Privacy policy

What we store about you and your requests, for how long, and who else sees it.

Effective date: to be confirmed. Questions: support@plaingateway.com.

1. The short version

• We do not store the text of your prompts or the model's answers.
• We keep a record of each request (model, host, tokens, cost, timing, status) for 7 days, then only hourly totals.
• We do not train models on your requests, and we do not sell your data.
• Your prompt goes to the model provider that serves it, under that provider's own terms.

2. What we collect

• Account: your email address, a hashed password or your Google sign-in, your account settings, and the referral code that brought you, if any.
• Payments: Stripe holds your card. We keep the Stripe customer id, the saved payment method id for auto top-up, each top-up's amount and status, and a card fingerprint that Stripe gives us to stop referral fraud.
• API keys: a hash of each key and its first 12 characters. We cannot show a key again after it is created.
• Requests: for each request, the model, the host that served it, token counts, cost, latency, status, the finish reason, any error message, and the app name and referrer headers your client sends. Not the prompt and not the answer.
• Site: the session cookie that keeps you signed in, and your theme choice in your browser.

3. What we use it for

• To route your requests, charge your balance and show your usage.
• To send receipts, password links and account notices.
• To prevent fraud and abuse, including referral fraud.
• To keep the gateway healthy, for example from error rates per host.

4. How long we keep it

• Per-request records: 7 days. After that, only hourly totals per model and host remain.
• Balance, payments and invoices: as long as the account exists, and after that for as long as tax and accounting law requires (the exact period: to be confirmed).
• A deleted account keeps its balance and records so it can be restored. Full erasure on request: write to support@plaingateway.com; how long we take: to be confirmed.

5. Who else sees it

• Model providers (for example OpenAI, Anthropic, Microsoft Azure and Amazon Bedrock) receive the content of each request they serve. Their own policies decide what they log and keep. Each model page names the host, and your privacy settings can limit which hosts are used.
• Service providers that run plaingateway for us: Stripe (payments), Supabase (database and sign-in) and Amazon Web Services (hosting). The full list with locations: to be confirmed.
• Authorities, when the law requires it.

We do not sell personal data and we do not share it for advertising.

6. Your choices and rights

• Change your email or password, or delete your account, in Preferences.
• Download your request records as CSV from Activity.
• Ask us for a copy of your data, a correction or erasure at support@plaingateway.com. Depending on where you live, the law may give you more rights; which laws apply to plaingateway: to be confirmed.

7. Changes and contact

We post changes here and update the effective date. For a change that affects how we use your data, we email the account address first.

Contact: support@plaingateway.com. Postal address of the legal entity: to be confirmed.