Privacy Policy

1. Information we collect

To provide reliable API forwarding and aggregation, we collect the following types of information:

1.1 Account information

When you register, we collect:

• Email address
• Username or display name
• Password (stored using secure hashing)
• Contact details (such as phone number for verification or urgent notices)

1.2 API usage data and logs

As an API aggregation platform, when you call our APIs we automatically record certain technical data for billing, troubleshooting, and security monitoring:

• Metadata: timestamps, source IP addresses, model types (e.g. gpt-4, claude-3), and token usage (prompt and completion tokens).
• Content in transit: your prompts and model completions.

Note: our core service is forwarding requests to upstream providers. Unless you enable specific debug modes or applicable law requires otherwise, we do not persistently store API content to train our own models.

1.3 Payment information

Payments are processed by third-party providers (such as Alipay, WeChat Pay, Stripe, etc.). We do not store full card numbers or sensitive bank credentials. We retain transaction records, order IDs, and top-up amounts for reconciliation.

2. How we use your information

We use collected information to:

• Deliver core services: validate API keys, route requests to the correct upstream AI vendors (such as OpenAI, Anthropic, Google), and return results to you.
• Billing and administration: calculate token usage accurately and deduct fees from your balance.
• Operations and security: monitor load, detect abusive or malicious traffic (such as DDoS), and address technical failures (e.g. 502/504).
• Notifications: send service changes due to upstream updates, top-up reminders, or security alerts.
• Legal compliance: meet applicable laws in China and other jurisdictions where we operate.

3. Sharing and disclosure

Because we provide API aggregation, certain sharing is inherent to how the service works:

3.1 Upstream model vendors

This is central to our service. When you send requests through BananaRouter, your prompts are forwarded to the relevant upstream AI vendors (including but not limited to OpenAI, Google, and Anthropic).

• Those vendors process data under their own privacy policies.
• We do not control how upstream vendors use the data (many commercial APIs state they do not train on API data—please review each vendor’s policy).

3.2 Service providers

We may share necessary non-content data with vendors that provide hosting, databases (such as MySQL or ClickHouse), security, and payments to keep the platform running.

3.3 Legal requirements

We may disclose information when:

• Required by court order, legal process, or competent authorities.
• Necessary to protect the rights, property, or safety of the BananaRouter team, our users, or the public (for example addressing abuse, fraud, or illegal content).

4. Storage and security

4.1 Storage

Account and metadata are stored on secured servers in multiple regions.

Large-scale logs may be archived in OLAP systems (such as ClickHouse or BigQuery) mainly for performance tuning and audit.

4.2 Security

We apply industry-standard safeguards, including:

• TLS/SSL encryption for API traffic.
• API keys stored using secure hashing.
• Strict internal access controls so only authorized staff can access core systems.

4.3 Retention

We retain personal information until you delete your account. API access logs are generally kept for about 30 days for troubleshooting, then deleted or anonymized unless a longer period is required by law.

5. Your rights

You may:

• Access and update: sign in to review usage, balance, and profile information.
• Delete your account: contact us to request closure; we remove sensitive personal data except records we must keep by law (such as certain transaction records).

6. Note for international users

By using BananaRouter, you understand that data may be transferred across borders.

If your request targets an overseas model (such as GPT-4), data may be processed in that vendor’s jurisdiction (often the United States).

We use commercially reasonable efforts to protect data during transfer.

7. Policy updates

We may update this policy as our business evolves (for example new upstream channels or organizational changes). For material changes, we will notify you via the website or email.

8. Contact us

If you have questions about this policy or wish to exercise your rights, contact us at:

Team: BananaRouter

Email:contact@bananarouter.com