potentially accessed under Chinese law.
7. Final Thoughts
AI is transforming the way we work – but it’s also transforming how data can move beyond our control. It is advised to think twice before you add content to any AI (LLM) Tool and actively keep track of how your content is used by any AI tool.
As always, we need to stay informed, be cautious and be proactive. That way, you can use the power of AI without compromising your most sensitive information. Keep an eye out for our upcoming in-depth articles on other AI models. We will also cover AI policies that can guide you and your team toward ethical and secure usage of these exciting new technologies.
Disclaimer: This article is a research project, provides general information about AI data usage and does not constitute legal advice.
If you have any further questions about the above, contact me via lowa@amstlegal.com or set up a meeting directly here .
Ultimate Guide how ChatGPT, Perplexity and Claude use Your Data
AI Data use is at an all-time high and data privacy & confidentiality is incredibly important when using AI models. Before you add text or documents to AI Models, read below how and when these platforms might use your content. We also list what content to avoid adding to the models and why AI Policies can be incredibly helpful.
Recently, I had a discussion with a lawyer who shared full client documents, including detailed confidential information, with an AI tool. He was completely unaware that the data we feed into AI systems can be used by the model. That conversation made me realize something important: Not everyone knows how large language models (LLMs) like ChatGPT, Claude and Perplexity actually handle the content we provide.
This is why I wrote this article “Ultimate Guide how ChatGPT, Perplexity and Claude use Your Data”, showing when ChatGPT, Perplexity and Claude uses (or does not use) Your Data.
What we will cover:
- Why businesses, law firms, and other organizations need comprehensive AI policies
- How free and paid versions of ChatGPT differ
- How Claude and Perplexity compare in terms of data handling
- Why you should never share private or proprietary content
The below is an ongoing research project, comparing AI models. Please do not treat the below as legal advice. Always verify current policies to ensure compliance with your (organization’s) requirements – carefully review relevant documentation to understand if and how they might use your input to refine their algorithms.
2. What Are AI Models Learning From? Our Data!
It’s common knowledge that AI models, including ChatGPT, Claude, and Perplexity, are initially trained on large datasets (e.g., internet text, books, articles). However, many people don’t realize that these models can also learn from the additional content we submit. This includes for example when we’re asking them to:
- Analyze or summarize data (e.g., uploading sections of a contract)
- Write or edit an article (e.g., pasting confidential notes)
- Generate ideas or code (e.g., providing business-critical snippets)
Whenever you input text into these systems, it may be used – depending on the model and the plan you’re on – to further refine or train the AI. In this article, we’ll dig deeper into how various well-known models handle (or don’t handle) your content, so you can make more informed decisions when you’re working with sensitive data.
3. ChatGPT: Paid vs. Non-Paid Tiers
ChatGPT is currently the most widely used AI model – focusing on Chatbots / Generative AI. It is important to understand the difference between the paid and free models of OpenAI when focusing on data privacy, confidentiality and to answer the question whether Open AI uses your data to train their model.
ChatGPT (Free)
- Data Usage: Under the free model, OpenAI may use the content you provide to further train or refine the model. This means if you share potentially sensitive information, it could (in theory) be included in the AI’s training data. See the Terms of Use for OpenAI (Free) on this point – I add the relevant part relating to whether it will be able to use your Input in the image below.
- Key Takeaway: Be mindful of what you enter into the model. If it’s something you wouldn’t want to become part of the broader AI model or if it’s private, proprietary or personal, do not include it in your prompts. Also remember that it can be against the law to add certain content.
ChatGPT (Paid: Enterprise, API, and Other Business Solutions)
- Greater Privacy: According to OpenAI’s Enterprise Terms of Use, customer content is not used to develop or improve the service. See the Business Terms for OpenAI (Paid) on this point. See image below – I add the relevant part whether it will be able to use your data.
- Stronger Security: Enterprise clients typically get enhanced security measures, better data handling policies, and the option to opt out of data usage altogether.
- Who Should Consider This: Those handling confidential documents, proprietary business processes, or sensitive client data. Lawyers, for instance, might prefer the enterprise offering if they frequently need to process large volumes of privileged information. However, we should note that it is not certain that this Input & Content is secure. Currently, until further notice we would still advice everyone – especially lawyers, doctors, government employees and other that have access to sensitive information not to add such information in the AI models.
- Opt-out: If you do not want your data contributing to AI model improvements, go to the following link to opt-out: https://lnkd.in/dVPcMfH8
4. Comparing Other AI Models: Claude and Perplexity
Next to ChatGPT there are many other AI models that are used. As we will handle Gemini next time, we will go into the details on Claude and Perplexity in this Article.
Claude (by Anthropic)
- Focus on Safety: Claude is well-known for its emphasis on AI safety and ethical guidelines. However, terms regarding data usage can still allow the model to analyze or store user inputs for system improvement unless otherwise specified. See the Consumer Terms of Service of Claude on this point. See image below – I add the relevant part whether it will be able to use your data.
- Paid Services: Anthropic offers enterprise solutions as well, which comes with a separate set of Commercial Terms containing stricter confidentiality and privacy protections. They have also added the following text in the Commercial Terms of Service: “Anthropic may not train models on Customer Content from paid Services“. Always check the most recent Terms of Service for precise details.
