1. Scope and roles
Niuron provides access and routing tools for AI models, including a dashboard, playground, APIs, and platform-executed tools.
For account, security, billing, and service-operation data, Niuron determines the purposes of processing. When an organization sends prompts or other end-user data through the API, the organization determines the content and purposes of the request; Niuron processes that data to route the request, apply settings, return the response, and record usage. The organization is responsible for having a lawful basis and notifying its own users where required.
2. Data we process
The data depends on how you use Niuron. We may process:
- Account and organization data: email, authentication credentials, organization name, members, roles, and preferences.
- Keys and integrations: Niuron API keys are stored as hashes; provider credentials you configure (BYOK) are stored encrypted so requests can be routed.
- Usage and diagnostics: account, organization, key, and request identifiers; requested and selected model/provider; token counts; cost; latency; outcome, status and error type; and technical client information such as IP address, approximate IP-derived location, browser, and some request headers.
- Submitted content: prompts, messages, files, or instructions included in requests, and generated responses. Playground conversations are saved to your account until deleted. API requests may also be processed by caches when this feature is enabled in organization settings.
- Billing: customer, checkout, payment, and invoice identifiers; amounts, currency, transaction status, and billing information you provide. Stripe processes payments; Niuron does not receive your full card number or security code.
- Website activity: technical access data and product usage metrics. In production, we use Google Analytics to measure website and product usage.
3. How we use data
We use data to create and administer accounts and organizations; authenticate users and protect keys; route requests to models and providers you select or the router selects; deliver and maintain the service; calculate usage and charges; prevent fraud and abuse; diagnose failures; comply with legal obligations; and understand product performance and usage.
We do not use prompts or responses to train Niuron’s own models. Processing by the selected provider — including whether it uses data to improve its models — is governed by that provider’s terms and settings. Review the provider’s policies before submitting confidential information.
5. International transfers
Because infrastructure, model, and tool providers may operate in other countries, some data — including content needed to fulfill a request — may be processed outside Brazil. We use available contractual and operational safeguards for these transfers and recommend reviewing the notices of the providers involved.
6. Storage and retention
We keep each data category for as long as necessary for its purpose, considering security, support, billing, and legal obligations. Current operational periods include:
- Usage and request events recorded for observability: up to 90 days.
- Model comparison (shadow) results: up to 30 days.
- Playground conversations: until you delete them or the account is removed. Deletion may take some time to propagate to backups.
- Response caches: for short, configurable periods; duration depends on service and organization settings. Disabling caching prevents new cache storage of this kind but does not delete usage records or playground history.
- Account, security, and billing data: while the account is active and afterward as needed to resolve disputes, prevent fraud, and meet legal obligations.
7. Your choices and controls
You can delete playground conversations, revoke API keys, remove provider credentials, and adjust organization cache and tool settings. If you use a BYOK key, the relevant provider may keep its own request records under its settings and policies. Niuron does not control independent retention by those providers.
8. Your rights
Under applicable law, you may request confirmation of processing, access, correction, anonymization, blocking or deletion, portability where applicable, information about sharing, and review of automated decisions in cases provided by law. You may also request information or submit a complaint to Brazil’s National Data Protection Authority (ANPD).
We may request information to verify your identity and locate the data. Some records may be retained where legally required or reasonably needed to establish or defend legal claims.
9. Security
We use technical and organizational measures designed to protect data, including access controls and credential safeguards. Niuron API keys are stored as hashes; BYOK credentials are encrypted at rest. No transmission or storage method is risk-free, so avoid sending sensitive data that is not necessary for a request.
10. Children
Niuron is not directed to anyone under 18 and should not be used by them without a legal guardian’s involvement and authorization.
11. Changes to this policy
We may update this policy to reflect changes to the service or our processing practices. We will publish the revised version on this page and update the date at the beginning. If a change requires specific notice or consent, we will take the applicable steps.