Privacy Policy

01Who we are

This Privacy Policy explains how JettySoft LTD, the company that provides AirLLM ("AirLLM", "we", "us"), collects, uses, shares, and protects personal information when you use our websites, applications, APIs, and related services — including the AirLLM platform and dashboard, Air Router, AirGPU, AirCode (AirCode CLI and AirCode Studio), Alina, our AI support agent, and any beta or preview features (collectively, the "Services", as defined in our Terms & Conditions). AirLLM routes requests from your tools — chat platforms, coding assistants, and agents — to third-party large language models and to AirLLM-operated GPU capacity, applying routing and cost optimization along the way.

Depending on the data involved, we act in two roles:

• Data controller — for account, billing, marketing, and website data, Alina support chats, and safety records. This policy is the primary document for that data.
• Data processor / service provider — for the prompts, code, files, and completions ("Customer Content") that flow through the Services on behalf of a business customer. That processing is governed by our Data Processing Addendum and the customer's instructions; the customer's own privacy notice applies to their end users.

02Information we collect

Information you provide

• Account data — name, email address, organization, role, password (stored as a salted hash), and workspace settings.
• Billing data — plan selection, billing address, and tax information. Card details are collected and handled by our payment processor, Stripe; we never store full card numbers.
• Auto-renewal and auto-recharge consent records — when you buy or change a paid plan, turn a paid key back on, or turn on or change auto-recharge on the Token plan, we record your agreement to the automatic charges: the plan and price (or the recharge amount and threshold), the terms you were shown, when you agreed, and the IP address and browser details you agreed from.
• Terms-acceptance records — when you create an account, by signing up, accepting an invitation, or first signing in with Google or single sign-on, we record your acceptance of our Terms & Conditions and this Privacy Policy: the versions you accepted, how you signed up, when you accepted, and the IP address and browser details you accepted from.
• Customer Content — the prompts, code, files, tool calls, embeddings, and model completions transmitted through the Services when you or your tools call our API or use our products, including AirCode CLI and AirCode Studio. Request content passes through short-lived caches; we keep it longer only in the records described in Section 06, such as the content of failed requests.
• AirCode session records — instructions an administrator types into an AirCode session from the Control Plane, and session control records (pause, resume, end). Session transcripts are relayed live and not stored.
• Alina support chats — when you chat with Alina, our AI support agent: your questions and Alina's answers, the page you were on, and, when you're signed in, your account ID.
• Communications — support tickets, contact-form messages, emails you send us, problem reports you send from AirCode, feedback, survey responses, and demo requests.

Information collected automatically

• Technical data — IP address, browser and device type, operating system, language, and referral URL.
• Request headers — headers such as User-Agent and tool-identification headers, which we read solely to detect which coding tool is calling so we can return the response in the correct format.
• Usage metadata — timestamps, token counts, the model used, cost, latency, and error codes. This metadata describes how a request was handled, not its content.
• Cookies and browser storage — used to keep you signed in, protect your account, and remember your preferences, and — only if you accept them — to measure how our website is used with Google Analytics, as described in our Cookie Policy. We don't use advertising cookies, and we honor Global Privacy Control (GPC) signals.
• Safety records — if a safety guardrail or an Acceptable Use review is triggered, a record of the event, which may include the text that triggered it.

Information from other sources

If you sign in through a single-sign-on or OAuth provider, we receive the profile details you authorize (typically name and email); sign-in with Google runs through Google Firebase Authentication. If your organization provisions your account, we receive the details your administrator supplies.

03How we use information

We use personal information to:

• Provide and operate the Services — authenticate you, route your requests to an appropriate model, serve repeated requests faster from short-lived caches scoped to your account, translate responses into your tool's format, and maintain session continuity.
• Fix problems and check quality — diagnose failed requests using their content, with secrets removed, including in tickets in our engineering issue tracker, and check routing quality on samples of responses. None of this is used to train AI models.
• Meter and bill usage — track token consumption against subscription budgets and prepaid balances, prevent overage, generate invoices, email a receipt for every charge, record your consent to automatic renewal and auto-recharge, email the billing contact when a payment fails, and send a yearly reminder that lists every plan that renews automatically.
• Support you — use Alina support chats and support tickets to answer your questions, investigate problems, and improve our support answers and documentation. Reviewing support chats to improve our written support answers and documentation is not model training: AirLLM never uses support chats to train any AI model.
• Keep the platform safe — detect abuse, fraud, security incidents, and violations of our Acceptable Use Policy, and keep the safety records described in Section 06 for enforcement and legal defense.
• Improve the Services — analyze service-quality metrics derived from usage metadata, together with the routing-quality checks described above, so the Services perform better over time. Nothing is used to train AI models.
• Understand how our website is used — only if you accept analytics cookies: count visits and see which pages and links people use, so we can improve the site, with Google Analytics as described in our Cookie Policy. It never involves your Customer Content and isn't used for advertising.
• Communicate with you — service announcements, security notices, billing alerts, and (with your consent where required) product news. You can opt out of marketing at any time.
• Comply with law — meet legal, tax, accounting, and regulatory obligations, and establish or defend legal claims.

