Privacy policy

What we collect

• Mobile number — the only way into an account, and required to send the one-time code.
• Email (optional) — for payment receipts and low-balance warnings.
• Name, national/company ID, economic code, registration number, address and postal code — only if you enter them, and only to issue the official invoice the law requires.
• Usage metadata — request time, model name, input and output token counts, success/failure, latency and cost.
• Payment data limited to a reference number and amount. Your card or bank details never reach us; payment happens on the gateway.

Message content: the API and the chat

API: the content of the requests and responses you send through the API is not stored. We count tokens to bill you; we do not keep the text of your messages.

IranRouter Chat: chat conversations are stored so that history, search and projects work. Conversation text, titles, and project instructions and document text are kept encrypted in a separate database; attached files are stored encrypted like your account's other files, and only you can see them.

“Remove from history” takes a conversation out of your list and your search; it does not erase the data. A “no history” conversation never appears in your history or search, and is stored like any other.

Our staff see conversation content only to handle your support request or when the law requires it — each time with the reason and the staff member's name recorded in the audit log.

The site, the dashboard and the chat load no third-party analytics (no Google Analytics or similar) and set no tracking cookies. The dashboard session is a token held in your own browser; the chat session is a strictly necessary sign-in cookie.

Who we share with

• The model provider — your request content is sent to the target service (e.g. OpenAI or Anthropic) for processing. That service's privacy policy governs it there.
• The payment gateway — amount and payment reference, to complete the transaction.
• The SMS provider — your mobile number, to send the login code.
• The tax authority's Moadian system — invoice details, to the extent the law requires.
• Beyond the above and what law or a judicial order requires, we do not share or sell your data.

Security

Credentials and your personal provider keys are stored encrypted and are never displayed again after entry. Your API key is shown exactly once, at creation. All site and API traffic is over HTTPS.

Retention

Account data is kept while the account is active. Financial records and invoices are retained as the law requires even after an account closes — those records cannot be deleted.

Chat conversations, projects and attachments are never deleted automatically; they are kept for as long as the account exists.

Your rights

• View and correct your account details under Account in the dashboard.
• Export your own usage as CSV.
• Close your account. Closing revokes your keys and scrubs identity fields; tax records remain per the clause above.

Changes to this policy

On a material change we update the date on this page and notify users where appropriate.