Privacy Policy

1. Information we collect

• Account data — name, email address, and authentication credentials (stored only as secure hashes) when you register or sign in.
• Billing data — top-up amounts, transaction status, and payment references. Full payment instrument details are handled by our payment partners (e.g. QRIS / Toopay) and never touch our servers.
• Usage data — API request metadata such as model, token counts, latency, status codes, timestamps, and the API key used. This powers your dashboard, quotas, and billing.
• Request content — prompts and completions transit our infrastructure to reach Upstream Providers. We do not use your prompts or outputs to train models.
• Technical data — IP address, browser/device information, and cookies required for sessions and security.

2. How we use information

• Operate the Service: routing requests, enforcing quotas and rate limits, metering usage, and processing payments.
• Secure the platform: fraud and abuse detection, audit logs, and incident response.
• Communicate with you about your account, transactions, and material service changes.
• Improve reliability and performance using aggregated, de-identified statistics.

3. When we share information

• Upstream Providers — your prompts and generation parameters are forwarded to the model provider serving your request, subject to that provider's own data policies.
• Payment partners — the data necessary to create and confirm your payment.
• Infrastructure vendors — hosting, database, and cache providers that process data on our behalf under contractual safeguards.
• Legal — where disclosure is required by law, regulation, or valid legal process, or to protect the rights and safety of Rerouter, our users, or the public.

We do not sell your personal information.

4. Retention

Account and billing records are kept while your account is active and as required for tax and legal obligations. API usage metadata is retained for operating and audit purposes, then deleted or aggregated. You may request deletion of your account at any time; residual copies in backups are purged on their normal rotation.

5. Security

We apply industry-standard measures including TLS in transit, hashed credentials, scoped API keys, and access controls. No method of transmission or storage is 100% secure — please keep your API keys confidential and rotate them if you suspect exposure.

6. Cookies & sessions

We use strictly necessary cookies for authentication sessions and security. We do not use third-party advertising trackers.

7. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact privacy@rerouter.dev to exercise them. You can review most of your data directly in the dashboard.

8. International transfers

Data may be processed in countries other than your own, including where our infrastructure and Upstream Providers operate. We take steps to ensure an adequate level of protection consistent with this Policy.

9. Changes & contact

We may update this Policy from time to time; material changes will be announced on the dashboard or by email. Questions: privacy@rerouter.dev.