The data is sent to a relay server, which then sends it on to Deepl/Claude.
There are quite a few layers of privacy:
1. Websites on the blacklist (e.g. banking sites), or with certain terms in the URL (e.g. "account"), are blacklisted
2. Websites can be blacklisted by the user
3. Sentences are checked for sensitive language, and filtered for banking info/emails/credentials/etc
4. The words in a sentence must be over a certain proportion (80% iirc) of known English words
5. Once the sentences are sent to the server, the server doesn't log who-sent-what, and the upstream translation services don't know either (because it all comes from the relay).
Translations are cached, though. It's a necessity in order for it to be even remotely economical to do so much translation.