Where the GDPR or similar laws apply, we rely on: performance of a contract (providing the Services), legitimate interests (security, safety records, the operator audit log, diagnosing failed requests, routing-quality checks, support, service improvement, B2B communications, and keeping a record of your acceptance of our Terms to establish or defend legal claims), consent (website analytics, and marketing where required), and legal obligation (tax and accounting records, billing notices, and auto-renewal and auto-recharge consent records).

04Our model-training commitment

In addition:

• The commitment covers every Service, including Air Router, AirGPU, AirCode CLI, AirCode Studio, and Alina, and every plan.
• Model providers and your plan. Model providers may retain prompts under their own policies, for example to monitor for abuse. On paid plans, AirLLM avoids model providers that use prompts to train models. On the Free plan, model providers may use your prompts to train models and may retain them.
• Service improvements rely on service-quality metrics derived from usage metadata and on routing-quality checks of sampled responses — never on model training.
• Reviewing Alina support chats to improve our written support answers and documentation is not model training, and AirLLM never uses support chats to train any AI model.
• To answer a request, its content is processed by third-party model providers and other subprocessors under their own terms and privacy policies. AirLLM does not control, and is not responsible or liable for, how a third party stores, retains, logs, uses, or discloses data — including any model training it carries out under its own terms. If that matters for your use, review the provider's terms.
• Where you use a tenant-scoped provider key (your own key with a provider), upstream calls are made under that key and your own agreement with the provider, which governs the provider's handling of your data.

05How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

• Upstream model and capacity providers — to fulfill a request, its content is transmitted to the third-party model that serves it (for example Anthropic, OpenAI, or Google model families, directly or via an aggregation provider), or to third-party GPU capacity when AirGPU falls back to it. These providers are independent third parties that process, and may store, retain, log, or use, that content under their own terms and privacy policies. AirLLM does not control and, to the maximum extent permitted by applicable law, is not responsible or liable for their data handling, availability, outputs, or security. See Section 5 of the Data Retention Policy.
• Analytics provider — if you accept analytics cookies, Google processes website usage data (pages viewed, approximate location, device and browser details, and the site actions listed in our Cookie Policy) for us as a service provider, under its data processing terms.
• Subprocessors — vendors that host our servers, databases, and caches (Microsoft Azure), host our website and email, deliver and protect our websites and API and run bot checks on sign-in, sign-up, and the contact form (Cloudflare), sign you in with Google (Google Firebase), process payments (Stripe), send our emails (Amazon Web Services), and run our engineering issue tracker (Microsoft Azure DevOps), each bound by data-protection terms. The current list is published in our DPA.
• Affiliates — our parent, subsidiaries, and affiliates that help us operate the Services, who handle the information consistently with this policy.
• Your organization — if you use the Services under a workspace administered by your employer or another entity, that administrator can access account, usage, and billing information for the workspace.
• Legal and safety — where required by law or legal process, or where necessary to protect the rights, safety, or property of AirLLM, our customers, or the public. Where lawful and appropriate, we will try to notify affected customers before disclosure.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy's protections.
• Aggregated or de-identified data — statistics that cannot reasonably identify you, such as benchmark and service-performance reports.

06How long we keep information

We keep personal information only as long as needed for the purposes above, then delete or de-identify it. Highlights:

