Chinese AI Models: What Happens to the Data You Send Them

Introduction

Chinese models are now part of everyday work: translating, organising specifications, schedules and Dynamo scripts. Engineers encounter Qwen, DeepSeek, Kimi, GLM, MiniMax, ERNIE, Hunyuan and Doubao even without seeking them out, because a router or free plugin may select one.

Asked “Do you use a Chinese model?”, people say either “No, I don’t send anything to China” or “Yes, but price is what counts”. Both answers are too quick.

Think of sending files to a project server. You do not ask whether it is domestic. You sign a data processing agreement, specify the region and know who has access. Language models work the same way, except you never stand there signing anything.

In this article, I show:

• which of eight major Chinese providers have servers outside China and which offer no such choice,
• what their terms say about retention and training on submitted data, with quotations,
• who else serves the same models and how that changes the country where the prompt is located,
• access from Poland and prices in USD and CNY,
• when open weights on your own hardware beat any API,
• what a small design office can send and what requires a separate agreement.

Method note: data comes from provider documentation and price lists checked on 20 October 2026, plus OpenRouter’s public API from that day. I did not measure latency, create accounts or test endpoints: without an account and card, availability cannot be measured reliably. Unconfirmed figures are marked.

Summary in five points

• The question is not whether a model is Chinese, but who serves it and on what terms. The same DeepSeek V4 Pro is served on OpenRouter by 15 operators, mostly based in the USA, while the original DeepSeek provider does not appear in this sample even once.
• A foreign API address does not mean “outside China”. Alibaba has actual regions in Singapore, Virginia and Frankfurt, but DeepSeek offers no choice: its privacy policy explicitly says that personal data is collected, processed and stored in the People’s Republic of China.
• The biggest difference between providers is one sentence in their terms: whether a prompt can be used for training. Alibaba states “never use your data for model training”, Kimi and MiniMax refer to service development with an exception through a separate agreement, while DeepSeek and Z.ai explicitly allow training.
• Jurisdiction matters as much as server geography. DeepSeek is subject to Chinese law, Moonshot to Singapore law with SIAC arbitration, and Z.ai and MiniMax operate as companies from Singapore.
• For a small design office, the answer is not “Chinese or American”, but “send only what is already public, or keep the model on your own premises”. A model with open weights is the only option where nobody receives the prompt.

Table 1: providers, regions and data

Prices in USD per million tokens (input and output), as of 20 October 2026, excluding taxes. “n/a” means that I could not establish this from an official source. I do not put figures from comparison sites in its place.

