Privacy Policy

1. Collection of Personal Data

Information You Provide

We collect information you voluntarily provide when you register for an account, make purchases, contact us for support, or otherwise interact with our services. This may include your name, email address, and any other details you choose to share. When you sign in through a third-party provider such as GitHub, Discord, or Google, we receive the basic profile information that provider releases to us. Payments are handled by our payment processors; we receive confirmation of a transaction and its amount, but we never receive or store your full card number. We also collect the content of the prompts and files you submit for the limited purpose of routing them to the AI model provider you have selected.

Information Collected Automatically

When you access our services, we automatically record your IP address and the time of each request. For each API request we record operational metadata such as the model requested, token counts, cost, latency, and whether the request succeeded. This metadata is what powers your usage logs and billing, and we retain it even where we do not retain the content of the request itself.

Cookies and Tracking Technologies

We use cookies and similar technologies to keep you signed in and to remember your preferences. Strictly necessary cookies hold your session and authentication state and cannot be disabled without breaking the service. Preference cookies remember settings such as your theme, language, and selected model. We do not use cookies or similar technologies for analytics or advertising. You can block or delete cookies in your browser settings, but parts of the service may stop working. If you use the chat without an account, a cookie with a random guest ID links to your browser the consents you give for models with training use or other models that require consent, and any objection you declare to your inputs being passed to providers with training use. The guest ID is valid for one year.

2. How We Use Your Personal Data

We use the information we collect to provide, maintain, and improve our services; to route your requests to the AI model provider you select and return the response; to process transactions, maintain your credit balance, and issue invoices; to send you technical notices, updates, security alerts, and administrative messages; to respond to your comments, questions, and support requests; to monitor and analyze trends, usage, and activities; to detect, investigate, and prevent fraud, abuse, and other illegal activity; and to comply with legal obligations. We do not use the content of your prompts or the responses you receive to train our own models, and we do not sell your personal information.

3. How We Share Your Personal Data

We share your information only where it is necessary to run the service or where the law requires it. AI model providers: when you send a request, its content is transmitted to the upstream provider that serves the model you chose. Each provider handles data under its own terms, and some may retain or train on what they receive. Because the model you select determines who receives your data, please review the practices of a provider before sending it anything sensitive. Payment processors: Stripe, Creem, and NowPayments process purchases and receive the data needed to complete and invoice a transaction. Infrastructure providers: hosting and content delivery vendors process data on our behalf under contractual confidentiality obligations. Legal and safety: we may disclose information where required by law, or where we reasonably believe disclosure is necessary to enforce our terms, investigate abuse, or protect the rights and safety of our users or the public. Business transfers: if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Content checks for images and videos: before we carry out an image or video generation request, we send its text prompt to our merchant of record Creem in Estonia, because our payment provider requires such checks. Only the prompt text is sent, without your name, email address, IP address or any other identifier. Text requests are not checked this way. If a prompt is rejected, we keep only the result of the check in the usage log, not the prompt itself.

4. Sharing with Model Providers That Use Inputs for Training

UnoRouter offers some models through providers that also use your inputs for their own purposes (in particular to train their models). Providers that have not published how they handle inputs are treated in the same way, because it cannot be ruled out that they use inputs for their own purposes. These providers process the data under their own responsibility. UnoRouter shows you which models and providers are affected when you choose a model. Passing your inputs to these providers is based not only on the performance of the contract but also on our legitimate interest in offering you the widest possible choice of AI models, including models that are only available on these terms (Art. 6(1)(f) GDPR). You choose the model yourself and are informed of the training use beforehand. Models without training use are available to you at any time. We only transmit the content of your input, not your account data, your IP address or any other identifiers. You must not enter special categories of personal data within the meaning of Art. 9(1) GDPR, such as health data or data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or sex life, into models with training use. Our legitimate interest does not extend to such data.

Right to object: You may object at any time, on grounds relating to your particular situation, to your inputs being passed to these providers (Art. 21(1) GDPR). After an objection, we no longer forward your inputs to these providers. You can declare your objection in your account settings under "Objection to use for the providers' own purposes", without an account via "Manage consents" in the chat, or by email to [email protected].

5. Your Rights and Choices

Depending on your location, you may have rights over your personal data, including the right to access it, correct it, delete it, receive a portable copy, object to or restrict certain processing, and withdraw consent where our processing relies on it. You can update your account details and delete stored chat data at any time from within the application, and you can opt out of marketing email using the unsubscribe link it contains. You can also limit what leaves your device: choosing a different model changes which provider receives your requests. To exercise any right that is not available in the application, contact us at [email protected]. We may ask you to verify your identity before we act, and we will respond within the time limits set by applicable law. Deleting your account removes your stored data except where we must keep records for billing, tax, security, or other legal obligations.

