Privacy Policy

The short version

An ordinary request is forwarded to the provider and its prompt and response are not written to our database. Four features you choose to use do store them, each for a fixed time: Capture (1, 7 or 30 days, per key), the response cache (per-request expiry, up to 24 hours), the Batch API (30 days, so results can be fetched) and an Idempotency-Key retry (24 hours). What we record otherwise is metadata about the request so we can bill you and show you your usage.

Who is responsible for your data

Creativefuel Private Limited, First Floor, Gravity Mall, Vijay Nagar, Indore, Madhya Pradesh 452010, India, is the data fiduciary. Questions and grievances go to support@rapidrouter.ai.

What we collect

Account details, when you sign up:

• Email address and name
• A password hash, or your Google or GitHub account identifier if you sign in that way
• An organisation name, if you give one

Request metadata, every time you call the API:

• Which model and provider handled it
• Response status and latency
• Token counts in and out, and the resulting cost
• Timestamp, and which of your API keys was used
• If the provider returned an error, a short classified line: the status and the provider's error code or the first 120 characters of its message, with key-shaped tokens removed
• Identifiers you choose to send: the user field of the request body and the HTTP-Referer and X-Title headers, if present

Sign-in records, for account security:

• IP address, and the city and country derived from it
• Browser user agent
• Whether it was a signup or a login, and the method used

Billing records for top-ups, including the invoice trail required by law.

What we do not collect

• Prompt text or model output on an ordinary request. The time-limited exceptions are the features listed above: Capture, the response cache, the Batch API and Idempotency-Key retries.
• Payment card numbers. Those go to the payment gateway, never to us.
• Your postal address or any government identifier. A phone number is held only if you add one for WhatsApp alerts or on your billing profile.

Why we process it

• To run the service and route your requests
• To meter usage and bill you accurately
• To show you your own usage and spend
• To detect abuse, fraud and compromised keys
• To meet tax and accounting obligations under Indian law

Transfers outside India

This is the important one. Rapid Router routes to model providers who operate outside India, including in the United States and elsewhere. Your prompt is transmitted to the provider you selected in order to be answered. Once it reaches them it is handled under that provider's own privacy policy and retention rules, not ours, and some providers do retain prompts for their own abuse monitoring.

If that matters for your data, check the policy of the specific provider before sending anything sensitive through it. Choosing a model is choosing where the data goes, with one addition: if you enable the semantic cache on a request, the conversation text, including the system prompt, is also sent to the embedding provider (OpenAI by default) to compute a vector for the lookup, whichever model you chose.

How long we keep it

• Account records: while your account exists, and afterwards only where tax law requires it
• Request metadata: retained for usage history and billing dispute resolution
• Sign-in records: retained as a security trail
• Invoices and financial records: as long as Indian tax law requires
• Prompt and response content: not retained on an ordinary request, except bodies captured at your request, which are deleted after the 1, 7 or 30 days the key chose
• Cached responses, exact or semantic (with the stored embedding): until the per-request expiry, default 5 minutes, at most 24 hours
• Batch API request bodies and results: deleted 30 days after the batch was created
• Idempotency-Key responses: deleted 24 hours after the request

Sharing

We share what is necessary with the model provider handling your request, our payment gateway for processing recharges, and our infrastructure providers for hosting. We do not sell personal data and we do not share it for advertising.

Your rights

Under the DPDP Act you can:

• Ask what personal data we hold about you and how it is processed
• Ask us to correct or complete inaccurate data
• Ask us to erase data we no longer need for a lawful purpose
• Withdraw consent, which you can do by closing your account
• Nominate someone to exercise these rights if you are unable to
• Complain to us, and then to the Data Protection Board of India

Email support@rapidrouter.ai to exercise any of these. We acknowledge within 24 hours and resolve within 90 days.

Security

Traffic runs over TLS. Passwords are stored as bcrypt hashes and API keys only as hashes, so neither can be read back. Provider credentials are stored encrypted. If a breach affects your personal data we will notify you and the Data Protection Board as required.

Children

The service is not for anyone under 18 and we do not knowingly collect their data.

Changes

We will post any update here and change the date at the top. Material changes will be notified by email.