Privacy Policy

Effective date: 2026-07-10. Applies to the Routeplane gateway, the managed service, and the open-source (Apache-2.0) core.

This policy explains what data flows through Routeplane, what [Legal entity name] (“Routeplane”, “we”) collects when you use the managed service, how it is handled, and the rights you have over it. Routeplane is a neutral, multi-provider, OpenAI-compatible AI gateway: it sits in front of the LLM providers you choose and routes each request according to your configuration.

Data that flows through the gateway

When you send a request, your prompt (and the model’s response) passes through the gateway on its way to and from the provider you route to. Two things happen on that hot path, by design, before your data leaves our boundary:

• Deterministic redaction. Personally identifiable information and secrets are detected and masked on the request path (and, best-effort, on responses) using deterministic rules — not a model call. This is on by default and is not an implicit opt-out.
• Sovereign routing. When a request carries regulated personal data and a residency region, provider eligibility is region-locked so that regulated data is only routed to providers resident in that region. This is a hard constraint that overrides your provider preference.

We do not use your prompts or responses as training data, and we do not sell them. See “We do not train on your data” below.

What we collect

• Account details — the identifiers needed to create and administer your tenant.
• Virtual keys — issued to authenticate your requests. Keys are stored as a one-way hash at rest, never in plaintext.
• Usage & telemetry metadata — per-request operational metadata (provider, latency, token counts, routing decision, timestamps) used for cost/FinOps reporting, reliability, and the audit ledger. This is metadata about the call, distinct from the prompt/response content that transits the gateway.
• Audit ledger entries — a hash-chained, tamper-evident record of governed decisions (for example, the sovereign routing decision), kept so that compliance can be demonstrated after the fact.

We do not train models on your data

Routeplane does not train, fine-tune, or otherwise build models on your prompts, responses, or usage data. Your content passes through only to serve the request you made.

Subprocessors — the providers you choose

Routeplane is neutral by design: it does not host a model of its own. The LLM providers you configure Routeplane to route to are effectively your subprocessors — your data goes to them, per your routing configuration. Each provider processes your data under its own terms and privacy policy, which you are responsible for reviewing and accepting. Sovereign routing lets you constrain which providers are eligible for regulated data by region.

Self-hosting — you are the controller

The Routeplane core is available under Apache-2.0 for self-hosting. When you run it on your own infrastructure, your data stays on your infrastructure; you are the data controller and this managed-service policy does not apply to that deployment. We receive none of your prompt, response, or usage data.

Retention

Prompt and response content is processed transiently to serve the request and is not retained by the gateway as a matter of course. Usage metadata and audit-ledger entries are retained for as long as needed to provide the service, meet the compliance and record-keeping obligations they exist to satisfy, and for the period stated in your agreement. Specific retention windows are set out in your contract or the applicable [jurisdiction] requirements.

Your rights

Subject to the applicable law of [jurisdiction], you may request access to, correction of, or deletion of the personal data we hold about you, and you may withdraw consent where processing relies on it. This policy is written to align with India’s Digital Personal Data Protection Act (DPDP) as the primary framework and with the GDPR where it applies; HIPAA handling is available via the corresponding compliance pack. To exercise a right, contact us below.

Contact

Data-protection questions and rights requests: rp_maintainers@routeplane.ai. The controller of record for the managed service is [Legal entity name], [jurisdiction].