Privacy notice

1. Controller and contact

SwitchRoute is operated by SIA Enfluidity, registration number 50203721791, VAT number LV50203721791, Krišjāņa Barona iela 130 k-9, Rīga, Latvija, LV-1012 (“we”, “us”, or “SwitchRoute”). SIA Enfluidity is the controller of the personal data described in this notice.

For privacy requests or questions, email aigars.ozolins@enfluidity.com.

2. Data we process

• Website and consent data: technical request information, security logs, and your privacy-choice setting. Optional marketing analytics are only used when you opt in.
• Account and identity data: email address, Google identity identifier when you choose Google sign-in, organisation membership, session information, and account settings.
• Service and routing data: API request content, prompts, messages, model selections, routing decisions, usage measurements, and related telemetry needed to deliver, secure, troubleshoot, and improve the service.
• Billing data: customer and subscription references, payment status, invoices, and transaction records. We do not store full payment-card details.
• Support and communications: information you send when you contact us.

Please do not submit special-category data or other sensitive personal data through the service unless you have a valid legal basis and have configured the service appropriately for that processing.

3. Why we process data

• To provide the website, authentication, account, billing, API routing, and support services, we process data to perform our contract with you or to take steps at your request before entering a contract.
• To protect our systems, prevent abuse, investigate faults, maintain security, and keep audit-grade operational records, we rely on our legitimate interests in operating a secure and reliable service.
• To comply with accounting, tax, and other applicable legal obligations, we retain the data required by law.
• We use optional marketing or analytics technologies only with your consent. You can withdraw that consent at any time through Privacy choices.

4. Retention

We keep personal data only for as long as needed for the purposes above. Routing-decision retention is configurable by an organisation and defaults to 30 days. Account deletion removes the account, keys, and associated routing data from active systems, subject to lawful retention requirements and the time needed for secure deletion from backups. Billing and tax records may be retained for longer where required by law.

5. Service providers and recipients

We use processors and service providers to operate SwitchRoute, including Cloudflare for edge delivery and infrastructure, Supabase/PostgreSQL for database services, Stripe for payments, Sentry for error monitoring, Google and our email providers for sign-in and account communications, and model providers including OpenAI, Anthropic, Google, DeepSeek, and xAI.

When you use the routing service, the request content needed to generate a response is sent to the model provider selected by the applicable routing configuration. Your organisation’s configured providers and routing choices therefore determine which provider receives a given request.

Some recipients may process data outside the European Economic Area. Where that occurs, we use the transfer mechanism required by applicable law, such as an adequacy decision or the European Commission’s standard contractual clauses with supplementary measures where appropriate.

6. Security

We use technical and organisational measures designed to protect personal data, including access controls, encrypted secrets, restricted operational logging, and redaction of sensitive request metadata in observability systems. No internet-based service can guarantee absolute security.

7. Your GDPR rights

Depending on the circumstances, you may request access, rectification, erasure, restriction, objection, and portability of your personal data. You may also withdraw consent at any time where processing is based on consent; this does not affect processing completed before withdrawal.

To exercise a right, contact aigars.ozolins@enfluidity.com. You also have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) or the supervisory authority in your habitual residence, workplace, or the place of the alleged infringement.

8. Changes to this notice

We may update this notice when our processing changes or when required by law. We will publish the current version here and update the effective date above.