Provider	Models (2026)	Regions and endpoints	Where the servers are	Retention and training (terms)	Price per 1 million (input and output)	Open weights
Alibaba Qwen (Model Studio)	qwen3.8-max, qwen3.7-plus, qwen3.8-flash, qwen3.8-omni, qwen-image	dashscope-intl (Singapore), dashscope-us (Virginia), Beijing, Hong Kong, Frankfurt (eu-central-1), Tokyo	Actual regions, including outside China	“will never use your data for model training”, but data from calls is stored	2.00 and 6.00 (max); 0.15 and 0.47 (flash)	Yes, Qwen open source section in the price list
Moonshot Kimi	kimi-k3 (1 million context), kimi-k2.7-code, kimi-k2.6	api.moonshot.ai (international, USD)	Singapore	Content may be used to develop and improve services; restriction only through a separate enterprise agreement	n/a	Partially, K3 n/a
DeepSeek	deepseek-flash, deepseek-v4-pro	api.deepseek.com, no region choice	China (PRC)	Training on data is stated explicitly in the policy, including public data; there is a right to opt out	1 and 4 CNY off-peak (flash); 4.5 and 13.5 CNY (pro)	Yes, V3/R1 family
Zhipu Z.ai (GLM)	GLM-5.3, GLM-5.3-Flash, GLM-5.2, GLM-4.7, GLM-4.7-Flash	api.z.ai	Singapore	Processing in Singapore; training on public data declared	1.40 and 4.40 (GLM-5.3); 0.15 and 0.50 (Flash)	Yes, 4.x and 5.x
MiniMax	MiniMax-M3 (512k and more), M3.1-Flash	api.minimax.io (international)	Singapore (Nanonoble Pte. Ltd.)	Input and output may be used to develop services; retention period has no number of days	0.30 and 1.20 (M3 up to 512k); 0.15 and 0.60 (Flash)	Partially, M3 n/a
Baidu ERNIE	ERNIE 5.1, ERNIE 5.0, ERNIE 4.5 Turbo	Qianfan, international site	China (regions outside China n/a)	Terms not read; retention and training n/a	0.56 and 2.53 (5.1, up to 32k)	No
Tencent Hunyuan	Hy4, Hy3, Hunyuan A13B, Hy3D	hunyuan.intl.tencentcloudapi.com, route to nearest region, example in domain: Guangzhou	Region according to routing, example: Guangzhou	Terms and retention n/a	n/a	Partially, scope n/a
ByteDance Doubao (BytePlus)	Seed 2.0 Pro, 2.0 Lite, 2.0 Mini, 2.1 Turbo	ap-southeast-1 (Southeast Asia)	Singapore (BytePlus Pte Ltd)	Provision on training in terms n/a	0.50 and 3.00 (pro, up to 128k); 0.10 and 0.40 (mini)	No, API only

The “n/a” entries are not carelessness. They are gaps that cannot be closed without logging in with a provider or manually going through a document that an automated tool could not read. I would rather show them than enter a figure from a pricing blog that will be wrong next week.

Where the servers really are

This is the point most often overlooked, and it determines everything.

Alibaba is the only one of the eight with specific regions in its documentation. Model Studio has separate addresses for Singapore, Virginia, Beijing and Hong Kong, plus dedicated Frankfurt and Tokyo endpoints. A prompt sent to Frankfurt is handled by a German data centre.

DeepSeek offers no choice: one API address, one privacy policy and an unambiguous sentence: “we directly collect, process and store your Personal Data in People’s Republic of China”. It has no European endpoint or declaration that data is stored elsewhere.

Kimi, Z.ai, MiniMax and BytePlus declare Singapore. Kimi says its servers are there; Z.ai says it generally provides the service and processes personal data there; MiniMax’s operator is Nanonoble Pte. Ltd., at 152 Beach Road; BytePlus lists ap-southeast-1. The servers are outside China, but the parent companies and product decisions are Chinese.

Hunyuan illustrates the trap. Its international address looks innocuous, but documentation says requests go automatically to the nearest server, citing Guangzhou as an example. International address, Chinese region. Without reading that paragraph, you would not know.

A domain prefix proves nothing. Check the documented regions and which one your account uses.

The same model, a different operator

Anyone using a model router may ask: if DeepSeek is on OpenRouter alongside a dozen other operators, are they all in China? No. This is the most interesting part of the story.

On the check date, OpenRouter listed eight models on 148 endpoints served by 48 operators. Its metadata places 31 in the USA, 6 in Singapore (Alibaba, Moonshot AI, Z.AI, MiniMax, SiliconFlow and Seed), 3 in the EU (Mistral in France, Nebius in the Netherlands, Inceptron in Sweden), 2 in China (Baidu and StreamLake), and 1 in Indonesia (DekaLLM); 5 had no value. The models were DeepSeek V4 Pro, DeepSeek V4.1 Flash, GLM-5.3, Kimi K3, MiniMax M3, Qwen3.8 Flash, Qwen3.8 Max and Seed 2.1 Turbo.

The model name tells you who trained it; the operator tells you who sees your prompt. Jurisdiction follows the operator. Send a DeepSeek query through Azure, Cloudflare or DigitalOcean, and the data stays in Microsoft, Cloudflare or DigitalOcean infrastructure, not DeepSeek’s PRC server room. The operator’s terms apply, not DeepSeek’s policy above. Same model, different agreement and country.

