Privacy Policy

Who is responsible

The data controller is NightRouter, operated from Vietnam. Contact for privacy questions: support@nightrouter.ai.

Data we collect

• Account data: username, email address if you give one, password (stored only as a bcrypt hash), and the sign-in provider if you sign in with a third-party account.
• Usage records: for each API request, the model, token counts, time, duration, cost, API key name and request ID. We use them to bill you and to show your usage logs.
• Payment records: amount, currency, payment method, transaction reference and status. When card payments are offered, card details are handled by Waffo Pancake, our PCI-DSS certified payment processor, and never reach our servers. For USDT payments, the wallet address and transaction hash on the blockchain.
• Technical data: IP address, browser or client type and request metadata, used to run, secure and rate-limit the service.
• Support messages: what you send us when you contact support.

Content you send through the API

Prompts, files and responses are forwarded to the model provider that handles your request so that it can produce a result. We do not store the content of your requests or responses in our usage logs, we do not use it to train models and we do not sell it. Model providers process content under their own policies and may keep it for a limited time, for example for abuse monitoring.

How we use data

• To create and run your account, authenticate you and route your requests.
• To bill accurately by usage, process top-ups and show your balance and logs.
• To give support, handle refunds and resolve disputes.
• To prevent fraud, abuse and security incidents.
• To meet our legal and accounting obligations.

We use data on the basis of our contract with you, our legitimate interest in running a secure service, and our legal obligations. We do not sell personal data and we do not use it for advertising.

Sharing

• AI model providers that handle your requests receive the content of those requests.
• Payment processors: Waffo Pancake for card and related payments when they are offered, the bank for VND transfers, and the blockchain network for USDT payments.
• Infrastructure providers that host and protect the service, such as our server and Cloudflare network providers, under confidentiality obligations.
• Competent authorities, when the law requires it, or when the law allows it in order to report suspected illegal content, such as child sexual abuse material, or to protect someone from serious harm.

Some of these providers are outside Vietnam, so your data may be processed in other countries.

Retention

• Account data: while your account is open; after you close it, we delete or anonymize it within a reasonable time, normally within 30 days.
• Usage and payment records, including the IP address recorded with each request: as long as needed for billing, accounting, refunds and dispute handling, and not more than 5 years.
• Server logs: up to 90 days, unless needed longer to investigate a security incident.
• Support messages: up to 2 years.

Security

Connections to NightRouter use HTTPS. Passwords are stored as bcrypt hashes. API keys are visible only in your own account, and you can revoke them at any time. Access to our systems is limited to what is needed to run the service. No system is completely secure; if a breach affects your data, we will tell you without undue delay.

Your rights

You can view and update your account details and change your password in your account settings. You can also ask us to access, correct, export or delete your personal data, or object to its use, by writing to support@nightrouter.ai. Write from the email address on your account, or include your username and recent transaction details so we can verify that the account is yours. We aim to reply within 30 days. Depending on where you live, you may also complain to your data-protection authority.

Cookies

We use only first-party cookies that the website needs to work: a session cookie that keeps you signed in, a cookie for your account ID, cookies that remember your language, theme and currency, and short-lived cookies used during third-party sign-in. We do not use advertising or third-party tracking cookies. You can delete cookies in your browser, but you will then be signed out.

Children

NightRouter is not intended for anyone under 18, and we do not knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.

Changes and contact

We may update this policy and will publish the new version on this page with a new "Last updated" date. For significant changes we will also notify you on the website or by email at least 14 days before they take effect. Questions: NightRouter · support@nightrouter.ai.