Privacy, in plain English.

1. What llmdeal logs

For every API call, the only fields we write to durable storage are the six we need to bill you. They are:

• account_id — the opaque id of your account.
• model_alias — which model you asked us to forward to (e.g. claude-3-5-sonnet).
• prompt_tokens — input token count, returned by the upstream provider.
• completion_tokens — output token count.
• requested_at — UTC timestamp.
• duration_ms — how long the upstream call took.

That row is the billing event. No prompt body, no response body, no IP address, no user-agent string are written into usage_events by today's gateway code.

2. What llmdeal does not do

3. Where data lives

All primary data — accounts, API keys, usage events — lives on a single VPS at Hetzner HEL1 (Helsinki, Finland), inside the EEA. There is no replica outside the EEA today.

Backups are encrypted on the box with restic (client-side AES-256) and shipped to iDrive. iDrive sees ciphertext only. When a customer asks for deletion, both primary and backup copies are purged on the same cycle.

4. Routing transparency

We forward to upstream LLM providers you select via a model alias. Today the upstream mix includes:

• Groq and Cerebras for high-throughput open-weight inference;
• NVIDIA NIM consortium as the no-cost backend tier;
• Any upstream you bring yourself via a customer-supplied API key (BYO).

Some upstreams are physically located in the United States. The EU/US tier on your account selects which set we route to per request; choose EU to keep traffic on EEA infrastructure. The full live list is at the sub-processor table below and machine-readable at /api/legal/subprocessors.json.

5. Encryption

In transit: TLS 1.2 or higher on every public endpoint. The edge is Cloudflare; the origin is the same VPS over Cloudflare Tunnel — no public origin IP is exposed.

At rest: upstream provider tokens and customer credentials are AES-256-GCM encrypted before they touch disk. Decryption keys are held by the running process via dotenvx; they are not in the repo and not in logs.

6. Your rights under GDPR

One-click email invocations of the four GDPR articles you'll actually use. Each opens your mail client with the right subject line so the operator can find your request quickly:

7. Sub-processors

Every third party that may touch your data or operate the infrastructure underneath us. The live machine-readable list is at /api/legal/subprocessors.json and changes are emitted to subprocessors.rss so compliance teams can subscribe and be notified.

8. Downloads