Privacy Policy

Effective date: 2026-09-26 · Version: 1.0

GateLLM AI Router (a company registered in the State of Wyoming, United States — "GateLLM", "we", "us") operates the GateLLM AI Router website (www.tokrouter.dev), the account console (api.tokrouter.dev) and the API gateway reachable at api.tokrouter.dev/v1. This policy describes what we collect, why we are allowed to, who we share it with, and how long we keep it.

The short version. We bill per token, so we keep the metadata of every call. We do not store the bodies of your requests or of the models' responses, and we never use them to train or improve any model. Card data never touches our servers.

1. Who we are and how to reach us

• Controller: GateLLM AI Router, registered address available on request at support@tokrouter.dev.
• Privacy contact: support@tokrouter.dev. Put "Privacy request" in the subject line and we will route it accordingly.
• We have not appointed a Data Protection Officer; we are not required to under Article 37 GDPR. Requests go to the address above.

2. What we collect

2.1 Account data

Username, email address, a salted hash of your password (never the password itself), the account group you belong to, your credit balance, and the API keys issued to you. If you sign in with GitHub, we receive your GitHub account identifier, username and the email address you authorise GitHub to share. If email verification is enabled, we process the verification address and the token we send to it.

2.2 Payment data

Top-ups are processed by Stripe. Card numbers, CVC and authentication data go directly to Stripe; we never receive or store them. What we keep is the settlement record we need in order to bill, reconcile and refund: our internal trade number, the Stripe payment intent and customer identifiers, the amount, the currency and the timestamp.

2.3 Call metadata (the billing record)

For every API call we record: request identifier, timestamp, model name, upstream provider, API key name and key group, HTTP status code, latency, input / output / cache-read / cache-creation token counts, inbound and outbound protocol, request path and method, and — when a call fails — the upstream error message. This is the record your invoice and your usage log in the console are computed from.

2.4 Request and response content (prompts and completions)

To serve a call we must transmit your request body to the model provider you selected, and transmit their response back to you. That content passes through the gateway in memory and in transit. We do not write it to our logs or our database: our call log has no field for it. We do not read it, mine it, annotate it or use it for training, benchmarking or model improvement.

What happens to that content at the provider's end is governed by their terms and retention policies, not ours. Today the providers we can route to include Anthropic, OpenAI, DeepSeek and Alibaba Cloud (DashScope); the live list is on the Models page. If you bring your own provider key (BYOK), the call is made against your own provider account and that provider's relationship is with you.

2.5 Refund requests

The public refund form collects the email address you enter, an optional order number, and your free-text reason. For rate limiting and abuse tracing we store a salted SHA-256 hash of your IP address — we deliberately do not store the address itself. The form is protected by Cloudflare Turnstile, which loads a script from challenges.cloudflare.com and lets Cloudflare assess whether the submission is automated.

2.6 Website and console technical data

The marketing site is a static export served from Amazon S3 / CloudFront. It sets no cookies, embeds no analytics, no tag manager and no advertising or tracking pixels. AWS records standard access logs (source IP, timestamp, path, user agent, response size) as part of operating the CDN. The console sets a session cookie once you log in — it is strictly necessary to keep you logged in — and, if enabled, a Cloudflare Turnstile cookie on the registration and login forms.

3. What we do not do

• We do not sell or share personal information, and we do not engage in "sharing" for cross-context behavioural advertising as the CCPA/CPRA defines it.
• We do not train models on your prompts, completions, files or usage patterns.
• We do not build advertising profiles, and we run no third-party trackers on our site.
• We do not use your data for automated decision-making that produces legal effects for you. Automated fraud and abuse controls (rate limits, refund gates, Turnstile) can block a request or decline a refund; every such decision can be appealed by email to a human.

4. Why we are allowed to process it

For users in the EEA, the UK and Switzerland, our legal bases under Article 6 GDPR:

Purpose	Legal basis
Creating and running your account; routing your API calls	Performance of a contract
Metering, invoicing, refunds, tax and accounting records	Contract; legal obligation
Fraud prevention, abuse and chargeback controls, rate limiting, IP hashing	Legitimate interests
Security monitoring and incident response	Legitimate interests; legal obligation
Transactional email (verification, receipts, service notices)	Contract
Product or marketing email, if we ever send it	Consent, withdrawable at any time

5. Who we share it with

We use the following processors and sub-processors. We do not disclose personal data to anyone else, except where Section 6 applies.

Recipient	Role	Data
Amazon Web Services	Hosting, object storage, CDN	All service data at rest; CDN access logs
Stripe	Payments, refunds	Payment identifiers, amount, email supplied at checkout
Cloudflare	Turnstile human verification	IP address, browser signals, challenge result
Email delivery provider — to be named here before account email is enabled	Transactional email	Recipient address, message content
GitHub	Optional sign-in	OAuth identifiers you authorise
Model providers (Anthropic, OpenAI, DeepSeek, Alibaba Cloud and others listed on the Models page)	Fulfilling your API calls	Request and response content in transit; no account data

We also disclose data where we are legally obliged to (valid legal process, regulatory requirement, defence of legal claims), and to a successor in the event of a merger or acquisition, in which case this policy continues to apply until replaced with notice.

6. Where your data is processed

Our servers run in the United States (AWS, Oregon region). If you are in the EEA, the UK or Switzerland, using the service involves a transfer of personal data to the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses (Module Two, controller to processor), the UK International Data Transfer Addendum and the Swiss addendum, executed as part of our Data Processing Addendum — available on request at support@tokrouter.dev. Requests you address to a model provider are processed wherever that provider operates; their documentation states where.

7. How long we keep it

Data	Retention
Request and response content	Not stored. In memory for the duration of the call only
Gateway call metadata	30 days
Billing and usage records in the console (per-call token counts, cost, model, key)	As long as needed for billing, tax and dispute resolution
Payment index and refund records	Same as above; refund gates require the history
Refund request forms (email, reason, hashed IP)	24 months, then deleted
Account data	Until you delete the account, then removed within 30 days except records we must keep for tax, accounting or fraud-prevention purposes
CDN and server access logs	As configured by our hosting provider, currently 30 days

8. Security

All traffic to our site, console and gateway is served over TLS; plaintext HTTP is redirected. Credentials and provider keys are supplied to our services through environment configuration rather than committed to source, database access is restricted to the services that need it, IP addresses in the refund pipeline are stored only as salted hashes, and administrative endpoints are disabled unless an operator token is configured. We are pursuing SOC 2 and ISO 27001 certification; neither is granted yet, and we do not claim either.

No system is perfectly secure. If we discover a breach affecting your personal data we will notify affected users and, where required, the competent supervisory authority, without undue delay.

9. Your rights

Subject to the applicable law, you may ask us to: give you a copy of your data; correct it; delete it; restrict or object to a specific processing activity; export it in a portable format; or withdraw a consent you previously gave. Residents of California may additionally request the categories and specific pieces of personal information we collected, the purposes, and the categories of recipients — and may not be discriminated against for exercising those rights. We do not sell or share personal information, so there is nothing to opt out of.

To exercise any of this, email support@tokrouter.dev from the address on your account, or tell us which account you mean. We respond within 30 days and will say so if we need longer. You may also lodge a complaint with your local supervisory authority — for EEA users, the authority in your country of residence.

10. Children

The service is for business and professional use and is not directed at children. You may not use it if you are under 18. We do not knowingly collect data from children; if you believe we have, write to us and we will delete it.

11. Changes to this policy

We will post any change here and update the effective date. For changes that materially reduce your rights we will notify account holders by email at least 15 days before they take effect. The version in force is the one published here.