What is DeepSeek's policy on data retention?

DeepSeek’s data retention policy is designed to balance operational needs with user privacy and legal compliance. The company retains user data only as long as necessary to fulfill the purposes for which it was collected, such as providing services, improving models, or meeting legal obligations. For example, logs of API interactions or user queries might be stored temporarily to debug issues or analyze performance. After the retention period expires, data is either anonymized or securely deleted. Exceptions apply when legal requirements mandate longer storage, such as preserving records for regulatory audits or law enforcement requests.

Specific retention periods vary by data type. User-provided inputs, like prompts or uploaded files, are typically retained for 30 days unless tied to an active project or subscription. System logs, which include metadata like timestamps and API keys, might be kept for 90 days to monitor service health or investigate outages. For instance, if a developer reports a bug in the API response time, DeepSeek might review recent logs to identify patterns. Data stored in backups follows a separate schedule—such as 180 days—to ensure disaster recovery without indefinite retention. All data is encrypted at rest and in transit, and access is restricted to authorized personnel.

Developers have control over their data through account settings and API tools. Users can request early deletion of specific datasets or export their activity history via self-service portals. For example, a team managing a project with sensitive data could use DeepSeek’s API to programmatically delete all associated records after a sprint concludes. The company also enforces data minimization, avoiding unnecessary collection—like excluding personally identifiable information (PII) from telemetry by default. Audit logs track internal data access, and third-party vendors handling data must comply with DeepSeek’s retention standards. This approach ensures compliance with regulations like GDPR and CCPA while maintaining transparency for technical users.