Privacy Policy | RouterLab

routerlab/legalprivacy

1. Data Controller

The data controller is:

Eyelo SA Rue du Simplon 37 1006 Lausanne Switzerland UID: CHE-108.174.302 Email: [email protected]

Eyelo SA, a Swiss corporation based in Lausanne, Switzerland (UID: CHE-108.174.302), operates the RouterLab service.

This policy describes how Eyelo SA collects, uses, stores, and protects data in connection with the use of its services, specifically the RouterLab platform.

2. Nature of Data Collected

To prevent repeated free-trial attribution, RouterLab stores a random strictly necessary cookie for 400 days and creates HMAC fingerprints of the normalized email address and browser identifier when a trial is granted. These fingerprints are kept indefinitely to prevent another trial, including after account deletion. Detailed signup-security events are kept for 90 days and automatically purged each day.

Eyelo SA only collects data necessary for the provision of the service, security, support, billing, and the proper functioning of the platform.

These data may include:

account information, such as the email address and information necessary to identify the user;
information necessary for billing, payments, and subscription management;
technical data necessary for the operation of the service, such as IP address, browser, access times, technical logs, and usage statistics;
consumption information, including the number of tokens used, models called, dates of use, and amounts consumed;
information voluntarily transmitted by the user via a contact form, support request, API request, or any other communication channel with Eyelo SA.

RouterLab does not permanently log or archive the content of prompts and responses. Where technical caching is used, prompt and response content may be temporarily stored for up to 10 minutes. The corresponding cache entry expires automatically after that period and is no longer accessible through the service.

3. AI Models Hosted by RouterLab

RouterLab provides access to several types of AI models.

Some models identified as hosted by RouterLab are run on infrastructure used by Eyelo SA to provide the service in Switzerland and Germany.

When the user chooses an open-source model identified as hosted by RouterLab, the requests required to run it are processed on infrastructure used by Eyelo SA to provide the service in Switzerland and Germany. In this case, the data is not transmitted to OpenAI, Anthropic, Google, or another third-party model provider for execution.

Certain requests, including multimodal requests, may undergo internal technical transformations required for their execution. These operations are carried out on RouterLab service infrastructure in Switzerland or Germany and do not involve any additional transmission to an external model provider.

Eyelo SA applies reasonable technical and organizational measures to protect data processed on its infrastructure, in particular for the security, availability, and proper functioning of the service.

4. AI Models and Services Provided by Third Parties

Some models accessible via RouterLab are provided by third-party providers, such as OpenAI, Anthropic, Google, AWS, Azure, Vertex AI, Grok/X, or other providers.

When the user chooses a model provided by a third-party provider, the data necessary to execute the request is transmitted to the relevant provider. The processing of this data then depends on the conditions, privacy policies, and commitments specific to that provider.

In this case, Eyelo SA acts as a technical gateway between the user and the selected provider. Eyelo SA cannot substitute itself for the operational, contractual, or regulatory guarantees specific to these providers.

Depending on the provider and the chosen model, the data may in particular:

transit outside of Switzerland or the European Union;
be processed on the infrastructure of the relevant provider;
be subject to the retention, security, and processing conditions specific to that provider.

The user is informed that choosing a third-party model may involve processing by the relevant provider, in accordance with the conditions applicable to that third-party service.

5. Technical Providers and External Services

Eyelo SA may use certain external providers necessary for the operation of its services, specifically for:

hosting and technical infrastructure;
orchestration and execution of models;
billing and payments;
security;
support;
communications with users.

These providers may include Stripe for billing and payments, as well as certain providers of infrastructure, AI APIs, or technical services necessary for the operation of RouterLab.

Eyelo SA limits the use of these providers to the needs necessary for the operation of the service.

6. Purposes of Processing

Data is used for the following purposes:

provide access to services and AI models;
allow the creation and management of user accounts;
manage subscriptions, payments, invoices, and credits;
measure service consumption, including the number of tokens used;
ensure the security, prevention of abuse, and stability of the platform;
respond to support or contact requests;
improve the technical functioning of the service;
comply with applicable legal, accounting, or regulatory obligations.

7. Cookies

The random browser identifier cookie used to prevent repeated trial attribution is strictly necessary for the service and is stored for no more than 400 days.

The site uses cookies necessary for the service to function. Optional Google Analytics 4 audience measurement cookies are used only after you accept.

Google then receives public page addresses without query parameters or fragments, the referring site domain and technical browsing and connection information. Our measurement component does not transmit private pages, email addresses, API keys or API request content. Google processes this data on its infrastructure, which may be outside Switzerland. You can refuse measurement or withdraw consent using “Measurement preferences”.

