Legal
Privacy Policy
Last updated: 21 October 2026
1. Data controller
| Identity | Máximo Jack Cervantes Robson |
| Tax ID (NIF) | 78845372S |
| Address | C. Eslovenia 1, 5 — 35580 Playa Blanca, Yaiza, Las Palmas, Spain |
| Contact email | [email protected] |
| Website | routix.tech |
No Data Protection Officer has been appointed, as none of the circumstances in Article 37 GDPR apply.
2. Data we process
2.1. Account data
When you sign in with Google or GitHub, the provider sends us your account identifier, your email address and your public name. We also store the sign-up date and which provider you used. We also record which promotional coupons you have redeemed and the remaining balance of any free token grants. We never receive or store your password — authentication is carried out entirely by the external provider.
2.2. API keys
We store a cryptographic hash (SHA-256) of each key, its first few characters so you can identify it in the dashboard, the name you gave it, and creation and last-use timestamps. The full key is never stored.
2.3. Technical logs
Our servers record IP address, date and time, requested path, response status and user agent. These are needed for service security, abuse detection and troubleshooting.
2.4. Request content
We do not store the content of your prompts or the generated responses. They are transmitted to the model provider and discarded when the request completes. They are not written to access logs and are not used to train models.
2.5. Data we do not collect
We do not process special categories of data (Art. 9 GDPR) or data relating to children. We do not build commercial profiles or make automated decisions with legal effects on you.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating and maintaining your account, managing keys | Performance of a contract — Art. 6(1)(b) |
| Providing the API service and answering your requests | Performance of a contract — Art. 6(1)(b) |
| Security, abuse prevention and rate limiting | Legitimate interests — Art. 6(1)(f) |
| Handling enquiries and data subject requests | Legitimate interests — Art. 6(1)(f) |
| Complying with requests from authorities | Legal obligation — Art. 6(1)(c) |
Where the basis is legitimate interests you may object at any time (Art. 21 GDPR) without having to give reasons.
Account data is required to use the service: without it, no account can be created and no key can be issued. All other data is generated automatically by the technical operation of the service.
4. Recipients and processors
We do not sell or share your data with third parties for commercial purposes. To operate the service we use providers acting as data processors (Art. 28 GDPR):
| Provider | Function | Safeguards |
|---|---|---|
| Cloudflare, Inc. | CDN, TLS termination and attack protection | EU-US Data Privacy Framework |
| Google LLC | OAuth authentication, if you choose it | EU-US Data Privacy Framework |
| GitHub, Inc. | OAuth authentication, if you choose it | EU-US Data Privacy Framework |
| Model provider | Processing requests to generate responses | See section 5 |
| Whop, Inc. | Payment processing for account top-ups (we do not receive or store your card details) | See Whop's privacy policy |
| Oracle Cloud Infrastructure | Server hosting | Standard contractual clauses |
If you use Routix to process third parties' personal data, you are the controller for that processing and we are your processor. In that case you must enter into a data processing agreement under Art. 28 GDPR by writing to [email protected].
5. International transfers
When you call /v1/chat/completions, the content of your message is transmitted to the model provider serving the request, which may be located outside the European Economic Area. That transmission is essential to deliver the service you requested.
Do not send personal data, trade secrets or confidential information in your prompts unless you have a legal basis to do so and accept that it leaves the EEA. By using the API you expressly consent to this transfer (Art. 49(1)(b) GDPR).
The other processors listed in section 4 are covered by the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) or by standard contractual clauses approved by the European Commission.
6. Retention periods
| Account data | While the account is active, and until deleted |
| API keys | Until revoked or the account is deleted |
| Access logs | 14 days |
| Rate limit counters | Minutes |
| Prompt and response content | Not retained |
| Data needed for legal claims | Statutory limitation period (Art. 1964 Spanish Civil Code) |
Once those periods expire, data is deleted or irreversibly anonymised.
7. Your rights
You may exercise the following rights by writing to [email protected], stating which right you are exercising and proving your identity:
- Access (Art. 15): find out what data of yours we process.
- Rectification (Art. 16): correct inaccurate data.
- Erasure (Art. 17): delete your account and keys.
- Restriction (Art. 18): limit processing while a complaint is resolved.
- Portability (Art. 20): receive your data in a structured format.
- Objection (Art. 21): object to processing based on legitimate interests.
We will respond within one month, extendable to two for complex cases, and will inform you of any extension. Exercising these rights is free of charge.
Deleting your account also deletes your API keys, which stop working immediately and permanently.
8. Complaints to a supervisory authority
If you believe we have not handled your rights correctly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es. You may also contact the supervisory authority of your EU country of residence.
9. Cookies
We use a single cookie: the signed session cookie that keeps you logged in to the dashboard. It is strictly necessary for the service and exempt from prior consent under Art. 22(2) of the Spanish Information Society Services Act (LSSI-CE). It is HttpOnly, Secure and SameSite=Lax, and expires after seven days.
We use no advertising cookies, tracking pixels or third-party analytics. That is why no cookie banner is shown.
10. Security
Traffic is encrypted with TLS. API keys are stored only as cryptographic hashes. We apply the principle of data minimisation: we do not collect data we do not need, and we do not retain the content of requests.
No system is infallible. If a security breach affected your personal data, we would notify the AEPD within 72 hours and, where there is a high risk to your rights, we would also notify you, in accordance with Articles 33 and 34 GDPR.
11. Children
The service is intended solely for people aged 18 or over. We do not knowingly collect data from children. If we identify an account belonging to a minor, we will delete it and the associated data.
12. Changes to this policy
If we make a material change to this policy we will update the date at the top and, where the change affects the legal basis or expands the purposes, we will tell you before it takes effect. Continued use of the service after it takes effect means you accept it.