router.africa Privacy Policy

Effective date: 19 September 2026

1. About this policy

This policy describes what personal data Router Africa, Inc. (“router.africa”, “we”, “us”) handles when you use our website, dashboard and API (the “Platform”), why, who sees it, and what control you have. Words with special meaning (such as “Content”, “Prompts” and “Upstream Provider”) are explained in our Terms of Service.

Privacy contact: legal@router.africa

2. Two roles we play

• When we decide the purpose: we are the controller. This covers your account, billing, security, usage metadata, support and marketing information.
• When you decide the purpose: we are your processor. This covers personal data that sits inside the Prompts, files and Responses that pass through the Platform on your instructions. You are the controller, and we handle it only on your instructions to provide the Platform. If you build an application, you must give your own users a privacy notice and have a lawful basis for sending their data to us.

3. What we collect

3.1 Information you provide

• Account details: name, work email, organisation, role, country, sign-in credentials, and the teammates you invite.
• Verification details: where our payment partners or the law require it, business registration and tax details, and identity documents for authorised individuals.
• Payment details: payment method type (such as a mobile-money number, card token or bank reference), amount, currency and status. Full card numbers and mobile-money credentials are held by our third-party payment partners, not by us.
• Messages: what you send to support, survey answers and feedback.

3.2 Information created by using the Platform

• Request metadata: the API key used, time, model and Upstream Provider selected, token or unit counts, response time, cost, status and error codes, request ID, routing settings and source IP address.
• Device and site data: browser, device identifiers, logs and pages viewed.
• Cookie data (see Section 9).

3.3 Content that passes through

• We do not store Content by default. It is relayed to the selected Upstream Provider and back to you, and exists on our side only in memory and short-lived operational buffers while the request runs.
• If you switch on prompt storage, or use a feature that needs it (such as file storage or conversation history), we keep the relevant Content for the period you choose, for your use only, and you can turn it off or delete it at any time in the dashboard.
• We look at Content only if you ask us to (for example in a support case), where needed to investigate a specific abuse or security incident, or where the law compels us.

3.4 Information from others. Your organisation may add you to a team. Payment partners and mobile-money operators send us payment confirmations and fraud signals. We may also consult public or commercial sources for compliance checks.

4. What we use it for

Our firm lines: we don’t train our own models on your Content, we don’t sell personal data, and we don’t use Content for advertising or profiling. If this ever changes, we’ll ask for your explicit opt-in first.

Where the law requires consent, we rely on it, and you may withdraw it whenever you like without affecting what we did before.

5. Who receives your data

• Upstream Providers. To answer your request, we send your Content and limited technical data to the company that runs the model. We send a pseudonymous reference rather than your name or email. Each Upstream Provider follows its own rules on keeping and using data, which can differ from ours, and some may keep prompts for safety review or use them to improve their models. Where routing controls are available, they are described in our documentation. Where known, each provider’s policies are linked from its model listing (see our Model Terms).
• Payment and financial partners. Processors, mobile-money operators and banks, for payments, currency conversion, settlement, reconciliation and compliance.
• Infrastructure and tooling vendors (sub-processors). Edge cloud hosting, databases, monitoring, email, analytics, support tools and identity-verification services. Each is bound by contract to protect data and use it only for us.
• Your organisation’s administrators, who can see usage and billing for their team’s keys.
• Advisers and authorities. Lawyers, auditors, insurers and public authorities where required or to protect rights and safety.
• Deal counterparties. In a merger, financing or sale of the business, under confidentiality.
• Anyone you tell us to share with.

6. Moving data across borders

We serve builders across Africa and rely on Upstream Providers and vendors located in other countries. Your data, including Content, may therefore leave your country and the African continent.

Where the law requires it, we use safeguards such as contractual protections, transfers needed to perform our contract with you, your consent, or an adequacy finding, in line with the rules that apply. If you have data-residency requirements, contact us at legal@router.africa before sending that data through the Platform.

7. How long we keep it

At the end of the period we delete or irreversibly anonymise the data unless we must keep it to meet a legal duty or settle a dispute. Upstream Providers keep data under their own rules.

8. Protecting your data

We apply safeguards suited to the risk, including encryption in transit and at rest, least-privilege access, hashed API keys, monitoring and logging, vendor due diligence and staff confidentiality duties. No system is perfectly safe, so please guard your credentials and use separate keys for separate environments.

If a breach is likely to put people’s rights at risk, we will tell the relevant regulator and affected customers within the legal deadline that applies and give you what you need to meet your own duties as controller.

9. Cookies

We use essential cookies (sign-in, security, load handling), preference cookies and limited analytics cookies. We ask for your permission before using non-essential cookies, and you can change your choice at any time with “Cookie settings” in the site footer. You can also adjust settings in your browser. We use third-party analytics tools. We do not use advertising cookies.

10. Your choices and rights

Depending on where you live, you may be able to:

• learn how your data is used;
• get a copy of your data;
• have inaccurate data corrected;
• have data deleted where there’s no overriding reason to keep it;
• object to or limit certain processing, including direct marketing;
• receive your data in a portable format, where that right applies;
• withdraw consent at any time;
• ask for human review of a decision made only by automated means that seriously affects you (we use automated tools for fraud and abuse detection).

Email legal@router.africa to use these rights. We may ask you to prove your identity, and will reply within the time the law sets and explain any refusal. If someone whose data is in your Content contacts us, we’ll point them to you as controller.

Complaints. Tell us first if you can. You may also complain to your local data protection authority.

11. Under-18s

The Platform is for businesses and adults. We don’t knowingly collect personal data from anyone under 18; if you think we have, tell us and we’ll delete it. If your application serves children, you must meet the child-protection and consent rules that apply to you.

12. Other websites

The Platform may link to partner or Upstream Provider sites with their own privacy policies. We aren’t responsible for those.

13. Updates to this policy

We may revise this policy. For material changes we’ll notify you 14 days ahead by email or dashboard and update the effective date at the top.

14. Reach us

Router Africa, Inc. Privacy questions: legal@router.africa