What we collect, where it goes, and how to make us forget you.

1. The summary

Leanroute is a developer infrastructure product. We collect the minimum needed to run the gateway, bill you accurately, and let you audit your usage. We do not sell your data and we do not use your prompts to train models. Prompt content is not stored in Postgres — request logs contain metadata only (model, tokens, cost, latency). Prompt content DOES live briefly in the Redis prompt cache (hashed key + response, 24h TTL) and, when enabled, the semantic cache (prompt embeddings + response), both scoped per organization. Customers who want zero prompt persistence at any layer can enable no-persistence mode in the dashboard. The detail below spells out exactly what we keep and for how long, layer by layer.

2. What we store, what we don't

One row per category:

Cache hits never re-call the provider, so a hit is also a privacy improvement: your prompt + response stay inside our cache window and the upstream provider doesn't see the duplicate.

3. The no-persistence switch

You can flip a master switch in /dashboard/settings that disables both the prompt cache and the semantic cache for your organization. When it's off, no prompt or response content touches any of our caches for the lifetime of the request — the gateway emits an x-gateway-prompts-persisted: false response header so your monitoring can verify. A wipe-cache-now button on the same page deletes everything still in cache. Token counts, model, latency, and cost stay in request_log regardless — without them, billing and the dashboard stop working.

4. Where data is hosted

Singapore by default. The database and cache run in the same region. Other regions are available on request. All transit is TLS; data is encrypted at rest. BYOK provider keys are additionally encrypted client-side with AES-256-GCM before they reach the database — a leaked database dump alone reveals only ciphertext. Sub-processors named on /compliance.

Caches are scoped per organization. The cache key namespace is gw:cache:<type>:<orgId>:<hash> and lookups always include your organization id, so a cache entry from one organization can never satisfy a request from another.

5. Upstream providers

When we route your request to OpenAI, Anthropic, Google, DeepSeek, Qwen, GLM, Doubao, Kimi, Sarvam, or Krutrim, that provider receives the prompt content under their own terms-of-service and privacy policy. We use the standard REST API endpoints — not training endpoints — and most major providers contractually exclude API traffic from model training, but you should read their policies for the providers you care about. With BYOK enabled for a provider, that provider bills you directly and we never see the token money.

6. Billing data

Payments are processed by Stripe; we never see your card number. Stripe holds the payment details under its own privacy policy. We store the Stripe customer id, the subscription/checkout status, and an audit row per Stripe event that moves your credit balance (in the processed_stripe_event table). The audit row records the event id, type, the dollars credited or forfeited, and the timestamp — enough to reconstruct any balance later, without the payment-instrument data.

7. Cookies + sessions

The dashboard uses an HTTP-only session cookie issued by Better Auth on sign-in; we do not use third-party tracking cookies, and we do not embed analytics scripts on authenticated pages. The marketing site may carry privacy-respecting product analytics; if so it will be disclosed in this policy and excluded for any visitor whose browser sends Do-Not-Track.

8. Your rights

Singapore PDPA, Hong Kong PDPO, EU/UK GDPR, China PIPL, Japan APPI, and India DPDP all give individuals rights of access, correction, deletion, and portability for personal data. Email [email protected] with your organization id and we'll respond within 30 days. You can also delete your organization yourself from the dashboard; doing so cascades through cache, request_log, and BYOK keys.

9. Subprocessors

We use Fly.io (Singapore region) for compute, Neon for Postgres, Upstash for Redis, Stripe for payments, Better Auth for the authentication layer, and Grafana Cloud for logs, metrics, and error monitoring (with prompt-payload scrubbing on the no-persistence path). A current subprocessor list lives at /compliance and is updated when it changes.

10. Changes

We'll announce material changes at least 30 days in advance via the dashboard and the email address on your account. Mechanical clarifications can ship without notice but will be reflected in the effective date above.