Privacy Policy

What we collect

Account information you provide (email, username), payment records required for billing, and usage metadata from API requests: model, token counts, cost, latency, status, and timestamps.

We also record the IP address each API request comes from, together with the request ID, and derive the country it originates from (stored as a two-letter country code, resolved offline — your IP is never sent to third-party geolocation services). This powers usage statistics such as which AI models are popular and request volumes by region. No city-level or precise location is stored.

What we do not store

Prompt and response bodies are not stored by default. Passwords are stored only as salted hashes. API key secrets are stored only as hashes and are shown exactly once.

How data is used

To operate the service: authenticate requests, meter usage, calculate charges, show you your own analytics, and support you when you contact us. IP address and country are used only to build aggregate platform statistics (for example, which AI models are popular, request volume, and spend by region) and to protect the service against abuse; they are never used to build individual profiles and never sold.

Sharing

We do not sell your data. Content you send is transmitted to the upstream model provider selected to serve the request. Payment details are processed by our payment providers.

Retention and deletion

Usage metadata is retained for billing and analytics and rolled off according to our retention schedule. You may request account deletion through support; billing records are kept as required by law.

Canadian privacy compliance (PIPEDA)

CanRouter AI is a Canadian business and manages personal information in alignment with the Personal Information Protection and Electronic Documents Act (PIPEDA): we collect only the personal information needed to operate the service (account details, billing records, and usage metadata), we tell you why we collect it, we keep it only as long as required for those purposes, and we protect it with safeguards appropriate to its sensitivity.

Data residency: account, billing, and usage records are stored on servers we operate. Requests are relayed to the upstream AI providers (OpenAI, Google, Meta, Anthropic, xAI, Nous Research, DeepSeek, Alibaba (Qwen), ByteDance (Doubao), Z.AI (GLM), Moonshot (Kimi), MiniMax, Tencent (Hunyuan), Baidu (ERNIE), iFlytek (Spark), Xiaomi, 01.AI, Black Forest Labs (FLUX), Midjourney, Kuaishou (Kling), PixVerse, Shengshu (Vidu), Suno, SiliconFlow, and other model vendors served through our partner platform) needed to serve them, and payment details are processed by our payment providers.

Your PIPEDA rights: you may access the personal information we hold about you, ask for corrections, and withdraw consent (subject to legal and contractual retention duties) by contacting [email protected]. We respond to privacy requests within 30 days. If you have concerns that are not resolved with us, you may contact the Office of the Privacy Commissioner of Canada.

Compliance program

Our full compliance program — customer reviews, abuse prevention, Canadian support commitments, and platform capability disclosure — is documented openly on our Compliance page.