Scope
This notice covers the hosted platform: the web app and the API at the address in the footer. It does not cover self-hosted deployments of the open-source package, which store data only where their operator configures it, and it does not cover the third-party model providers your requests are forwarded to when you ask for execution.
What is stored
| Data | Contents | Why |
|---|---|---|
| Account | Email address, display name, plan, creation time, Stripe customer id (paid plans only), workspace kind and slug. | To operate the account and bill it. |
| Sign-in identities | Provider (GitHub, Google, Microsoft, GitLab or your organization's identity provider), the provider's subject id, the email, name and avatar URL it returned, first and last sign-in time. | To sign you in without a password. |
| Browser sessions | A hashed session token, the provider used, creation, expiry and last-seen time, the browser user-agent string (first 200 characters). | To keep you signed in for up to 30 days and let you review and revoke sessions. |
| API keys | A SHA-256 hash of the key, its prefix, a name you give it, creation, last-use and revocation time. The key itself is shown once and never stored. | To authenticate API requests. |
| Usage records | Per metered request: timestamp, endpoint, chosen target, model, success flag, HTTP status, latency, token count, cost, request id, detected domain and complexity score. | To enforce quotas, show usage, savings and activity in the dashboard, and compute the public model statistics and rankings in aggregate. |
| Tenants, members, invitations | Tenant slugs and their constraint configuration; organization memberships with roles; pending invitations (email and role). | To apply per-tenant policy and manage organization access. |
| Marketplace | Listings you publish (manifest, description, versions), installs, ratings and reviews under your account. | To run the marketplace. Published listings and reviews are public. |
| Signup throttle | A per-IP daily counter. | To limit automated signups. Not linked to an account. |
| Billing events | Stripe webhook payloads (checkout completed, subscription changes). | To reconcile plan changes with payments. |
Request content
The text you route - the prompt, chat history and context - is processed in memory to extract signals and make the decision. It is not written to the usage records, the activity log or server logs. When you set execute or call the OpenAI-compatible endpoint, the text is forwarded to the model provider behind the chosen target and their terms apply; the platform keeps the token counts and cost of that call, not the content or the answer. Values in profile are hashed before they reach the learners. PII detection runs on every request so that a tenant's data_boundary can keep sensitive requests on private targets; the detection result is a flag, and the detected values are not stored. Details are in the platform guide and the security model.
Cookies and browser storage
Your API key or session token is kept in this origin's localStorage so the dashboard can call the API; signing out removes it. The sign-in flow uses a short-lived signed state value to complete the redirect from the identity provider. Your analytics choice (below) is stored under osr-consent.
The public pages (landing, models, docs, pricing, sign-up) load Google Analytics 4 to count page views, sign-ups, clicks on calls to action and outbound links, copies of code snippets and page-speed measurements (Core Web Vitals). It runs in Google's consent mode: until you accept the banner no analytics or advertising cookies are set and Google receives only cookieless, unidentifiable pings; IP addresses are truncated. The dashboard never loads the tag. Declining or changing your choice takes effect immediately:
Who processes it
- Hosting - the web app and API run on Microsoft Azure (Container Apps) in the Sweden Central region; the database lives in the same region.
- Payments - Stripe handles checkout and card details; the platform never sees card numbers and stores only the Stripe customer id and webhook events.
- Sign-in - GitHub, Google, Microsoft, GitLab or your organization's OIDC provider, only when you choose to sign in with them.
- Model providers - only when execution is requested, and only the provider behind the chosen target.
- Analytics - Google LLC (Google Analytics 4) for aggregate page-view and sign-up statistics on the public pages, subject to the consent choice above. Analytics data is not linked to your account and is never joined with usage records.
Usage data is not sold or shared with anyone else, and public statistics are aggregates that cannot be traced to an account.
Retention
Account, key, tenant and marketplace records are kept while the account exists. Usage records are kept for the life of the account; the dashboard shows the last 30 days and the API returns per-day totals for the range you ask for. Browser sessions expire after 30 days of inactivity and can be revoked earlier under Account. Revoked API keys are kept as revoked so that their prefix can be recognised in old records.
Access, export and deletion
Everything above is readable through the API with your own key: GET /api/v1/me, /keys, /usage, /activity, /tenants, /auth/identities, /auth/sessions and /me/listings. You can revoke keys and sessions, unlink identities, leave organizations and archive listings yourself. To delete the account and its records, write to security@opensmartroute.org from the account's email address; deletion removes the account, keys, identities, sessions, tenants and usage records, and anonymises reviews you left.
Changes
This page is versioned with the rest of the site in the repository; the history of the file is the history of the notice. Material changes are also noted in the changelog.