Draft, not yet legally reviewed. Not in force.
Privacy Policy
Last updated [date]
This policy explains what personal data NuRoute Chat (chat.nuroute.ai) processes, why, and your rights.
Controller: [company legal name], [address], [privacy email]. [Data protection officer, if required.]
What we process, and why
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Email address, name (from Google sign-in, if used) | Your account and sign-in | Contract (Art. 6(1)(b) GDPR) | Until you delete your account |
| Your chats: messages, answers, web searches made for them, sources | To show you your chats | Contract | Until you delete them or your account |
| Token counts per request (no text) | Your weekly allowance, limits, invoicing, preventing abuse | Contract; legitimate interest (Art. 6(1)(f)) | Kept without link to you after account deletion |
| 👍/👎 ratings with the model that answered (no text) | Improving which model answers | Legitimate interest | Kept without link to you after account deletion |
| A one-way hash of your email and your card's fingerprint | One free trial per person | Legitimate interest | Kept after account deletion |
| Subscription and payment status | Billing | Contract; legal obligation (Art. 6(1)(c)) | As tax law requires |
| Waitlist email | Telling you when you can sign in | Consent (Art. 6(1)(a)) | Until you're let in or ask us to remove it |
| IP address, browser, technical logs | Security and abuse prevention | Legitimate interest | [N] days |
Your chats are never used to train AI models.
Who receives data
- AI model providers, through the NuRoute gateway. To answer, your messages go to NuRoute's routing gateway and from there to the provider of the model chosen. The gateway stores no message content for this service. Providers may keep API data for up to about 30 days to detect abuse. [List of providers and their regions.]
- Brave Search receives the search query when an answer needs the web, never your account details.
- Stripe (payments). Stripe receives your payment details directly; we never see your full card number.
- [ZeptoMail by Zoho / Resend] sends sign-in and service emails.
- Google, only if you sign in with Google.
- Cloudflare Turnstile checks that sign-up and waitlist requests come from a person.
- Hosting: [provider], servers in the EU.
Where a recipient is outside the EU/EEA, transfers rely on [adequacy decisions / Standard Contractual Clauses].
Cookies and storage
We use one cookie to keep you signed in. Your light/dark choice is stored in your browser. No advertising or analytics cookies.
Your rights
You can access, correct, export and delete your data (Account → Export my data, Delete account), restrict or object to processing, and withdraw consent at any time. You can complain to a data protection authority, for example [competent authority].
Contact: [privacy email]