Privacy Policy

Privacy Policy

This policy explains what information OAIRoute collects, how we use and protect it, and what rights you have over your personal data.

Effective: 22 October 2026 Last updated: 22 October 2026 Version v2.0

01Scope of this policy

This Privacy Policy (the "Policy") applies to our processing of personal information when you visit the OAIRoute website, register an account, call the API or use any related service.

The Policy forms part of the Terms of Service. Where the two conflict on personal data matters, this Policy prevails.

In one sentence
We collect only what is needed to run the Service. Prompt content is not persisted, never used to train models, and never sold to third parties.

02Information we collect

2.1 Information you provide

  • Account data: email address, username, password (stored as a one-way hash), registration and sign-in times;
  • Correspondence: content you provide when contacting us by email or Telegram;
  • Business details: company name and supporting documents provided for invoicing or partnerships.

2.2 Information generated by use

  • Billing and transactions: top-up amounts, balance changes, usage records, refund history;
  • Request metadata: timestamp, model, input and output token counts, status code, latency, retry count;
  • Key data: key name, permission scope, creation time, last-used time.

2.3 Technical information collected automatically

  • IP address, browser type and version, operating system, device type;
  • access time, pages viewed, referring URL;
  • cookies and local-storage identifiers used to distinguish sessions.
Important
Do not submit ID numbers, card numbers, medical records or other sensitive personal data as prompt input. If your business requires processing such data, complete your own compliance assessment and apply de-identification first.

03How we use information

We use your information only for the following purposes:

  • Providing the Service: authenticating you, routing requests, forwarding to upstream models and returning results;
  • Billing: measuring usage, generating invoices, processing top-ups and refunds;
  • Security: detecting abnormal calls, preventing key theft and fraud, handling abuse;
  • Improvement: analysing latency and success rates, diagnosing faults and tuning routing (on aggregated data, without prompt content);
  • Communication: service changes, security notices, billing alerts and support replies;
  • Legal obligations: complying with laws and lawful requests from courts or regulators.

We do not use your information for targeted advertising, and we do not send you marketing based on your prompt content.

04Sharing and disclosure

4.1 Necessary upstream forwarding

To perform inference, your request is forwarded to the upstream provider behind the model you chose (for example Anthropic, OpenAI, Google or DeepSeek). This processing is essential to the Service; each provider applies its own privacy policy to the data it receives.

4.2 Service providers

We may engage third parties for payment processing, email delivery and cloud infrastructure. They access data only to the extent needed for their function and are bound by confidentiality.

4.3 Legal disclosure

We may disclose necessary information when:

  • you have given explicit consent;
  • required to comply with law or a lawful request from a court or regulator;
  • necessary to protect the safety or property of us, our users or the public;
  • in a merger, acquisition or asset transfer, as part of the transferred assets (under equivalent protection).

We do not sell or rent your personal information.

05How prompt content is handled

This is the question users care about most, so we address it separately:

  • your input and the model output pass through the gateway in memory only and are not written to persistent storage;
  • logs record metadata (timestamp, model, token counts, status code), not conversation text;
  • prompt content is never used to train any model and never used to build user profiles;
  • only where you explicitly agree, and only to diagnose a specific fault, may we temporarily inspect the content of a single request, deleting it immediately afterwards.
Note
Whether an upstream provider retains request content depends on its own policy. For highly sensitive data, review the relevant provider's privacy terms before calling.

06Retention periods

  • Request metadata: 30 days by default for billing reconciliation and troubleshooting, then deleted automatically;
  • Billing and top-up records: retained as required by financial and tax rules, typically at least 5 years;
  • Account information: retained while the account is active; after closure, kept only for the minimum legal period, then deleted or anonymised;
  • Security logs: sign-in and risk-control records kept for 90 days.

Once the retention period ends, the information is deleted, anonymised or aggregated so that it can no longer be linked to you.

07Security measures

We apply reasonable technical and organisational measures to protect your information:

  • transport encryption (HTTPS/TLS) to prevent interception in transit;
  • passwords and API keys stored encrypted or as one-way hashes, never in plaintext;
  • internal access control on a least-privilege basis, with access auditing;
  • monitoring and alerting for abnormal sign-ins and unusual calls;
  • periodic review and updating of security practices.

No system can be absolutely secure. If a data security incident occurs, we will notify you as required by law and explain its impact and our response.

Your responsibility
Keep your API keys safe and never commit them to public repositories. If a key leaks, revoke it in the console and contact us immediately.

08Your rights

You have the following rights over your personal information:

  • Access: view your account details, usage records and invoices;
  • Correction: fix inaccurate or incomplete account information;
  • Deletion: request deletion after account closure (except where law requires retention);
  • Export: obtain a copy of your billing and usage data;
  • Withdraw consent: withdraw consent for consent-based processing at any time, without affecting prior processing;
  • Account closure: after settling fees and handling any remaining balance.

To exercise these rights, email support@oairoute.com. We respond within 15 business days and may ask you to verify your identity to protect the account.

09Cookies and local storage

We use cookies and browser local storage for these essential functions:

  • Session: recognising signed-in users and avoiding repeated verification;
  • Preferences: remembering your theme (light/dark) and language;
  • Security: identifying abnormal requests and preventing cross-site request forgery.

This data lives in your browser and can be cleared at any time through your browser settings, though you will need to sign in again afterwards.

We do not use third-party advertising cookies for cross-site tracking or profiling.

10Third-party services

The Service relies on third parties of the following kinds: upstream model providers, payment processors, cloud infrastructure and monitoring services. We share data with them only as necessary and require equivalent confidentiality and security obligations.

This website may link to third-party sites. Their information handling is their own responsibility; review their privacy policies before visiting.

11Children

The Service is intended for users with full legal capacity and is not directed at anyone under 18. If you are under 18, use it only with the consent and guidance of a guardian, who bears responsibility.

If we learn that we have collected information from a minor without guardian consent, we will delete it promptly.

12International transfers

Because upstream providers may be located in other countries or regions, your request content may be transferred internationally during forwarding. We select providers with appropriate compliance credentials and apply contractual protections where necessary.

If your business is subject to cross-border data transfer rules, complete the relevant assessment before use.

13Policy updates

We may update this Policy due to legal or business changes. Material changes will be announced in advance through the site, email or our Telegram channel, and the effective date and version number at the top will be updated.

A revised Policy takes effect when published. If you disagree with the changes, stop using the Service and request account closure.