Depends on how you're running them I suppose. If you are running them on local hardware, then the harness is what you are concerned about. A compromised local model might be able to exfiltrate data via tool calls.

If you are running it in a cloud, the above is true, but also you have to trust the cloud provider isn't relaying your chats to a third party, for training or perusing.

If I am totally blunt, if privacy is a concern then corporate US has proven time and time again to be a terrible steward of your private data. You should assume it's being ingested or sold, or turned into metadata that's sold in a data laundering pipeline.

If it's corporate secrets, on-prem and enterprise offerings are your options. Enterprise at least puts the providers on the hook legally, when they inevitably fuck up keeping your data private in some way.

There are zero-retention 3rd party providers (EU/US companies), but it's your choice whether to trust their claims or not.

I worry about the US models sending my data back to Israel.