CloudAct privacy & data

We act as the Data Controller for account, billing, and operational data, and as a Data Processor for LLM request content submitted through our API.

Identity: email address, full name, avatar URL

Signup metadata: phone number, country code

Financial: credit amounts, transaction types, timestamps (no payment card data stored — Stripe handles PCI)

Request content: prompts and completions sent through our API

Request metadata: model, token counts, cost, latency, timestamps

Route LLM requests to providers and track usage costs

Process payments and manage credit balances via Stripe

Maintain audit logs for security and compliance (SOC 2-aligned)

Zero data retention (never written to disk or database; processed ephemerally in memory only)

Until account deletion + 30-day grace

Credit transactions 7 years

30 days after expiration (auto-purged)

Our application compute infrastructure is hosted in the US (Microsoft Azure Container Apps, East US) and our managed database infrastructure is hosted in the US (Supabase, Oregon).

EU data residency options (European Union (Netherlands) and EU North (Stockholm)) are available for organizations that require data to remain within the EEA.

The EU-US Data Privacy Framework (DPF) for certified sub-processors

Standard Contractual Clauses (SCCs) adopted by the European Commission (Commission Implementing Decision (EU) 2021/914)

The current sub-processor register is available upon request at privacy@nrouter.ai .

A pre-signed DPA is available for organizations that require one under GDPR Art. 28.

Request deletion of your account and all associated data. Available via Organization Settings > Danger Zone > Delete Organization .

Right of access (Art. 15): Request a copy of all personal data we hold about you.

Right to rectification (Art. 16): Update your name, email, or other account details from your profile settings.

Right to erasure (Art. 17): Request deletion of your account and all associated data.

Right to data portability (Art. 20): Export your data in a structured, machine-readable format (JSON).

Right to restrict processing (Art. 18): Request that we limit how we process your data while a dispute is resolved.

Right to object (Art. 21): Object to processing based on legitimate interest.

Right to lodge a complaint: You may file a complaint with your local supervisory authority

We do not use your LLM request content to train models, serve advertisements, or share with third parties beyond the sub-processors listed below.