Privacy Policy

Effective 3 March 2026 · privacy@lxg2it.com

Short version: We don't read or store your message content. We store the minimum needed to run the service: your email, usage statistics (token counts, costs), and billing records. Your API calls pass through to AI providers — we don't keep copies.

Who we are

Model Router is an AI API gateway operated by lxg2it (ABN 64 933 166 844), based in Australia. This service is available at api.lxg2it.com.

Questions or requests: privacy@lxg2it.com

What we store

Account data: your email address, account creation date, current credit balance.
API keys: we store a prefix (e.g. mr_sk_abc123...) and a hash of each key. The full key is shown once at creation and never stored again.
Usage statistics: per-request records of which tier/model was used, input token count, output token count, and cost in credits. No message content.
Billing history: Stripe payment records (charge amount, date, status). Card details are handled entirely by Stripe — we never see or store raw card numbers.
Server logs: standard HTTP access logs (IP address, endpoint, status code, timestamp). Retained for 30 days.

What we do NOT store

Message content: the text of your API requests and AI responses is never stored by us. It passes through our routing layer to the AI provider and is not persisted.
Conversation history: we have no record of what you asked or what the AI answered.
Cookies or tracking: we use no analytics trackers, advertising pixels, or third-party cookies.

How your data flows

When you make an API call, your message is routed to one AI provider (Anthropic, OpenAI, Google, AWS Bedrock, or xAI) based on your settings. Our primary providers (Anthropic, OpenAI, Google, AWS Bedrock, Groq, and Cerebras) do not use your API inputs or outputs to train their models by default — this is a contractual commitment, not just a setting. That said, each provider's privacy policy governs how they handle your data, and we encourage you to review them if you have specific concerns. You can block specific providers in your profile settings — if you block a provider, your data is never sent to them.

Stripe processes all card payments. We receive a record of successful charges (amount, timestamp) but not your card number, CVV, or full card details.

Data retention

Account data is retained until you delete your account. Usage statistics are retained for 90 days. Billing records are retained for 7 years for legal compliance. Server logs are retained for 30 days.

Your rights

You can delete your account and associated data at any time by emailing privacy@lxg2it.com. We'll respond within 5 business days. Billing records may be retained as required by law.

If you're in the EU or UK, you have rights under GDPR including access, rectification, erasure, and data portability. Contact us to exercise them.

Changes

We'll update the effective date and notify registered users by email if we make material changes to how we handle data.