For these models, the original DeepSeek provider never appeared on OpenRouter. All 16 DeepSeek V4 Pro endpoints belonged to third parties. Same model, different recipient for the prompt.

Model	Operators on OpenRouter	Input price per 1 million (from and to)	Examples of operators outside China
DeepSeek V4 Pro	15	0.355 to 1.91 USD	Azure, Cloudflare, DigitalOcean, DeepInfra
DeepSeek V4.1 Flash	28	0.028 to 0.60 USD	BaseTen, CoreWeave, DeepInfra, Fireworks
GLM-5.3	37	0.079 to 2.80 USD	BaseTen, Cloudflare, CoreWeave, Crusoe
Kimi K3	20	0.238 to 4.50 USD	Amazon Bedrock, BaseTen, DeepInfra, DigitalOcean
MiniMax M3	13	0.224 to 0.60 USD	CoreWeave, DeepInfra, Novita, ModelRun
Qwen3.8 Flash	1	0.15 USD, single price	none, Alibaba only
Qwen3.8 Max	1	2.00 USD, single price	none, Alibaba only
Seed 2.1 Turbo	1	0.50 USD, single price	none, ByteDance only

Eight models, 148 endpoints, 48 operators. The totals add up because DeepSeek V4 Pro has 16 endpoints across 15 companies, while GLM-5.3 has as many as 48 across 37. The more popular the model, the more hands the prompt passes through.

I could not confirm another point: OpenRouter’s public API gives operators’ headquarters and data centres, but no training or retention flags. Its model pages show a Data Policy label, which OpenRouter says reflects its best knowledge of other providers’ terms, not a definitive source. Without an account, the API cannot tell you who trains on prompts, and the label is no substitute for a data processing agreement. This remains a gap in my data.

Price is the third point. The same model costs 0.355 to 1.91 USD per million input tokens, over five times more at the most expensive endpoint. GLM-5.3 ranges even wider, from 0.079 to 2.80 USD. Differences reflect promotions and compute formats: GLM-5.3 metadata lists 16 fp8 endpoints, 13 fp4, 3 nvfp4 and 16 with no format. A cheaper endpoint may not deliver the same quality, despite the identical name.

OpenRouter is the third link in the chain. It stores no prompts or responses unless you enable input/output logging (off by default, for debugging) or opt into product improvement for a 1 per cent discount (also off by default). It always records request metadata: token count, latency and cost, but no content.

There are also two switches worth setting up on the day you create an account:

• data_collection: “deny” removes from routing operators that store data, while zdr: true narrows the choice to endpoints with zero retention. Both work at the individual request level and as an account setting.
• eu.openrouter.ai routes a request only to endpoints in the EU, EEA, United Kingdom and Switzerland. If there is no endpoint in the region that can serve the model, the API returns an error instead of sending the request outside the region. This option is part of the Business and Enterprise plans, so it is not a default feature of an account costing a few dollars.

Ask an operator four questions before sending project material: where is it based, where are its data centres, does it store prompts, and does it train on them? Headquarters and data centres differ: Alibaba is based in Singapore with centres in Singapore and China; MiniMax and SiliconFlow are based in Singapore with centres in the USA; Inceptron is based in Sweden with centres in Finland. Both answers are needed for the full picture.

I did not check data processing agreements for the 48 operators or measure their latency. Aggregator metadata can start a conversation, but it is not a document for the project file.

What the terms say about retention and training

This is where the real difference between providers begins, because the region is one thing and what happens to the prompt after the answer is another.

Alibaba states explicitly: “Alibaba Cloud strictly protects your data privacy and will never use your data for model training”. This must be read together with the sentence next to it: “Alibaba Cloud Model Studio stores data generated from model and application calls”. No training, but storage remains. The prompt stays on their server in line with local retention obligations, but it does not return as training material.

