Privacy Policy

Account info (email, name), batch metadata (item counts, timing, status), and billing records. The feedback widget collects more, and section 08 lists it. If you are a provider, section 09 covers your payout details. Batchrouter does not use batch item payloads to train models.

To route, retry, deliver, and settle batches. To send transactional emails. To protect the service from abuse: we rate-limit sign-in, sign-up, and costly API requests, sign-in and sign-up can require a Cloudflare Turnstile bot check, and an operator can suspend an organization. None of these controls reads the content of your batch payloads. Batchrouter never trains a model on your data, and never sells it.

Customer payloads are forwarded only to providers selected by routing. Before dispatch, the router compares the batch's privacy tier against the tiers each provider declares. It rejects a provider that does not declare the requested tier. That tier check always runs. A stricter zero-data-retention check exists, but it runs only in the privacy-constrained routing mode. In every other routing mode it does not run. A confidential batch can therefore reach a provider that declares no zero-data-retention guarantee, and today no built-in provider declares one. A provider also declares a retention window, and we publish that window in the routing receipt. The router does not compare that window against your batch. Treat it as provider-declared information, not as a limit we enforce. Batchrouter cannot control what a provider does after dispatch, and each provider sets its own training policy. Read the provider's own policy before you send regulated data.

Our target is a 30-day window: 30 days after a batch reaches a terminal state, we clear the batch item payloads and the stored item output, we delete the provider request and response bodies, and we delete the uploaded input manifest. The automatic deletion job is not live in production yet — today it runs in report-only mode — so treat the 30-day window as a target, not an active schedule. Result artifacts are separate, and the 30-day target does not cover them. A batch result file, a review file, and an error file follow a storage-retention policy that your organization sets through the API. The default policy is free and keeps a result for a grace window of 7 days after completion. You can raise that to a fixed window of up to 3650 days, or keep results until you delete them. Both longer tiers are metered. The result collection job also runs in report-only mode today, so no result file is collected yet. Files you upload as input attachments (images, documents, audio, video) are separate. An attachment can serve many batches, so it has no batch-linked deletion date today. No job deletes an attachment, and the product has no delete control for one. An attachment stays in our storage until an operator removes it by request. Email hello@batchrouter.com to ask for the removal of an uploaded file. Receipts and accounting records are retained for 7 years where required by the Swedish Bookkeeping Act (Bokföringslagen) and tax law — a legal-obligation basis under GDPR Art. 6(1)(c). This statutory retention overrides erasure requests only to the extent legally required. We act on every other erasure request manually. Section 05 states what account deletion does not reach today.

You can often delete your account yourself on the Profile page. The page asks for your account password first. It refuses the deletion while you still belong to an open team account, or while your personal account has another member. Leave each team account first, or close it if you are its last member. If you are the only owner of a team account that has other members, make one of them an owner first, then leave. If your personal account has another member, or you cannot complete these steps, email us. When the deletion runs, it does the following. It anonymises your profile, and it overwrites the name and billing fields of your personal account record. It deletes your sessions and your membership. It revokes the API keys and the pending invitations on your personal account. It removes your policy acceptances. It also deletes or strips the payloads of the saved quotes on your personal account. It does not touch the quotes saved in a team account, and they stay when you leave or close that account. It archives the providers your personal account owns and removes their payout details (see section 09). A suspended provider stays suspended. It does not delete your batch records, your batch item payloads, your execution records, your usage records, your uploaded files, or your feedback reports — see Retention. Your profile row and your personal account row stay in the database: we overwrite the name, email and billing fields and keep the row. We also write one internal audit event that survives the scrub. That event records your pseudonymous user ID, your organization ID, and a non-identifying snapshot of what the scrub changed. If your personal account owns a provider, the deletion also writes the change-log entries that section 09 describes. Batchrouter has no self-service data export today. Email hello@batchrouter.com for an export, a correction, an objection, or the erasure of data that account deletion does not reach. We handle each request manually. GDPR sets a one-month response deadline for these rights, and we work to it; no automatic system enforces it. CCPA rights go to the same address. We keep the records that Swedish law requires us to keep (see Retention).

Cloudflare, OpenAI, Anthropic, Mistral AI, xAI, Together AI, Groq, OpenRouter, SWERunAi, AUTONOMOUSc, Stripe, Resend, Amazon Web Services (Amazon SES), Google (Fonts), Google (Gmail), and Operator alert webhook (vendor to be confirmed). The Legal page lists what each vendor does and the category of data it receives.

