Privacy & Legal

Version 2026-06-27 · effective 2026-06-27.

Operating entity. BharatRouter is a brand and product of Krutrim SI Designs Private Limited (a Krutrim group company) — the legal entity behind this service, with registered office at 8th Floor, Wing C, Prestige RMZ Startech, Block C, Industrial Layout, Hosur Road, Koramangala, Bengaluru, Karnataka 560095, India. In these pages, "BharatRouter", "we", "us" and "our" refer to Krutrim SI Designs Private Limited. General legal contact: [email protected]; privacy contact: [email protected].

Privacy Policy

This policy explains what personal data we process, why, on what basis, with whom we share it, and your rights. It applies to the BharatRouter website, dashboard and API. We are the Data Fiduciary for the personal data described here.

1. What we process

• Prompts & responses — zero retention by default. Request and response bodies are not stored, logged, or used for training by BharatRouter. They transit memory only to fulfil the request. Content is logged only where you explicitly enable a feature that requires it (e.g. opt-in debugging), at the organisation level.
• Usage metadata. Per-request metadata for metering, billing and abuse prevention: masked API key, organisation/key id, model id, route, token counts, latency, HTTP status, and timestamp.
• Account data. Name, email, profile photo (only if your sign-in provider shares one), and authentication identifiers from your sign-in provider (Google or GitHub). The photo is used only to display your own profile and can be removed on your account page.
• Billing data. Organisation owners may add a billing address and GSTIN, used to issue GST Tax Invoices and determine place of supply. Payments are processed by our payment processor; we do not store full card details.
• Security signals. IP address and a device/browser fingerprint hash, used for fraud prevention, rate limiting, and account-security alerts.

2. Why we process it (purposes) & legal basis

We process personal data to: provide and operate the Service; meter usage and issue invoices; prevent fraud, abuse and security incidents; comply with legal and tax obligations; and communicate service and account notices. Under the DPDP Act we rely on your consent (given at sign-up and top-up) and on legitimate uses such as performance of the service you requested and compliance with law. We do not sell personal data, and we do not use your Customer Content to train models.

3. Who we share it with

• Model Providers. When a request routes to a provider (e.g. Krutrim, Sarvam, OpenAI), that provider processes your prompt under its own terms. Use data_policy: "india_only" to restrict routing to India-resident providers; requests fail closed (no_route) rather than silently leaving India. BYOK (upstream_key) keys are used in-flight only — never stored or logged.
• Payment processor. Razorpay processes top-up payments and related fraud checks as an independent processor.
• Tax-ID verification. Where you supply a GSTIN, it may be validated against an authorised GST verification provider to issue a correct Tax Invoice.
• Infrastructure. Hosting and operations run on Krutrim Cloud (India). We use self-hosted, cookieless analytics on our own infrastructure — no third-party advertising trackers.
• Legal. We may disclose data where required by law or to protect rights, safety, and the integrity of the Service.

4. Retention

Prompt/response bodies are not retained (so there is nothing to delete by default). Account and usage metadata are retained while your account is active and for the period required by tax and company law thereafter (invoices and tax records are retained for the statutory period). Security logs are retained for a limited period for abuse prevention.

5. Security

BYOK and provider keys are encrypted at rest; sessions are protected; access is least-privilege. No system is perfectly secure, but we apply reasonable technical and organisational measures appropriate to the data we hold.

6. International transfers & children

We operate India-first; the india_only control keeps inference within India-resident providers. If you route to a non-India provider, your prompt may be processed outside India under that provider's terms. The Service is not directed to children under 18.

Terms of Service

Your use of the Service is governed by our full Terms & Conditions — covering prepaid Credits, GST at top-up, credit expiry, service levels, acceptable use, liability, and India governing law. Model sellers should also see the Marketplace Seller Agreement.

DPDP Declaration

We design for India's Digital Personal Data Protection Act, 2023:

• Data minimisation by architecture — zero retention of prompt/response bodies is the default, so the personal data we hold is limited to account and usage metadata.
• Residency as a control — data_policy: "india_only" keeps inference traffic with India-resident providers; requests fail closed (no_route) rather than silently leaving India.
• Purpose limitation — usage metadata is processed for metering, billing and abuse prevention only.
• Consent — consent is captured at sign-up (click-wrap) and at top-up, with version and timestamp recorded; you may withdraw consent by closing your account.
• Data Fiduciary & grievance redressal — the Data Fiduciary is Krutrim SI Designs Private Limited; write to [email protected] (or [email protected]). A designated Grievance Officer is contactable at the same address.

Your data rights

Whether you're covered by DPDP, GDPR, or neither, we extend the same rights to all users:

Because prompt/response bodies are never stored, there is nothing to erase from inference content by default. We may update this policy on notice; the version and date are shown above.