• Model requests — AirLLM doesn't store prompts to train models. To run the service, request content — the prompts and responses sent through Air Router or the AirLLM API, including the model calls AirCode makes — passes through short-lived, account-scoped caches that expire automatically, generally within 24 hours of last use. When a request fails, we may keep its content, with secrets removed, to diagnose the failure, and we may keep samples of responses to check routing quality; these records are deleted with your account's data. The content of a failing request, with secrets removed, may also be attached to a ticket in our engineering issue tracker, where it is kept only as long as needed to diagnose and fix the problem, with access limited to our engineering staff. None of it is used for training or sold. Third-party model providers may keep data under their own terms (Section 05).
• AirCode session transcripts are relayed live from your machine and held for at most about a minute to deliver them; we don't store them. Administrator instructions and session control records are stored with the session's records and deleted with your account data. AirCode CLI and AirCode Studio keep their own data (history, settings, project files) on your device, under your control.
• Alina support chats are kept until they are no longer needed for support, then deleted — and we delete them sooner on request. In your browser, the open conversation is kept only for the browser session.
• Safety records, which may include the text that triggered a safety guardrail or Acceptable Use review, are kept for up to 2 years for enforcement and legal defense.
• Usage metadata (no content) is kept up to 13 months; billing records are kept 7 years from the invoice date, as tax law requires, even after your account is deleted. Billing notices — payment-failed notices and reminders, service-paused notices, and annual renewal reminders — are kept with the billing records.
• Auto-renewal and auto-recharge consent records are kept for 3 years from when you gave consent, even after your account is deleted, so we can show the consent that automatic-renewal laws require.
• Terms-acceptance records are kept for 7 years from when you accepted, even after your account is deleted, so we can show which Terms and Privacy Policy you agreed to.
• The operator audit log — the record of administrative actions AirLLM staff take, each logged with the operator's name — is kept as long as needed for security and legal defense.
• Support communications — support tickets, contact-form messages, and emails with our team — are kept only as long as needed to handle your request and for legal defense, with access limited to the staff who handle them. They are never used for training or sold.
• Closed accounts — when an Enterprise Admin closes the account in the dashboard (Settings → Close Account), the account and its data are deleted 1 year after closure, except the billing records and notices, consent records, and Terms-acceptance records above, which are kept for their own periods. Deleted data may remain in backups for a limited time until they're overwritten in the normal cycle. Export anything you need before you close your account.

The complete schedule, including safety-hold and legal-hold exceptions, is in our Data Retention Policy.

07Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a portable copy;
• Correct inaccurate or incomplete information;
• Delete your information;
• Restrict or object to certain processing, including processing based on legitimate interests;
• Withdraw consent at any time, without affecting prior processing;
• Opt out of marketing communications;
• Not be discriminated against for exercising any of these rights.

United States (CCPA/CPRA and similar state laws)

California and other US state residents may exercise rights to know, correct, delete, and opt out of "sale" or "sharing". We do not sell personal information or share it for cross-context behavioral advertising, and we treat GPC browser signals as a valid opt-out. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

EEA, UK, and Switzerland (GDPR)

You may lodge a complaint with your local supervisory authority, though we would appreciate the chance to address your concern first. Where we act as processor for a business customer, we will refer your request to that customer and assist them in responding.

How to exercise your rights

Use the controls in your dashboard, or send your request to our Legal Cell at legal@airllm.ai (or through our Contact page), including a request to delete your Alina support chats. To protect your information, we may need to verify your identity — for example by confirming control of your account or asking for equivalent evidence — before we act on a request. We respond within the legally required period (generally 30–45 days) and accept requests from authorized agents with proof of authorization. If we decline a request, we will explain why and how to appeal; appeals also go to our Legal Cell. A closed account and its data are deleted 1 year after closure (see Section 06); where the law gives you the right to earlier deletion, ask our Legal Cell at legal@airllm.ai.

08International data transfers

We are headquartered in the United States and may process information in the countries where we and our subprocessors operate. Where information originating in the EEA, UK, or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary technical measures such as encryption in transit. A copy of the relevant transfer mechanism is available on request from our Legal Cell at legal@airllm.ai.

09How we protect information

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption — industry-standard encryption for data in transit. Stored data may be encrypted at rest where our hosting providers support it.
• Key isolation — API keys are kept in protected form, and tenant-scoped upstream provider keys are isolated per customer so one organization's traffic does not bill or mix with another's.
• Access control — administrative access to the AirLLM control plane requires a named operator account with multi-factor authentication; access follows least privilege; administrative actions are logged with the operator's name. Within your workspace, role-based access controls what each member can do.
• Operational security — vulnerability management, dependency scanning, security testing, and an incident-response plan (breach notification is described in the DPA).

You are responsible for your credentials, API keys, devices, and networks: use strong, unique credentials and rotate any API key that may have been exposed. Learn more on our Security page.

10Children

The Services are business tools intended for adults. They are not directed to children, and you must be at least 18 years old (or the age of majority where you live) to use them. We do not knowingly collect personal information from children; if you believe a child has provided us information, tell our Legal Cell at legal@airllm.ai (or use our Contact page) and we will delete it.

11Changes to this policy

We may update this policy as our Services and the law evolve. For material changes we will give at least 30 days' notice by email or in-product notice before the changes take effect, and we will update the "Last updated" date above. Archived versions are available on request from our Legal Cell at legal@airllm.ai.

12How to contact us

Questions, concerns, privacy and data-rights requests, and data-protection questions all go to our Legal Cell at legal@airllm.ai. You can also reach us through our Contact page.

We haven’t appointed a Data Protection Officer because the law doesn’t require us to. Privacy questions go to our Legal Cell at legal@airllm.ai.

Tell us what your request is about and which account it concerns. To protect your information, we may need to verify your identity before we respond or act on a request.