Batchrouter sets strictly-necessary cookies only, and the table below names each one. The cookie notice does not appear inside the app (/app) or the operator console (/admin), so it never covers the product; the sign-in cookie is set there, and this section is its disclosure. We set no analytics, advertising, or cross-site tracking cookies, and we do not run Google Analytics or ad pixels. Public pages may load Cloudflare Web Analytics, which is cookieless: it measures pageviews and Core Web Vitals and does not store an advertising identifier. The Legal page lists Cloudflare as a subprocessor. The site also keeps a few values in your browser's local storage. All of them are functional: a flag that remembers you saw the cookie notice, your light or dark theme choice, and the models you mark as favourites on the marketplace. Clear your site data to reset all of them. Because we ask for no optional cookies, there is no consent to give and none to withdraw. One transfer is worth naming. Every page loads its web fonts from Google Fonts, so each page load sends your IP address and your browser user-agent string to Google servers in the United States.

The feedback button sends your message to Batchrouter. The form also offers an optional contact email field, so you can ask for a reply without an account. It sends the page URL, the app version, and your browser user-agent string. It sends your browser name, your operating-system name, your language, your screen size, and your window size. It sends the referring URL. A bug report also sends up to 20 recent browser console error lines. A console error line can quote content from the page you were on. If you are signed in, it sends your account email address and your organization ID. It sends a screenshot only when you attach one. We record the IP address of the request. We store the report in our database. We also email it through Resend to a Google-hosted mailbox that a Batchrouter operator reads. That email carries your message, your contact address, your IP address, the browser context block, and any screenshot you attach. Google hosts that mailbox, so Google receives the email as a mail-host subprocessor. A separate step can also open an issue in a Batchrouter GitHub issue tracker. A deployment setting controls that GitHub step, so it does not run in every environment. That issue carries everything above except the screenshot and the IP address. It carries the report ID, your email address, your optional contact address, your organization ID, the page URL, the app version, the user-agent string, the submission time, your full message text, and the browser context block with the console error lines. The issue title repeats the first 80 characters of your message. The purpose is product support: we read each report and we fix what you tell us.

This section applies if you register as a provider and add payout details. To pay your earnings, Batchrouter collects the account holder name, the IBAN or account number, the routing number or SWIFT/BIC code, the bank's country, and an optional remittance email address. We use them to pay you, to guard against payout fraud, and to keep the payment records the law requires. The legal bases are our agreement with you as a provider (GDPR Art. 6(1)(b)), our legal duty to keep accounting records (Art. 6(1)(c)), and our legitimate interest in preventing payment fraud (Art. 6(1)(f)), which covers the change log. You cannot take your provider live in the portal until payout details are saved. In the provider portal, only people who administer the account that owns the provider can add, change, or remove the details. They must be signed in, with a verified email address. An API key cannot change them. We encrypt the full bank details before we store them. The masked label and the remittance email are not encrypted this way. The portal never shows the full details again. It shows a masked label: at most the last four characters of the account number, and the account holder name. Every member of an account that has the owner, admin, or billing role on the provider can see that label and the remittance email. Batchrouter operators can see them too. Only Batchrouter operators with the payouts permission can read the full details, and we log each read. We log each change and each removal. For a change you make, the log entry holds the masked label, the remittance email, your account ID and user ID, your IP address, and your browser user-agent string. Each change, and each removal made in the portal or by us, sends a notice email. A removal caused by deleting your account sends none. The notice goes to the provider's contact address, the previous remittance email, and the owners and admins of the owning account who have a verified email address. It is sent through Resend. The change notice names the provider and the masked account number. The removal notice names only the provider. Neither carries the full details. We also alert our operators, without any bank details. Payouts are bank transfers in US dollars, and a Batchrouter operator sends each one. We keep the details until you replace or remove them. Saving new details replaces the old ones. You can remove them at any time with the Remove bank details button in the provider portal. Removing the details also removes the remittance email. We cannot pay you until you add details again. You can also email hello@batchrouter.com and we remove them for you. If you delete your account, we remove the payout details of the providers your personal account owns; section 05 lists what else account deletion does. Closing a team account does not remove the payout details of the providers it owns. Remove them first, or email us afterwards. Replaced or removed details can stay in our database backups for a limited time. We do not delete change-log entries today, and they keep the masked label and the remittance email. Payout statements and payment records are accounting records, and we keep them for 7 years where the law requires it (see Retention). Your rights in section 05 apply here too. You can also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).