Privacy Policy

1.Who we are

Final Router is an API gateway for large language models. You send us a request, we choose a model, forward the request to the provider that serves it, and return the answer. This policy explains what happens to data along that path.

For the account data described here, Final Router is the data controller. For the prompts and completions you route through the gateway, Final Router is a data processor acting on your instructions — those are governed by our Data Processing Addendum.

Final Router is operated by INNOVIDEN GP, a general partnership registered in Greece, at Zalokosta 8, Kolonaki, Athens, Greece. INNOVIDEN GP is the controller referred to throughout this policy, and is established in the EU, so our lead supervisory authority is the Hellenic Data Protection Authority.

Questions about anything below go to privacy@finalrouter.com, and we answer within five working days. General support is support@finalrouter.com.

2.What we collect

We group everything we hold into four buckets. Nothing outside these buckets is collected.

We do not use advertising trackers, we do not sell data to anyone, and we do not build advertising profiles. The site sets one cookie category — the session cookie that keeps you signed in — plus a short-lived cookie for CAPTCHA on the sign-up form.

3.Prompts and completions

This is the part most people are asking about, so it gets its own section.

• By default, prompt and completion bodies are held in memory only for as long as it takes to route a request and stream the answer back to you. They are not written to our database.
• We do not use your prompts or completions to train models, and we do not permit our staff to read them in the ordinary course of running the service. This holds whether or not you switch on the storage described below.
• We store metadata about the request — token counts, cost, latency, which model answered — because we cannot bill you or show you a usage chart without it. Metadata is not content.
• The provider that serves your request receives the prompt directly and applies its own retention policy. We link to every provider's policy in the dashboard so you can check before you route to them.

There is one exception, and it is yours to switch on. Prompt storage, in Settings, keeps the text of your requests and the replies so you can read them back in your own request log. It is off unless you turn it on. Nothing stored this way is used for anything except showing it to you.

• Kept for up to 30 days from the request — your account can choose a shorter window in Settings — then deleted automatically.
• Deleted immediately, and in full, the moment you turn the setting off.
• Readable only by your own account. Enforced by the database, not only by our code.
• Deleted with your account, like everything else.

If the prompts you send us contain other people's personal data, switching this on makes us store that data on your instructions. Whether that is lawful, and whether those people need telling, is your decision as the controller — the Data Processing Addendum sets out how we handle it once you have made it.

If you need contractual guarantees rather than a policy statement, the Data Processing Addendum makes the same commitments enforceable.

4.How we use it

Each use below is tied to a lawful basis under the GDPR.

5.Who else sees your data

We use a small set of processors, each with a data processing agreement in place. We add none silently — this list is the list.

Beyond that, we disclose data only when the law requires it, and only after checking that the request is valid and as narrow as it can be. Where we are permitted to tell you, we will.

6.How long we keep it

Deleting your account from Settings removes your profile, API keys, provider credentials, request metadata, stored prompts and routing rules immediately — not within 30 days — and removes your customer record and any saved card from Stripe, our payment processor, at the same time. Two things survive on purpose. Records of money that actually changed hands, meaning purchases and refunds, are kept for the 7 years tax law requires, with your account identifier removed from them so they are no longer about you; they are used for nothing but accounting. Stripe separately keeps its own record of those payments under its own legal obligation. Everything else, including the per-request usage ledger, is deleted with the account.

7.Your rights

If you are in the UK, EU or EEA, the GDPR gives you the rights below. We extend them to every user regardless of where they are, because operating two standards is a good way to get one of them wrong.

• Access — see a copy of what we hold about you, without asking: the same JSON export in Settings covers it.
• Rectification — correct anything inaccurate.
• Erasure — delete your account and the data attached to it.
• Portability — download everything we hold about you as one JSON file from Settings, or export the request log as CSV from the logs screen. Both are self-serve, any time, without asking us.
• Restriction and objection — tell us to stop a particular processing activity.
• Withdraw consent — unsubscribe from product email without affecting your account.

Email privacy@finalrouter.com to exercise any of these. We do not charge, and we respond within 30 days. If you think we have handled your data badly, you can complain to your local supervisory authority — but we would rather you told us first.

8.Security

Provider credentials are encrypted at rest with AES-256-GCM under a key we hold outside the database, and they are never returned to a browser once saved — the dashboard shows only the last four characters. Final Router API keys are stored as hashes, so a database dump does not yield a usable key.

Every table is protected by row-level security, so one account's rows are unreachable from another account's session even if application code has a bug. Traffic is TLS 1.2 or better end to end. Our security page describes the full control set.

9.International transfers

Your account data and request metadata live in the EU. Some processors, and most model providers, operate outside the EEA. Where data leaves the EEA we rely on the European Commission's Standard Contractual Clauses, the UK Addendum where the UK GDPR applies, or an adequacy decision where one exists.

You control which providers your traffic reaches. Restricting your account to EU-hosted models in the dashboard keeps prompt content inside the EEA.

10.Children

Final Router is a developer tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will remove it.

11.Changes to this policy

When we make a material change we email every account holder at least 30 days before it takes effect, and the effective date at the top of this page changes. Minor clarifications are published without notice, and the effective date still moves so you can tell something changed.