1. Scope and Roles
This Privacy Policy explains how the operator of AnRouter (“AnRouter,” “we,” “us,” or “our”) processes information when you use the AnRouter website, dashboard, managed inference API, documentation, payment features, or support channels (the “Services”). It should be read with our Terms of Service.
When you use the API for an organization, that organization normally decides what data is submitted and is responsible for its lawful collection and use. AnRouter processes that data only to provide the Services, subject to this Policy and any written data processing agreement. This Policy does not replace obligations that apply to you as a data controller or business.
“Personal Data” means information that identifies or can reasonably be linked to a person. “API Conversation Content” has the meaning set out below.
2. API Content Retention and Stateful Responses
Stateless API requests are not retained by AnRouter after processing.
We do not use API Conversation Content to train, fine-tune, evaluate, or improve any AI model, and production diagnostics are designed to exclude prompts, uploaded content, and model responses.
API Conversation Content includes prompts, messages, system instructions, uploaded text, files, images or audio, source data submitted for embeddings or reranking, tool arguments and results, and model-generated responses. It does not include the limited usage and security metadata listed in Section 3.
Chat Completions, Messages, and other stateless requests are processed in transient memory or short-lived request buffers for validation, format conversion, routing, retries, streaming, and delivery. Those buffers are removed when processing completes or fails and are not included in backups.
Stateful Responses exception. For models that support AnRouter stateful Responses, a Responses request is eligible for encrypted continuation storage unless the request explicitly sets store:false. We store the request input and model output solely to support previous_response_id. This state is bound to the account and API token, encrypted at rest, limited in size and continuation depth, and automatically expires no later than 24 hours after creation. It is not used for analytics, advertising, support, or model training and is not included in application backups.
Setting store:false prevents AnRouter from creating this local continuation state. If storage is disabled, a later request cannot rely on that response through previous_response_id. This control applies to AnRouter systems; the selected model execution environment may have separate retention or caching rules described in Section 6.
If you voluntarily paste prompts, outputs, screenshots, or files into a contact form, email, or support ticket, that copy becomes Support Data and is retained under Section 7 rather than this API-path commitment.
A lawful request can require us to disclose data we actually retain, but it cannot make us produce stateless API Conversation Content that was never stored or stateful content that has already expired.
3. Other Data We Collect and Retain
Account and contact data
- Username, email address, password hash, account group, preferences, API key identifiers and status, and information needed to administer an organization or account.
- Messages and files you choose to send through contact, support, privacy, security, or enterprise channels.
- Referral codes, inviter and invitee attribution, reward status, transfer records, and fraud-review signals used to operate the referral program.
Billing and transaction data
- Order and transaction identifiers, amount, currency, status, plan, subscription state, credit balance, promotional or referral balance, and related accounting records.
- When a payment provider hosts checkout, it receives the payment credentials needed to complete the transaction. AnRouter does not need to receive full card details from that hosted flow.
API usage and security metadata
- Request identifier, timestamp, API route, requested model, token or unit counts (including cache-read and cache-write units where reported), latency, response status, streaming status, error category, route or channel, and amount charged.
- IP address, user agent, authentication events, rate-limit events, and other security signals needed to protect accounts and infrastructure.
Website analytics and advertising-measurement data
- Pages viewed on the public website, the referring page, approximate location derived from IP address, browser and device type, and identifiers set by the third-party tools described in Section 8. This category relates to the public website only and never includes API Conversation Content.
Usage metadata describes the request but does not contain API Conversation Content. Production diagnostics are designed to exclude prompts, uploaded content, and model responses.
4. How and Why We Use Data
- Provide the Services, authenticate accounts and API keys, route requests, calculate usage, and deliver responses.
- Process purchases, manage credits and subscriptions, reconcile charges, and maintain required accounting records.
- Prevent fraud and abuse, enforce service restrictions, investigate metadata-only errors, and protect users and infrastructure.
- Respond to support and privacy requests and send transactional, security, billing, or material service notices.
- Meet legal obligations and establish, exercise, or defend legal claims.
- Plan capacity and improve reliability using operational or aggregated statistics that do not contain API Conversation Content.
Depending on applicable law, these activities are based on performance of our contract with you, compliance with legal obligations, our legitimate interests in operating and securing the Services, or consent where consent is required. We do not sell Personal Data, use API Conversation Content for advertising, or use it for model training.
