Data Protection

Personal data we collect

• Account data: your email address and name, and a password hash or your Google or GitHub identifier if you sign in that way.
• Billing profile: organisation name and billing email if you set them.
• Usage logs: which model handled each request, token counts in and out, latency, status and cost, plus a short classified provider error line when a request failed, and the user field, HTTP-Referer and X-Title header values if you sent them. These are metadata, kept so we can bill you and show you your own usage.
• Sign-in records: IP address, derived city and country, and browser user agent, kept as a security trail for your account.

What is not stored by default

On an ordinary request, prompt and completion bodies are not written to our database. Your content is forwarded to the model provider you selected and the response comes back to you. Four features you choose to use do store them, each scoped to your own account and deleted on a schedule: Capture (per key, 1, 7 or 30 days), the response cache (per request, until its expiry; the semantic variant also stores an embedding of the conversation), the Batch API (request bodies and results for 30 days, so results can be fetched) and Idempotency-Key retries (the full response for 24 hours, so a retry gets the same answer).

Who processes your data

• Our payment gateway processes top-ups. Card details go to it directly and never reach our servers.
• Upstream model providers answer your requests. Your prompt transits to the provider serving the model you selected, and from that point it is handled under that provider's own privacy policy, including any retention they do for abuse monitoring. Many providers operate outside India. Choosing a model is choosing where the prompt goes, with one addition: a request with the semantic cache enabled also sends the conversation text, including the system prompt, to the embedding provider (OpenAI by default) to compute the lookup vector.
• Our hosting providers run the infrastructure the service lives on.

We do not sell personal data and we do not share it for advertising.

Your rights as a data principal

Under the DPDP Act, 2023 you can:

• Access: ask for a summary of the personal data we hold about you and how it is processed.
• Correction: ask us to correct or complete inaccurate or incomplete data.
• Erasure: ask us to erase personal data we no longer need for a lawful purpose or a legal obligation.
• Grievance: complain to us first, and if unsatisfied, to the Data Protection Board of India.
• Nomination: nominate another person to exercise these rights if you are unable to.

To exercise any of these, email support@rapidrouter.ai from your registered address. We acknowledge within 24 hours and resolve within 90 days.

How long we keep it

• Account data: for the life of the account, then only what tax law obliges us to keep.
• Usage logs: retained so you can see your own usage history and so billing disputes can be checked against the record.
• Cached responses, and the embedding stored with a semantic one: until their per-request expiry (default 5 minutes, at most 24 hours), then swept automatically.
• Batch job request bodies and results: removed 30 days after the batch was created.
• Idempotency-Key responses: removed 24 hours after the request.
• Invoices and payment records: as long as Indian tax law requires.
• Sign-in records: kept as a security trail for the account.

Grievance officer

Arun Kaurav is the grievance officer for data protection matters, reachable at support@rapidrouter.ai. Grievances are acknowledged within 24 hours and resolved within 90 days.

Related pages

The full picture of collection and use is in the Privacy Policy. The technical safeguards are described on the Security page.