Privacy Policy

Introduction

SupaNexus ("we", "us", or "our") provides an enterprise LLM gateway platform, including our website, developer console, and OpenAI-compatible API (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and otherwise process personal data when you use the Service worldwide. Data protection requirements vary by country and region; where local law grants you additional rights or imposes additional obligations, those apply to the extent required. This policy is intended for business users acting in a professional capacity. The English version of this Privacy Policy is the legally binding version.

Personal Data We Collect

We collect personal data that is reasonably necessary to operate the Service. Categories may include:

• Account and profile data (such as email address, display name, organization and project identifiers, and authentication credentials or MFA settings).
• Usage and billing data (such as API call metadata, token counts, model identifiers, quotas, budgets, and payment-related records where applicable; not prompt/completion conversation text).
• API request handling: SupaNexus does not persist full conversation text on the server by default and does not maintain cross-request session history.
• Technical and security logs (such as IP address, user agent, timestamps, request identifiers, and error diagnostics; successful responses do not include completion text in these logs).
• Communications and support records (such as tickets or emails you proactively send to SupaNexus administrators or support channels; not OpenAPI model conversation content).
• Cookie and similar technology data as described in our Cookie Policy.

How and Why We Use Personal Data

We use personal data to provide, secure, and improve the Service, including authentication, authorization, routing, metering, billing, fraud prevention, abuse detection, customer support, and compliance with legal obligations. We process personal data only where we have a valid legal basis under applicable data protection law, which may include performance of a contract with you or your organization, legitimate interests (such as securing and operating the Service), compliance with legal obligations, and consent where required (for example, non-essential cookies).

How We Share Personal Data

We do not sell your personal data. We may share personal data with:

• Infrastructure and hosting providers that help us operate the Service.
• AI model providers: to fulfill inference, your API requests are forwarded in real time to the selected provider; SupaNexus does not store full conversation text—only call metadata and token statistics.
• Organization administrators for accounts provisioned under an enterprise or multi-tenant deployment.
• Professional advisers and authorities when required by law or to protect rights, safety, and security.

Retention

We retain personal data for as long as necessary to provide the Service, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods may vary based on data type, account status, backup cycles, and applicable law. For example, API call metadata and token usage details are typically retained for about 90 and 180 days respectively (subject to your deployment configuration); conversation text is not included. When data is no longer required, we will delete or anonymize it in accordance with our retention practices, subject to technical and legal limitations.

Security Measures

We implement commercially reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Where required by applicable law, we will notify affected parties and relevant authorities of a personal data breach in accordance with legal requirements.

Your Privacy Rights

Depending on your location and applicable data protection law, you may have rights to access, correct, delete, restrict, or object to certain processing, to withdraw consent where processing is consent-based, and to receive a copy of personal data in a portable format. To exercise these rights, contact your organization administrator (for enterprise accounts) or the team that deployed your SupaNexus instance. We may need to verify your identity before responding. If you are not satisfied with our response, you may have the right to lodge a complaint with a competent data protection authority in your jurisdiction.

International Data Transfers

We may process and store personal data in countries other than where you are located, including in facilities operated by us, our affiliates, or our service providers. Data protection standards differ across jurisdictions. When we transfer personal data internationally, we implement appropriate safeguards recognized under applicable law, such as standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms. Details about transfer safeguards may be available from your platform administrator or deployment team.

Automated Decision-Making

We do not use solely automated decision-making that produces legal or similarly significant effects concerning you as part of the Service.

Children's Privacy

The Service is intended for business and authorized professional use and is not directed at children. We do not knowingly collect personal data from anyone who is not permitted to use the Service under applicable law in their jurisdiction. If you believe we have collected such data in error, contact your platform administrator so we can take appropriate action.

Cookies and Similar Technologies

We use essential cookies to operate the website and remember preferences. Non-essential analytics cookies are used only with your consent. For details, see our Cookie Policy.

Enterprise and Self-Hosted Deployments

If your organization deploys SupaNexus in a self-hosted or enterprise environment, your organization may act as the data controller (or equivalent under local law) for certain processing activities, and SupaNexus may act as a processor or service provider. In those cases, your organization's policies, order forms, and data processing agreement govern to the extent they apply. Contact your administrator for a DPA, sub-processor list, or region-specific privacy information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date. Material changes may also be communicated through the Service or by your administrator where appropriate.

Contact Us

For privacy inquiries, contact your SupaNexus platform administrator or the team that deployed your instance.