Privacy policy

What you give us. Account details (email, name, organization), billing information handled by our payment processor, correspondence when you contact us, and the configuration you create - keys, budgets, locks, policies.

What flows through the gateway. Your Inputs and the Models' Outputs transit our infrastructure to be routed. We do not log their content in the ordinary course; the ledger stores metadata only - model, token counts, latency, exact cost, cache status, trace ID, and any metadata tags you attach. Features you explicitly enable (your organization's caches, batch processing) store content temporarily, scoped to your organization, solely to provide that feature.

What we collect automatically. Standard technical data: IP address, browser and device type, pages visited, and the request metadata needed for security, rate limiting and abuse prevention (including per-key IP and country checks you configure). We use privacy-respecting, cookie-light measurement: strictly necessary cookies for login and preferences (like your language choice), and no third-party advertising trackers. We do not serve interest-based ads and we do not sell personal data.

When you call a Model, your Input is transmitted to the provider you selected (or that switchgate/auto selected for you). Providers have their own data practices - including whether they retain Inputs or use them for training. Where a provider offers a no-training or zero-retention option, we take it, and we label each model's practices in the catalog. If you don't want your Inputs used for training, pick a model labeled accordingly, or serve your own through the Model Tunnel, where inference never leaves your network. We contractually require providers to comply with applicable data-protection law, but their own terms govern their independent processing.

Biometric-capable models. Some Models accept or produce image, audio or video. If you submit media containing an identifiable person - a voice, a face - you are responsible for having the notices and consents the law requires (GDPR, Québec privacy law, BIPA and similar). We pass media through for inference and don't extract or store biometric identifiers ourselves.

To provide and secure the Service (routing, billing, the ledger, fraud and abuse prevention, enforcing key policies you set); to run your account (notices, support, security alerts); to improve the Service using aggregated, de-identified measurements; to meet legal obligations; and, only if you opt in, to send product news you can unsubscribe from in one click. Public statistics - like the rankings pages - are built from aggregated, de-identified data, and app-level rankings are opt-in per organization.

With the Model providers you route to (that's the product); with service providers who help us operate (hosting, payments, email) under contracts limiting their use; within a corporate transaction (merger, financing, sale) with continuity of commitments; when the law requires it - we review requests, narrow them where we can, and notify you unless legally barred; and with your consent. We do not sell personal data and we do not share it for cross-context behavioral advertising.

Depending on where you live - Québec's privacy law, PIPEDA, the GDPR, the CCPA and others - you may have rights to access, correct, delete, port, and restrict or object to processing of your personal data, and to withdraw consent. Write to [email protected]; we verify identity, respond within the legal timeframe, and won't discriminate against you for exercising rights. Account deletion is available from support: once confirmed, associated personal data is deleted except what we must keep for legal, billing or security reasons. You can complain to your supervisory authority - in Québec, the Commission d'accès à l'information - though we'd appreciate the chance to fix it first.

TLS 1.3 in transit, AES-256 at rest, tenant-scoped caches, least-privilege internal access, and the key-level controls described on the security page. No internet transmission is perfectly secure; keep your credentials confidential and use the controls we give you - prepaid balances, IP locks, expiry - so a leaked key is an inconvenience, not an incident.

We keep personal data only as long as needed for the purposes above: ledger metadata for your accounting and our legal obligations; account data while your account exists; security logs briefly; content in opt-in features per that feature's documented window. When no longer needed, data is deleted or irreversibly anonymized.

Our control plane and ledger are hosted in Montréal, Canada - a jurisdiction with EU adequacy status. Requests you route necessarily travel to the provider you chose, wherever it operates; enterprise agreements can constrain routing to specific regions and add EU residency. Where data leaves the EEA/UK we rely on adequacy decisions and standard contractual clauses.

The Service isn't directed to children under 13 (or the higher local minimum, such as 14 for consent in Québec), and we don't knowingly collect their data. Classrooms use burnable keys under a teacher's organization, which is the design we recommend.

We'll post updates here and email account holders before material changes take effect; the date at the top always tells you the current version. Questions, requests, complaints: [email protected] · SwitchGate AI, Mile End, Montréal, Québec, Canada.