6. Model Execution, Prompt Cache, and Route Privacy
AnRouter provides managed AI inference. Your API Conversation Content is processed in the model execution environment selected by you or by the routing configuration. Execution may use compute, hosting, and networking infrastructure in another country or region, where retention rules, security systems, and legal obligations may differ.
AnRouter's retention controls apply only to systems controlled by AnRouter. Infrastructure-level or end-to-end zero data retention applies only when the selected route, model documentation, or written enterprise agreement expressly identifies that protection. A commitment not to use content for training is not necessarily the same as a commitment to store nothing.
Prompt caching. When a model or route supports prompt caching, its execution environment may create and retain a cache representation of all or part of the prompt for a defined period. Cache-read and cache-write usage may be reported and billed separately. AnRouter records cache usage metadata for billing but does not treat execution-environment cache storage as AnRouter stateful Responses storage. Do not use prompt caching for sensitive data unless the selected route's cache retention terms meet your requirements.
If your workload contains regulated, confidential, biometric, or highly sensitive data, use only a route expressly identified as meeting your retention and regional requirements, or contact enterprise support before sending it. You are responsible for obtaining any notice or consent required for data about another person.
7. Retention by Data Category
- Stateless API Conversation Content: not retained by AnRouter after request processing. Transient request buffers are removed when processing completes or fails and are not backed up.
- Stateful Responses content: encrypted continuation state is retained for no more than 24 hours unless storage is disabled with
store:false; it expires automatically and is not included in backups. - API usage metadata: retained only as long as needed to provide usage history, reconcile billing, investigate fraud or abuse, resolve disputes, and meet legal obligations. The duration depends on account activity, dispute and chargeback windows, security needs, and mandatory accounting or legal periods; it does not include conversation bodies.
- Account and referral data: retained while the account or referral relationship is active and afterward only as needed for account closure, fraud prevention, disputes, and legal obligations.
- Billing and transaction records: retained for the period required by tax, accounting, payment, anti-fraud, and other applicable laws.
- Support Data: retained for as long as reasonably needed to resolve the request, maintain a service record, and protect legal rights. Do not send API keys or unnecessary conversation content to support.
- Security logs: retained for the shortest period reasonably necessary to investigate abuse and protect the Services, and longer only for an active investigation, dispute, or legal requirement.
Backups may contain retained account, billing, support, referral, or metadata records until normal backup rotation completes. They do not contain stateless API Conversation Content or stateful Responses history. A legal hold applies only to data already retained and does not recreate expired or unstored API content.
9. Your Choices and Privacy Rights
Depending on your location, you may have rights to know, access, correct, delete, restrict, object to, or receive a portable copy of Personal Data; to withdraw consent where processing relies on consent; and to opt out of qualifying sale or sharing. You may also complain to your local data protection authority.
You can update certain account data in the dashboard and submit a request through the contact form or the email in Section 13. We may verify your identity and may deny or limit a request where permitted by law, including to protect another person, preserve transaction records, or prevent fraud.
Stateless API Conversation Content is not retained after processing. Stateful Responses history is automatically deleted when its 24-hour retention period expires; setting store:false prevents its creation. Because state is encrypted and bound to the requesting account and token, requests concerning it may require the response ID and account verification.
10. Security
We use technical and organizational safeguards designed for the nature of the Services, including encrypted transport, access controls, credential protection, data minimization, separation of conversation content from retained usage metadata, and encryption at rest for temporary stateful Responses history.
No internet service can guarantee absolute security. Keep passwords and API keys confidential, never place secret keys in public or client-side code, restrict key permissions where available, and revoke exposed keys promptly. Contact us if you suspect unauthorized access.
If a security incident involving retained Personal Data is legally notifiable, we will assess it and notify affected people and competent authorities as required by applicable law or a written enterprise agreement.
11. International Processing
Model execution, hosting, networking, payment, email, and support operations may process data outside your country. Where applicable law requires transfer safeguards, we use or require an appropriate lawful mechanism. A particular data-residency region is guaranteed only when expressly stated for a route or in a written enterprise agreement.
12. Children and Policy Changes
The Services are intended for business and developer use and are not directed to anyone under 18. If you believe a minor provided Personal Data without appropriate authorization, contact us so we can review and take appropriate action.
We may update this Policy when the Services, infrastructure, or law change. The date at the top identifies the current version. If a change materially reduces privacy protections or changes how retained Personal Data is used, we will provide notice through the website, dashboard, or account contact channel before it takes effect where required.
13. Contact
For privacy, account, deletion, enterprise data processing, or security requests, contact us through: