LEGAL
Privacy Policy
How we collect, use, store and protect your personal information.
Last updated: October 18, 2026
1. Scope
This Policy explains how FlyRouter ("we", "us") handles personal information when you use the gateway, website and console. It does not apply to how upstream model providers or the third-party clients you use handle your data.
2. Information We Collect
| Category | Content | Source |
|---|---|---|
| Account information | Email, username, password hash, third-party login identifiers (Google / GitHub), registration time | Provided by you or obtained when you authorize a login |
| Keys and configuration | API keys (only the hash and the leading/trailing fragments used for identification are stored), token names, assigned groups | Created by you in the console |
| Call records | Model name, token usage, latency, status code, amount charged, request ID, source IP and User-Agent | Generated automatically when you use the Service |
| Billing and payment | Top-up amounts, payment channel order numbers, refund records (we do not store full card numbers) | Returned by the payment channel when you top up |
| Site usage | Login session cookies, local settings such as language and theme | Generated when you visit the site |
3. How We Use This Information
- To forward requests and return results;
- To meter usage, bill, generate invoices and reconcile accounts;
- For authentication, risk control and anti-abuse (for example, identifying abnormal calls, stolen keys and bulk registration);
- For troubleshooting and technical support (when you ask for help);
- To fulfill obligations required by laws and regulations.
We will not use your prompts or outputs to train models, and we will not sell your data.
4. Who Can See Your Request Content
This is something to understand when using any gateway: your request content is sent to the upstream provider that supplies the model to you, which generates the response. The upstream's handling of content is governed by its own terms and privacy policy; we recommend that you confirm the source of the model you are calling before handling sensitive data.
We view request content only when necessary (troubleshooting, risk control, legal requirements), and we do not proactively browse it or use it for any other purpose.
5. Entrusted Processing and Sharing
To provide the Service, we share necessary information with the following types of service providers:
- Upstream model providers: to forward prompts and parameters and return generated results;
- Payment providers (Stripe, EPay, etc.): to process top-ups and refunds; we do not have access to your full card information;
- Email providers: to send registration verification codes and password reset emails;
- Cloud hosting and database providers: to store accounts, configuration and call records.
Except in the above circumstances and as required by laws and regulations, we will not provide your personal information to third parties. In the event of a merger, acquisition or similar transaction, we will require the successor to remain bound by this Policy and will notify you in advance.
6. Storage and Retention
- Account information: retained while the account exists; deleted or anonymized within 30 days after you close your account.
- Call records: retained for 30 days by default for troubleshooting and billing reconciliation, then aggregated into statistical metrics that contain no content.
- Billing and top-up records: retained as required by tax and financial regulations (generally no less than 5 years); deletion requests cannot be fulfilled during this period where deletion is not permitted.
- Session cookies: retained for the validity period of the login session and cleared when you log out.
7. Security Measures
- HTTPS across the entire site; API keys are stored only as hashes, and the console shows only a few leading and trailing characters;
- The database is not exposed to the public internet, and operations access goes through encrypted channels;
- Back-office access is assigned on a least-privilege basis, and critical operations are logged;
- If a data security incident affecting your rights and interests occurs, we will notify you and report to the competent authorities as required by law.
8. Your Rights
You may request to access, correct, export or delete your personal information, and may also withdraw your authorization or close your account. Please submit requests through [Contact Email], and we will respond within 15 business days. Records that must be retained by law and information necessary for handling disputes are excepted.
9. Cross-Border Transfers
Our servers and upstream providers may be located outside your country or region, and cross-border transfers may occur when your information is processed. We will require the relevant parties to adopt protective measures no less protective than this Policy.
10. Minors
The Service is not directed at minors under 18 years of age. If we discover that we have mistakenly collected information from a minor, we will delete the relevant account and information.
11. Policy Updates
When this Policy is updated, the date will be indicated on this page; significant changes will be highlighted in website announcements. Continuing to use the Service indicates your acceptance of the updated Policy.
12. Contact Us
- Operating entity: [Operating Entity Name]
- Contact email: [Contact Email]
- Registered address: [Registered Address]
Want to exercise your rights of access, deletion or export? Email us, and see other channels on the Contact Us page.
FlyRouter