Privacy Policy

01What we collect

1.1Data you give us

Account

Your name, your email address and whether it is verified. Your password is stored only as a hash.

Profile

Your first and last name, country, whether you use AZRouter as an individual or a company, and for a company its name, website and your role; what you plan to build, your expected monthly spend, how you heard about us, an optional phone number, and whether you want marketing email and since when.

Consent records

Which version of the Terms of Service and this policy you accepted, that you agreed to the use of your Content for model training, how you accepted (sign-up form or a later prompt) and when.

Google or GitHub sign-in

Only if you use it: your account id at that provider, your name and profile picture link if the provider sends them, the sign-in tokens it returns, and from GitHub your public company, website and location, which we use only to prefill your profile.

API keys

The name you give each key, its first few characters, a SHA-256 hash of the full key, an optional spending limit, and when it was created, last used and revoked. We never store the full key.

Top-ups

The amount of each top-up, Stripe's ids for the checkout and the payment, and any refund or dispute on it. You enter card details on Stripe's page, so we never see or store your card number.

1.2Data from using the Service

Usage records

For each API or playground request: the model, the kind of output, where the request came from (API or playground), its status, tokens in and out (including cache reads and writes) or other units (images, seconds, characters or requests), the cost, the same cost at the reference price, how long it took, the key used, the upstream channel, a request id, any error message, and the time.

Credit history

Every top-up, usage charge, refund, adjustment and bonus: the amount, currency and type, a reference such as a Stripe payment id, a short description, and the time.

Sign-in sessions

A session token, when the session expires, your IP address and your browser's user agent.

Rate limiting

Request counters per IP address (sign-in and sign-up) and per account (dashboard actions). They expire on their own.

Account status

Your usage tier, any custom limits on it, and whether the account is frozen.

API gateway account

Each AZRouter account has a matching account in our API gateway. We keep its credentials encrypted.

1.3Content: prompts, outputs, files and media

"Content" is what you send to a model through the API or the playground (text, images, audio, video, files) and what the model sends back. Content passes through our API gateway to the upstream provider that runs the model. AZRouter, the upstream provider and the model's owner may store Content and use it as section 2 describes, including to train AI models. Content can contain personal data, for example names in a prompt; the Terms ask you not to send sensitive personal data.

• [Where AZRouter stores Content (gateway logs, training datasets), with which provider, and for how long]
• [List of upstream providers and model owners with links to their privacy and data-use policies]

1.4Cookies and local storage

We use three cookies: two keep you signed in and one remembers your time zone. We do not use analytics or advertising cookies.

azr.session_token

Keeps you signed in. Lasts 30 days and renews while you use the site.

azr.session_data

A short-lived copy of your session, so pages load without a database lookup. Lasts 5 minutes.

azr_tz

Your time zone as your browser reports it (for example Asia/Bangkok), so times on the site show in it. Lasts 1 year.

Over HTTPS, browsers list the two sign-in cookies with a __Secure- prefix. Your light or dark theme choice is saved in your browser's local storage and is not sent to us.

02How we use your data

Run the Service

Create your account and sign you in, run your API and playground requests by sending Content to upstream providers, and show you your keys, usage and credits. Uses account, profile, Content and request metadata.

Billing

Meter usage, take its cost from your credits, process top-ups, refunds and disputes, and keep financial records. Uses account, profile, usage records and payment data.

Security and abuse

Rate limits, fraud and abuse checks, enforcing the acceptable use rules and investigating misuse. Uses sessions, IP addresses, request metadata and, where needed, Content.

Training and improving AI models

AZRouter, our upstream API providers and the owners of the models you use may use Content to train, evaluate and improve AI models and services, as the Terms (section 6) allow. People may review Content for this.

Communication

Email about your account, security and billing. Product news and marketing only if you opted in; you can opt out at any time.

Legal obligations

Keep records and answer lawful requests from authorities.

We do not sell your personal data and do not use it for advertising. [Confirm with TOR]

03Who we share it with

• Upstream API providers, including OpenRouter: Content and request settings, so they can run each request. They may also keep Content and use it to train and improve their models under their own terms.
• Model owners, the companies that make the models you use: Content may be made available to them to train and improve their models.
• Stripe: to take card payments. Stripe collects your card details directly.
• Cloudflare: traffic to azrouter.dev and the API passes through Cloudflare, which sees your IP address and request data in order to deliver and protect the Service. On sign-up, sign-in, password reset and checkout, Cloudflare Turnstile checks that a person, not a bot, is using the form; it reads signals from your browser to do so.
• Google or GitHub: only if you choose to sign in with them.
• Authorities, when the law requires it. [How we respond to legal requests]
• [Hosting provider and any other service providers]

04Your rights and choices

Depending on where you live, Thailand's Personal Data Protection Act (PDPA), the EU or UK GDPR or similar laws give you rights over your personal data. Subject to the exceptions those laws allow, you can:

• get a copy of your personal data, and receive it in a portable format;
• have inaccurate data corrected (most of your profile can be edited in Settings);
• have your data deleted, or its use restricted;
• object to uses based on our legitimate interests, and to marketing at any time;
• withdraw your consent at any time. Withdrawing consent to model training means you can no longer use the Service, because it is a condition of use; it does not undo use made before, and Content already used to train a model cannot be removed from it;
• complain to a regulator: in Thailand the Personal Data Protection Committee; in the EU or UK your local data protection authority.

• In the dashboard you can see your keys, usage and credit history, download your usage as a CSV file, and revoke any API key at any time.
• For any other request, email [email protected]. We answer within 30 days.
• Our credit ledger is append-only: its entries cannot be edited or deleted, and we keep financial records as the law requires even after other data is deleted.

05Security

• API keys are stored only as SHA-256 hashes, and passwords only as hashes.
• Session cookies are HttpOnly, so scripts on the page cannot read them, and they are sent only over HTTPS.
• azrouter.dev loads only over HTTPS.
• Sign-in and sign-up are rate limited.
• API gateway credentials are stored encrypted.

No system is fully secure. [How and when we tell you about a data breach]

06How long we keep it

• Your account, profile, keys, usage records and credit history are kept while your account is open. [Data retention period after an account is closed]
• Content is kept as long as it is needed for the purposes in section 2, including model training. [Maximum retention period for Content in AZRouter's systems] Upstream providers and model owners keep it under their own policies. Content already used to train a model stays part of that model.
• Consent records are kept for as long as we rely on the consent, and afterwards as long as we may need to show it was given.
• A sign-in session lasts up to 30 days and is extended while you use the site. Signing out ends it.
• Rate-limit counters expire on their own, shortly after the window they count.
• [How long server logs and backups are kept]

07Children

The Service is not for anyone under [Minimum age]. We do not knowingly collect their data.

08International transfers

Upstream API providers, model owners, Stripe and Cloudflare may process your data, including Content, in other countries, including the United States, whose data protection laws may differ from yours. Where the law requires it, we rely on safeguards such as standard contractual clauses or your consent. [Where AZRouter is based, and the safeguards used for each transfer (PDPA s.28–29, GDPR Chapter V)]

09Legal bases

• Contract: to run your account, requests and payments.
• Consent: to use Content for training and improving AI models, and for marketing email.
• Legitimate interests: to secure the Service, prevent abuse and improve it.
• Legal obligation: to keep financial records and answer lawful requests.

[Lawyer to confirm the basis for model training. Consent made a condition of the service may not count as freely given (GDPR Art. 7(4), PDPA s.19); contract or legitimate interests may be needed instead or as well.]

10Governing law

[Governing law and venue]

11Changes to this policy

We will post changes on this page with a new date. [How and how far in advance we tell you about important changes]

12Contact

• [Legal entity name]
• [Registered address]
• Privacy and data requests: [email protected], or the contact form
• [Data protection officer or representative, if required]