Privacy Policy
What we collect
- Account: your email and sign-in identity (via Firebase).
- Billing: handled by Stripe; we store subscription/credit state and Stripe identifiers, never your card number.
- Device + usage: device pairing state, and metered LLM-router usage (token counts and cost), for billing and operations.
LLM router traffic
When you use the router, your inputs leave our system: your request is forwarded to the third-party model provider you addressed (OpenAI, Anthropic, Mistral, or Z.ai) using our credentials, and that provider processes it under its own terms. We do not train models on your inputs, and we do not store the content of your requests or responses for our own purposes, except as described next for moderation.
Automated moderation
- To enforce the Acceptable Use Policy, the textof forwarded router requests and responses is automatically classified by a moderation service (Mistral). Non-text content (for example images) is not classified.
- If nothing is flagged, nothing is stored from that traffic.
- If content is flagged, we store a bounded excerpt plus category scores, review it (an automated reviewer and, where escalated, a human moderator), and retain it for up to 30 days (dismissed) or 90 days (actioned/escalated). Content subject to a legal-preservation obligation is retained as required by law.
- Requests we refuse (rate limits, disabled router, no entitlement, no credits) are never sent to a provider and are not classified or stored.
Subprocessors
We use these providers to run the service:
- Google Cloud - hosting and database.
- Cloudflare - DNS and edge.
- Stripe - payments.
- Firebase (Google) - authentication.
- Mistral - moderation classification (router traffic only).
- OpenAI / Anthropic / Mistral / Z.ai - the model providers your router traffic is forwarded to, at your direction.
We offer a Data Processing Addendum to business customers who act as a data controller.
Your choices
You can export your personal data as a downloadable file, anddelete your account, from your account settings (self-serve). You can also email support@cumulo-nimbus.ai and we will act within the period the applicable law requires. Deleting your account removes your account records; some records (billing history, and moderation records under a legal-preservation obligation) may be retained where the law requires. We do not sell your personal data.