Perplexity
- Research-Oriented: Perplexity is built around providing concise, sourced answers. It has been explained to me as more the “Google” way of searching in AI models. It has been said that Perplexity may not store or use data exactly like ChatGPT. However, the Terms of Service seem to indicate that Perplexity will use your Content – amongst others – for training purposes. See relevant part of Art. 6.4 (b) here: “Accordingly, by using the Service and uploading Your Content, you grant us a license to access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify Your Content to operate, improve, promote and provide the Services, including to reproduce, transmit, display, publish and distribute Output based on your Input. “ See image below – I add the relevant part whether it will be able to use your data.
- Enterprise Terms of Service: See these specific terms here. Enterprise customers do provide a license to Perplexity regarding their content. However, the following important wording is added: “Notwithstanding the foregoing, Perplexity does not and will not use Customer Content to train, retrain or improve Perplexity’s foundation models that generate Output.”
5. What Not to Upload to AI Tools
Whether you’re using ChatGPT, Claude, Perplexity, or any other AI platform, apply common sense and caution. Avoid sharing for example:
- Confidential details (client, business or family member names, private letters, contracts & strategies).
- Personally identifiable information (PII) (addresses, phone numbers, medical records).
- Proprietary or business-critical data (unreleased products, prices, financials).
- Sensitive materials (health info, internal memos, or business & personal).
- Data protected by Applicable Law (copyright, illegal data, government data).
If you must work with potentially sensitive text, consider (a) anonymizing the data first, (b) using an enterprise-level AI solution where the Terms of Use prohibit using your content for model training or (ii) an ‘on-premise’ AI model that anonymizes data.
6. Why Organizations Need AI Policies
Many organizations still lack formal guidelines for using AI tools, leaving employees to guess what’s permissible. It is our understanding – and our worry also – that most employees don’t even realize or understand which data they should or should not add to the AI models. This is why we advocate for the wide use and deployment of AI Policies in companies.
Here’s why AI policies matter:
- Education & Awareness: Ensures everyone in your organization understands the risks and best practices when interacting with AI.
- Risk Management: A solid policy helps prevent data leaks and breaches of confidentiality.
- Compliance: Aligns your company or legal practice with industry regulations and local laws—a must for highly regulated sectors.
- Consistency: Establish uniform standards so that everyone, from interns to senior partners, uses AI responsibly and avoids costly mistakes.
Stay tuned: We’ll be writing a longer article soon detailing the key components of an effective AI policy, with real-world examples to guide your organization’s strategy.
7. Real-World AI Policy Examples
There has been a lot of discussion on whether it should be forbidden to use AI models for work – in some countries it is even forbidden for everyone. I believe that this is the wrong way of dealing with this technology that we will not be able to stop. We should embrace AI technology but be very mindful how to use it. See below two examples of courts and lawyer organizations that believe you should not ban AI, but embrace it with correct guardrails.
Florida Bar’s AI Policy
The Florida Bar issued Ethics Opinion 24-1 on January 19, 2024, providing guidance on the use of generative AI by Florida attorneys (source link: 16).
Key points include (source: 1) :
- Lawyers may use generative AI in their practice, but must:
- Protect client confidentiality
- Provide accurate and competent services
- Avoid improper billing practices
- Comply with lawyer advertising restrictions
- Attorneys must research AI programs’ policies on data retention, data sharing, and self-learning to maintain client confidentiality
- Lawyers are responsible for their work product and must verify that AI use aligns with ethical obligations.
- Informed client consent is recommended when using third-party AI programs that involve disclosure of confidential information.
Delaware Supreme Court’s AI Policy
The Delaware Supreme Court adopted an interim policy on October 21, 2024, governing the use of generative AI by judicial officers and court personnel (see full text here: 7). Key aspects (source: 11) include:
- The policy allows the use of approved generative AI tools by judicial branch officers, employees, law clerks, interns, externs, and volunteers.
- Users of AI remain responsible for the output and must ensure accuracy.
- Training on AI capabilities and limitations is required before use.
- AI should not influence judicial decisions or replace human judgment.
- AI use must comply with existing laws and judicial branch policies.
- Only approved AI tools are permitted on state technology resources.
Both policies aim to balance the benefits of AI in legal practice with ethical considerations and safeguards to protect client interests and maintain the integrity of the legal system. More and more courses are being offered for lawyers & judges explaining the risks and how to avoid them.
The above examples contains external information gathered from Perplexity – mentioning all sources used for the information shared. We have not verified the AI policies or the (latest information relating thereto) in detail at this moment.
8. Embrace AI—Responsibly
From streamlining legal tasks, writing articles to supporting creative brainstorming, generative AI offers enormous advantages. However, that conversation with the lawyer who unknowingly uploaded full client files to a free-tier AI tool reminds us that we to improve our understanding how AI models handle our data.
- Read the Terms: Familiarize yourself with the data usage policies of each AI platform you use.
- Choose Wisely: If data sensitivity is high, consider enterprise solutions or what we at this time advise most legal professionals: do not share sensitive data.
- Use Caution: Always think twice before uploading potentially sensitive content.
- Establish AI Policies: Protect your organization, employees, and clients by setting clear, enforceable guidelines.
Final Thoughts
AI is transforming the way we work – but it’s also transforming how data can move beyond our control. Actively keep track of how your content is used, whether you’re on the free or paid version of ChatGPT, Claude or Perplexity
The lesson? We need to stay informed, be cautious and be proactive. That way, you can use the power of AI without compromising your most sensitive information. Keep an eye out for our upcoming in-depth article on building AI policies that can guide you and your team toward ethical and secure usage of these exciting new technologies.
Disclaimer: This article is a research project, provides general information about AI data usage and does not constitute legal advice.
I wrote this article further to my post on LinkedIn on this subject. If you have any further questions about the above, contact me via lowa@amstlegal.com or set up a meeting directly here .