6. Data Security

We implement and maintain reasonable physical, technical, and administrative security measures to protect your personal information from unauthorized access, destruction, use, modification, or disclosure. Traffic is encrypted in transit, API keys are stored hashed, session cookies are HTTP-only, and access to production systems is restricted. Your API keys are credentials: anyone holding one can spend your balance, so keep them secret and revoke any key you believe has been exposed. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. Third-Party Services

Our services link to and integrate with services operated by other companies, including AI model providers, payment processors, and authentication providers. We do not control how those companies handle your data, and this Privacy Policy does not apply to them. Once you follow a link away from our services or send data to a model provider, that company's own privacy policy governs. We encourage you to read the policies of any third party before sharing information with it.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. Account records and the operational metadata behind your usage logs and invoices are retained while your account exists and afterwards where tax and accounting rules require. Your chat history is stored locally in your own browser rather than on our servers, so clearing it in the application or clearing your browser storage removes it. Prompt content passed to a model provider is retained by that provider according to its own policy, not ours. When we no longer need data, we delete or anonymize it. IP addresses recorded with API requests are erased after 30 days; the operational metadata in the same records is kept, because it is the basis of your invoices. Records of consents to models with training use and other models that require consent, including the text you agreed to, are kept while your account or guest ID exists and for up to three years after the consent ends, so that we can prove it. An objection you declare with an account is stored as an account setting for as long as your account exists. An objection you declare as a guest is stored with your guest ID and deleted when the guest ID expires after one year.

9. Age Requirements

Our services are not directed to children. You must be at least 13 years old to use them, and old enough to enter into a binding contract in your country of residence, or have the permission of a parent or guardian. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it. If you believe a child has provided us personal data, contact us at [email protected].

10. International Data Transfers

Your personal data may be transferred to and processed in countries other than your country of residence. For our own infrastructure and payment providers, we transfer personal data out of the European Economic Area only where an adequacy decision of the European Commission covers the destination country or where standard contractual clauses approved by the European Commission are in place. Model providers are a separate case. Many requests, including requests to models from well-known Western developers, are served by providers based outside the European Economic Area in countries for which no adequacy decision exists, in particular China, Hong Kong, Singapore, Thailand and the United Arab Emirates, and by providers in the United States that are neither certified under the EU-US Data Privacy Framework nor bound to us by standard contractual clauses. The level of data protection in these countries is not comparable to that in the European Union: authorities there may have far-reaching powers to access data, and you may not have equivalent rights and legal remedies. Some of these providers inspect, retain or train on what they receive. For consumers, the transfer is necessary to perform our contract with you, because the provider through which a model is served is part of the service you use (Art. 49(1)(b) GDPR). Each model page lists the provider groups that serve the model, and you can limit a key to specific groups with group pinning. With automatic routing, a request goes to the cheapest available group, which is often one of the providers described here. Do not include personal data of other people in the content you send to a model, and we advise against including your own. Providers that also use your inputs for their own purposes, in particular to train AI models, are handled differently, whether the model is free or paid (see section 4). The same applies to providers that have not published how they handle inputs. If such a provider is based in a third country without an adequate level of data protection, we only transfer your inputs there after you have expressly consented in a dialog that names the destination countries (Art. 49(1)(a) GDPR). Your consent covers the providers through which the model is offered at the time you consent; if another such provider is added, we ask for your consent again. You can withdraw your consent at any time in your account settings, or as a guest via "Manage consents" in the chat; the model is then blocked for you. For all other providers, the transfer remains based on the performance of our contract (Art. 49(1)(b) GDPR). Models that require such consent are not available to business accounts.

Email and cryptocurrency payments: we send account and transaction emails, such as sign-up codes, password resets and payment confirmations, through Resend in the United States, which is certified under the EU-US Data Privacy Framework. Emails you send to our support address are stored with our mailbox provider netcup GmbH in Germany, which processes them on our behalf under a data processing agreement (Art. 28 GDPR). They are not transferred to a third country. Please do not send sensitive information by email. If you pay with cryptocurrency, the payment is handled on the payment page of NowPayments, operated by FD Transfers LLC in Saint Vincent and the Grenadines. We only send NowPayments the amount and a random order number, no name or email address. On its payment page NowPayments processes your data, such as your IP address and wallet address, as its own controller under its own privacy policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date above, and where the change materially affects your rights we will give account holders notice by email. Your continued use of our services after an update takes effect constitutes acceptance of the revised policy. Please keep the email address on your account current so that we can reach you.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise a data protection right, or wish to make a complaint about how we handle your information, contact us at [email protected] and we will respond as quickly as we can. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.