DeepSeek is at the opposite end. Its policy mentions training on data submitted to the service, and also on public data obtained from the internet: “We may obtain publicly available Personal Data via online sources to train our models”. At the same time, it gives a right to object: “the right to opt-out of using your Personal Data for training our models or optimizing our technologies”. The right to object exists, but it is an option you have to click, not the default setting.

Kimi and MiniMax use almost the same wording: content may be used to “provide, maintain, develop, support, and improve the Services”. Kimi adds a way out: “Customer who requires restrictions on the use of Customer Content for training or improving Moonshot AI models may contact Moonshot AI to discuss available enterprise arrangements or separate written agreements”. So you do not have to agree to training, but you do have to discuss it with the sales team.

Z.ai declares training on public data and lists purposes including “developing, improving, or promoting our Services, such as when we train and improve our models”. A separate sentence describes how it handles user data: “User Content. This includes any text prompts, images, or other data you input. This information is processed in real-time to provide you with the Service”.

Five readable sets of terms lead to one conclusion. The prompt does not disappear after the answer. The difference is whether training is the default, or requires an objection or an agreement, and which country the server is in.

I do not know how this differs for three providers because I could not read their terms to the end: Baidu Qianfan (document linked, content not read), Tencent (documentation only describes routing) and BytePlus (files downloaded, training section not read). I will not invent quotations or summarise from memory.

Access from Poland and prices

Registration is similar across providers: account, card and USD billing. Alibaba uses alibabacloud.com; Kimi uses platform.kimi.ai with prepayment from 1 USD; Z.ai accepts Google or GitHub sign-in; BytePlus offers self-service registration; OpenRouter uses one account and top-up for all models. I did not test registration from Poland without a Chinese phone number: no account, no payment. I mark this gap rather than assume it works.

Prices are in the first table. Compare model classes, not provider names.

Model	Provider	Input and output per 1 million
qwen3.8-flash	Alibaba, Singapore	0.15 and 0.47 USD
GLM-5.3-Flash	Z.ai	0.15 and 0.50 USD
MiniMax-M3.1-Flash	MiniMax	0.15 and 0.60 USD
Seed 2.0 Mini	BytePlus	0.10 and 0.40 USD
ERNIE 4.5 Turbo	Baidu	0.11 and 0.45 USD
GLM-5.3	Z.ai	1.40 and 4.40 USD
qwen3.8-max	Alibaba, Singapore	2.00 and 6.00 USD
deepseek-v4-pro	DeepSeek (CNY)	4.5 and 13.5 CNY

I could not download the official OpenAI and Google price lists on the date I checked: the first returned an access error, the second a redirect loop. I am not giving their rates because I do not have them from a first-hand source. The structural conclusion, which does not depend on a specific figure, is that Chinese flash-class models are in the range of the cheapest Western models, while max- and pro-class models are clearly cheaper than Western flagship models from the same period.

There is another detail that is easy to miss: regional price differences are real. The same Qwen3.8-Max costs 2 and 6 USD in Singapore and 1.65 and 4.951 USD in Beijing. The “Global” version of Qwen3.8-Flash costs 0.113 and 0.382 USD, while in Singapore it costs 0.15 and 0.47 USD. Anyone aiming for the lowest price will probably choose a region in China, while anyone targeting a specific jurisdiction will pay more. Price and region are the same decision, just recorded on two different tabs in the console.

DeepSeek publishes prices in yuan and also has an off-peak rate, which costs less. I am not converting CNY to USD because the exchange rate on the date of the article changes a figure that will become outdated anyway.

When to choose a model with open weights on your own premises

This is the only option where the question of jurisdiction disappears, because the prompt does not leave the office. You only need to check whether your hardware can handle it.

Open weights are no surprise: Alibaba lists Qwen open source models separately, the GLM family is published as open source, and DeepSeek published V3 and R1. But I did not check Hugging Face model cards or licence text for the 2026 versions (Qwen3.8, DeepSeek V4, GLM-5.3, Kimi K3, MiniMax M3). Check these point by point before publication: “open weights” may still mean a licence with commercial restrictions.

The hardware figures below are my calculations, not sourced quotations. Assumption: 4-bit quantisation, around 0.55 GB GPU memory per billion parameters, plus 10 to 20 per cent for context.

Model class	4-bit weight size	Practical hardware
7 to 9 billion parameters	4 to 5 GB	Laptop with 8 GB of GPU memory, works, but slowly with a long context
30 to 32 billion	17 to 19 GB	One 24 GB card or a Mac with 32 GB
70 to 80 billion, dense model	40 to 45 GB	Two 24 GB cards or a Mac with 64 GB
200 to 250 billion, MoE (DeepSeek, Kimi K2, GLM Air)	120 to 150 GB	Server with 4 x 48 GB or 8 x 24 GB; it will not run on one card
600 billion and above, MoE	350 GB and above	Multi-GPU server, beyond the reach of a design office

For a design office, there are two realistic thresholds. First: a 30-billion-parameter model on one 24 GB card, good for summaries, translations and organising specifications. Second: 70 billion on two cards or on a Mac with 64 GB, if you want reasonable quality in Polish. Anything above that is server infrastructure, not a computer on a desk. I described how to start at the cheaper threshold in two articles about LM Studio: LM Studio (part 1) and LM Studio (part 2).

Recommendations for a small office: what you can and cannot send

Let’s start with what you can send to a cloud provider, regardless of its country of origin.

• Public materials: standards and catalogues that are already published, notices, your own articles and posts.
• Text that does not itself identify the client or location: general technical questions, content drafts, translations without proper names.
• Code and configurations, as long as they do not contain API keys or internal addresses.

What you must not send without a data processing agreement and an assessment of the effects of the transfer:

• drawings and IFC models with client data, especially names, addresses and plot numbers,
• cost estimates, offers, contracts and correspondence with the investor,
• personal data in any form, including names in comments in DWG files,
• anything covered by the client’s trade secrets.

Let’s arrange the options from least to most risky.

• A model with open weights on your own hardware, for example 30 billion parameters on a 24 GB card. The prompt does not leave the office. This is the only option that removes the problem rather than merely regulating it.
• A model with open weights at a Western operator, for example DeepSeek or GLM at a provider in the USA or EU, with zdr: true enforced and training disabled. The prompt does not go to China, but it does go to a third party, which must also be entered in the register.
• A Chinese API with a region outside China: Alibaba Frankfurt or Singapore, Z.ai and MiniMax in Singapore. This requires a data processing agreement, an assessment of the transfer and awareness that the parent group is in the PRC.
• A Chinese API with no region choice: DeepSeek. Do not use it for anything containing client data. The terms are unambiguous: data in the PRC, training on by default, Chinese law.

The practical recommendation is short: use option 1 for work with client data, and option 3 or 4 for work with public materials, either one. Use option 2 as a compromise when you lack the hardware or need to use a model with open weights without your own graphics card.

There is one more thing that comes not from any terms, but from experience. Client data most often leaks unintentionally, in passing. An engineer pastes a screenshot from Revit instead of describing the problem, uploads an entire contract instead of the three sentences they need, or gives the project name in a question about a standard. No terms will stop that, because the problem starts at the keyboard, not on the server. A rule that works in practice: make the question to the model general enough that it could be published on an industry forum without harming the client.

If you run a small company and want to keep project knowledge on your own premises, the subject will return in the next two articles: one about a knowledge base without the cloud, and one about a local model router that lets you switch providers with a single key.

Summary

The question about Chinese AI models in engineering is not politics or answer quality. Test quality on your own tasks; differences within the same price class fade after two weeks. The real question is what happens to the ten sentences you sent at 9:15 for someone else to summarise a specification.

The documentation shows two extremes. Alibaba offers regions outside China and declares no training; DeepSeek offers no choice, trains by default and is governed by Chinese law. Kimi, Z.ai, MiniMax and BytePlus place servers in Singapore, but training on content is default or requires a separate agreement. Baidu, Tencent and BytePlus have gaps to resolve before deployment.

The operator is another layer hidden by the model name. The same DeepSeek at an American provider means a different agreement, law and country. Safest order: open weights on your own premises for client data; open weights at a Western operator with zero retention for sensitive work; any API for public material.

Sources (checked 20 October 2026)

All numbers and quotes come from the providers’ official documentation and from the public OpenRouter API. Price comparison sites were not the basis of any claim.

• Alibaba Cloud Model Studio: https://www.alibabacloud.com/help/en/model-studio/base-url , https://www.alibabacloud.com/help/en/model-studio/billing-for-model-studio , https://www.alibabacloud.com/help/en/model-studio/privacy-notice
• Alibaba Cloud product terms: https://www.alibabacloud.com/help/en/legal/latest/alibaba-cloud-international-website-product-terms-of-service-v-3-8-0
• Moonshot AI: https://platform.kimi.ai/docs/models , https://platform.kimi.ai/docs/agreement/userprivacy , https://platform.kimi.ai/docs/agreement/modeluse
• DeepSeek: https://api-docs.deepseek.com/ , https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html , https://cdn.deepseek.com/policies/en-US/deepseek-open-platform-terms-of-service.html , https://api-docs.deepseek.com/zh-cn/quick_start/pricing
• Z.ai: https://docs.z.ai/guides/overview/pricing , https://docs.z.ai/legal-agreement/privacy-policy
• MiniMax: https://platform.minimax.io/docs/pricing/overview , https://platform.minimax.io/docs/guides/privacy-policy , https://platform.minimax.io/docs/guides/terms-of-service
• Baidu AI Cloud, Qianfan: https://intl.cloud.baidu.com/en/doc/qianfan/s/Jm8r1826a-intl-en
• Tencent Cloud International: https://intl.cloud.tencent.com/document/product/1284?lang=en , https://intl.cloud.tencent.com/document/product/1284/75533
• BytePlus: https://ai.byteplus.com/ark/region:ap-southeast-1/docs/model-pricing , https://docs.byteplus.com/en/docs/legal/docs-terms-of-service , https://docs.byteplus.com/en/docs/legal/docs-privacy-policy
• OpenRouter: https://openrouter.ai/api/v1/providers (operator headquarters and data centres), https://openrouter.ai/docs/guides/privacy/data-collection , https://openrouter.ai/docs/guides/privacy/provider-logging , https://openrouter.ai/docs/guides/routing/provider-selection , https://openrouter.ai/docs/guides/features/in-region-routing

What could not be confirmed

For the sake of honesty, so nobody has to discover this after the fact:

• Kimi prices (the table is rendered client-side) and Tencent Hunyuan prices in USD,
• Baidu Qianfan and BytePlus terms on retention and training, as well as weight licences for the 2026 versions,
• specific retention periods at MiniMax and Z.ai (both agreements say “retention period” without a number of days),
• data processing agreements at OpenRouter operators, training and retention flags in its public API, and latency from Poland to Singapore, Frankfurt and the USA,
• the possibility of registering from Poland without a Chinese phone number, and OpenAI and Google prices for the same period.

Check also:

• Chinese AI Models: What Happens to the Data You Send Them
• Many Mailboxes in One System: Thunderbird and AI
• What Computer for Revit and BIM in 2026: CPU, GPU, RAM and SSD
• Unstructured Data in Construction: Emails, Notes and PDFs
• Nozbe from Scratch: Priorities, Projects and Weekly Review

This article was created with the help of artificial intelligence.