Privacy Policy

NuRoute is operated by Amit Gupta, Eichendorffstraße 17, 10115 Berlin, Germany (see our Imprint for full details). We are the data controller for the account, billing, and service-usage data described below. If your organisation is subject to the EU General Data Protection Regulation (GDPR), this policy explains how we process personal data as required by Art. 13/14 GDPR.

Account data. Name, email address, organisation name, and role, provided when you or your organisation signs up.

Billing data. Invoicing details and usage/spend records needed to calculate and send invoices for the Cloud plan.

Provider API keys. If you connect your own AI provider credentials (BYOK), we store them AES-256-GCM encrypted at rest and never return them in plaintext through any interface, including to your own organisation.

Prompt and completion content. Requests you send through NuRoute, and the responses returned, are logged (Request Explorer) so routing decisions are replayable and your usage is auditable. If you enable PII redaction, detected personal data is replaced with placeholders before the request leaves NuRoute and restored only in the response shown back to you.

Technical data. IP address, timestamps, and request metadata, used for security, abuse prevention, and latency/quality monitoring.

Referral data. If an organisation signs up with a referral code, we record which organisation referred it, so that the benefits and credits of the referral program can be applied.

Website visits and cookies. What this marketing website processes, and which cookies it may set, is described in §3 and §4. The dashboard sets a single essential session cookie to keep you signed in; it is required for the service to function and is not used for advertising or cross-site tracking.

When you first visit this website a banner asks whether you accept analytics and referral cookies. Nothing is loaded from Google and no analytics or referral cookie is set unless you accept. You can change or withdraw your choice at any time via "Cookie settings" in the footer of every page.

Consent cookie (nuroute_consent). Stores whether you accepted or declined, for 6 months, so we do not ask on every page. It is strictly necessary to respect your choice and does not require consent (§ 25(2) no. 2 TDDDG).

Google Tag Manager and Google Analytics 4 (only with your consent). If you accept, your browser loads Google Tag Manager from Google's servers, which receive your IP address, and Google Analytics 4 sets cookies (_ga, _ga_*, lifetime up to 2 years) to measure page views and interactions on this website. The providers are Google Ireland Limited (Ireland) and, for processing outside the EU, Google LLC (USA). Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Analytics data is kept in Google Analytics for the retention period configured in our property, never longer than 14 months. Advertising features are not enabled.

Referral cookie (nuroute_ref, only with your consent). If you open a valid referral link (nuroute.ai/r/<code>) and have accepted, we store the referral code for 30 days so that it can be applied when you sign up. It is readable by the NuRoute dashboard on the same domain. If you have not accepted, the code is passed on only in the link to the sign-up page for that visit, and no cookie is set.

Fonts. Fonts are served from our own domain. No request is made to Google Fonts.

When you visit this website, our web server processes your IP address, the date and time, the requested URL, the referring page, your browser's user agent and the response status. We do this to deliver the website, keep it secure and detect abuse (Art. 6(1)(f) GDPR). These logs are kept only as long as needed for those purposes and are rotated regularly. The website and the NuRoute platform are hosted on servers in Frankfurt am Main, Germany, and backups are stored in Vilnius, Lithuania. Both are provided by Hostinger International Ltd. (Cyprus), which acts as our processor under a data processing addendum.

Performance of a contract (Art. 6(1)(b) GDPR): creating and running your account, routing your requests, generating invoices, and applying referral benefits and credits.

Legitimate interest (Art. 6(1)(f) GDPR): detecting abuse, securing the service and this website, and training and improving our own routing models (see below).

Training our routing models. On the Cloud plan, we use the content of requests routed through NuRoute (prompts and responses, which may contain personal data) together with their outcomes (model chosen, cost, latency and quality) to train the models that decide which AI model should handle a request. We do not use it to train general-purpose language models and we do not share it with others for their training. Our interest is to make routing more accurate and cheaper for all customers. You can object to this use at any time (Art. 21 GDPR): write to support@nuroute.ai and we will exclude your organisation's content from future training. On the Enterprise plan, which runs on your own infrastructure, your traffic is not used for training.

Legal obligation (Art. 6(1)(c) GDPR): retaining invoicing records as required by German commercial and tax law.

Consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG): Google Tag Manager and Google Analytics 4, and the referral cookie, on this website.

NuRoute routes your requests to the AI model provider(s) your organisation has connected or selected (for example OpenAI, Anthropic, Google, Mistral, AWS, Azure, or another provider you've added). Those providers process the prompt content of that specific request as an independent data processor or controller under their own terms, which you accept when you connect them. NuRoute itself does not sell personal data, and does not share it with any party outside of what is needed to run the service: the model providers you've chosen, and our processors (hosting, database and backups at Hostinger; transactional email from the platform via Zoho ZeptoMail in the EU; business email via Google Workspace). The current list is on our Security page.

When you buy credits, the payment is handled by Stripe Payments Europe, Ltd. (Ireland), which receives your organisation's name, billing email and address, VAT ID if given, and the payment details you enter at checkout. NuRoute never sees or stores your full card details. Stripe processes this data as our processor and, for fraud prevention and its legal obligations, as an independent controller under its own privacy policy (stripe.com/privacy). Some processing may take place in the USA under the EU-U.S. Data Privacy Framework and standard contractual clauses.

If you accept analytics, Google (see §3) receives the data described there. The "Book a call" and "Talk to us" buttons open a scheduling page run by Calendly LLC (USA), and the GitHub link opens github.com. Nothing is sent to these services until you click, and what you enter there is processed under their own privacy policies.

Several major model providers are based outside the EU/EEA, most commonly in the United States. Where we or you route a request to such a provider, the prompt content is transferred internationally under that provider's own data processing terms, typically relying on the EU Standard Contractual Clauses. If your organisation needs to keep requests within the EU, use NuRoute's data residency and region-aware routing controls to restrict routing to compliant providers, or connect only EU-hosted providers via BYOK.

Our own hosting is in Frankfurt, Germany, so the website and platform data described above are not transferred outside the EU by our hosting provider.

Google LLC (USA), which receives analytics data only if you consent, participates in the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision. Google also relies on Standard Contractual Clauses.

Account and billing data is kept for as long as your organisation has an active account, and afterwards only as long as required by German commercial and tax retention law. Request/response logs are kept for as long as your organisation's account exists and are deleted with it. You can request earlier deletion of your account and associated data at any time; see §9. Cookie lifetimes and analytics retention are stated in §3.

Under the GDPR you have the right to access, correct, delete, or export your personal data, to restrict processing, and to object to processing based on our legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future, via "Cookie settings" in the footer; withdrawal does not affect the lawfulness of processing before it. To exercise any of these rights, contact us at support@nuroute.ai. You also have the right to lodge a complaint with a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Routing a request to a model is an automated technical process that you configure through your routing policies.

Provider API keys are encrypted at rest with AES-256-GCM, per organisation. Customer API keys used to authenticate to NuRoute are SHA-256 hashed, not stored in reversible form. Access to production data is limited to what is operationally necessary to run the service.

NuRoute is a business-to-business developer tool and is not directed at, or knowingly used by, individuals under 16.

We may update this policy as the service evolves. Material changes will be reflected by updating the date at the top of this page.

Questions about this policy or your data: support@nuroute.ai. See also our Imprint for our full legal identity and address.