These cookies may include:

technical cookies necessary for navigation, login, or security;
cookies related to payments or fraud prevention, particularly via Stripe;
cookies strictly necessary for the operation of the user area.

Eyelo SA does not use advertising cookies for commercial targeting purposes.

8. Data Transmission

Eyelo SA does not sell users' personal data.

Data may be transmitted only when necessary:

to technical providers essential to the operation of the service;
to payment and billing providers;
to AI model providers when the user chooses a third-party model;
to competent authorities in case of legal obligation;
to support or security providers when necessary for the protection or proper functioning of the service.

Eyelo SA strives to limit these transmissions to data strictly necessary for the relevant purpose.

9. Security

Eyelo SA applies reasonable technical and organizational measures to protect the data under its control against unauthorized access, loss, alteration, or misuse.

These measures may include:

access control;
use of secure connections;
limitation of retained data;
technical monitoring of the service;
separation of environments when relevant;
logging necessary for security and technical diagnostics.

However, no data transmission or storage over the Internet can be guaranteed as completely secure.

When data is transmitted to a third-party provider chosen in connection with the use of a third-party AI model, the security and processing of such data also fall under the measures, policies, and commitments specific to that provider.

10. Retention Period

Detailed signup-security events are kept for 90 days and automatically purged each day. The Trial anti-reassignment register keeps the HMAC fingerprints of the email address and browser identifier associated with a granted trial indefinitely.

Data is retained only for the time necessary for the purposes for which it is processed.

Prompt and response content is not permanently retained by RouterLab. Where technical caching is required, such content is retained for no longer than 10 minutes, after which the corresponding cache entry expires.

Certain data may be retained longer when necessary to:

comply with applicable legal, accounting, or tax obligations;
ensure the security of the service;
manage a dispute, claim, or support request;
retain information necessary for billing and proof of transactions.

Accounting data may notably be retained for the period required by Swiss law, for example up to 10 years where applicable.

Data processed by third-party providers follow their own retention policies and periods.

11. User Rights

In accordance with applicable law, including the Swiss Federal Act on Data Protection (FADP) and, where applicable, the General Data Protection Regulation (GDPR), users may request:

access to their data;
rectification of inaccurate data;
deletion of their data, where applicable;
restriction of processing;
objection to processing, where applicable;
information on the processing carried out;
where the GDPR applies, portability of data provided under the conditions established by law;
withdrawal of consent at any time where processing is based on consent;
lodging a complaint with the competent data protection authority.

Any request can be sent to Eyelo SA by email to the following address: [email protected]

Eyelo SA may request additional information to verify the identity of the requester before processing the request.

12. Legal Basis for Processing

Data processing is based notably on the following legal grounds:

performance of the contract, when data is necessary for the provision of the service;
Eyelo SA's legitimate interest, particularly for security, abuse prevention, support, and service improvement;
user consent, where required;
compliance with applicable legal, tax, accounting, or regulatory obligations.

13. Hosting and International Transfers

Data under the direct control of Eyelo SA, together with open-source models identified as hosted by RouterLab, is processed on infrastructure located in Switzerland and Germany.

When the user chooses a proprietary model, the data required to process the request is transmitted to the relevant provider, including OpenAI, Anthropic, or Google. Depending on the selected route and provider commitments, this data may be processed outside Switzerland or the European Union and is then subject to the safeguards and terms applicable to that provider.

If Eyelo SA were to move a significant portion of its own infrastructure to another country in the future, users would be transparently informed.

14. Data Sent via APIs

The user is responsible for the content they transmit via the APIs or interfaces provided by RouterLab.

It is the user's responsibility not to transmit sensitive, confidential, medical, financial, regulated data, or data belonging to third parties, unless they have the necessary rights and accept the processing conditions applicable to the chosen model or provider.

Eyelo SA recommends that professional users check the type of selected model before sending sensitive data:

model hosted directly by RouterLab;
model provided by a third-party provider;
model involving an international transfer;
model subject to the specific terms of an external provider.

15. Policy Update

Eyelo SA may modify this privacy policy to adapt it to changes in its services, infrastructure, providers, or applicable legal obligations.

In the event of a significant change, Eyelo SA will endeavor to inform users appropriately.

16. Applicable Law and Jurisdiction

This policy is governed by Swiss law.

The place of jurisdiction is located in the Canton of Vaud, subject to applicable mandatory provisions.