Privacy Policy

1. Information We Collect

OmniRoute Technologies ("OmniRoute", "we", "us") strictly practices data minimization. We only collect the minimal personal information necessary to deliver and secure our API gateway service:

• Account Information: Name, email address, and cryptographically hashed passwords (using bcrypt with salt cost factor 12). Plaintext passwords are never stored.
• Upstream Credentials: Master OpenRouter API keys provided by administrators are encrypted at rest using AES-256-GCM authenticated encryption.
• Operational Gateway Metrics: Request timestamps, token counts (prompt and completion), model identifiers, and latency metrics to provide usage quotas and audit logging.

2. Lawful Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contractual Necessity: To provide you with API key generation, gateway routing, and dashboard access.
• Legitimate Interests: To protect our infrastructure against DDoS attacks, abuse, unauthorized token use, and malicious activities.
• Consent: Where you have explicitly opted into non-essential analytics or notifications.

3. How We Use Your Data

Your data is strictly utilized to authenticate your identity, validate scoped API permissions, forward requests to upstream AI models, and display analytics in your dashboard. We do not sell, rent, or monetize your personal information or API prompts to any third parties.

4. Data Retention & Erasure

We retain your account and key logs for as long as your account remains active. You may request complete erasure of your account, API keys, and associated logs at any time by contacting our privacy officer at privacy@omniroute.dev or binaryfroster@gmail.com.

5. Your Legal Rights

Under GDPR, CCPA/CPRA, UK GDPR, and applicable privacy regulations, you possess the right to:

• Access and receive a copy of your personal data.
• Rectify inaccurate or incomplete information.
• Request erasure of your personal data ("Right to be Forgotten").
• Restrict or object to processing.
• Lodge a complaint with a supervisory data protection authority.