Privacy Policy

1. Scope and controller

This Privacy Policy explains how Cybrient Technologies SA ("Cybrient", "we", "us", or "our") collects, uses, discloses, stores, and otherwise processes personal data in connection with BoldRouter, https://boldrouter.com, related pages, communications, support, accounts, and the services described below.

It applies when a person visits the Site, creates or administers an account, purchases or uses Credits, sends API or other requests, communicates with us, or uses a Model through BoldRouter. It does not replace the separate privacy terms of a Model Provider or another third party.

This Policy should be read with the applicable Terms of Use, any Order Form, and any data processing agreement ("DPA"). If a signed DPA applies to Customer Personal Data, the DPA controls to the extent of a conflict about that processing.

The controller for the processing described in this Policy is Cybrient Technologies SA, Rue Liotard 6, 1202 Genève, Switzerland, UID CHE-211.912.834. Privacy requests may be sent to [email protected].

2. Our role and the Customer's role

Cybrient's role depends on the processing activity:

• For website operation, account registration, contracts, billing, communications, fraud prevention, security, compliance, and service analytics, Cybrient generally acts as an independent data controller.
• For personal data contained in Inputs and Outputs that a business Customer submits and instructs Cybrient to process to provide BoldRouter, Cybrient generally acts as a processor or service provider for that Customer.
• For security, abuse detection, billing integrity, legal compliance, and protection of the Service, Cybrient may process limited Customer data for its own legitimate and legal purposes as an independent controller, where permitted by law.
• A Model Provider may act as Cybrient's subprocessor, Customer's processor, or an independent controller depending on the provider relationship, Model Terms, selected configuration, and applicable law.

Business Customers are responsible for their own privacy notices, lawful bases, consent, data minimization, retention, access controls, and responses to individuals whose data they submit. An individual seeking rights concerning data controlled by their employer or another Customer should ordinarily contact that Customer first; Cybrient will assist as required by contract and law.

3. Personal data we collect

Data provided by users and business customers

• name, business email, telephone number, job title, employer, department, address, and other profile or contact details;
• account credentials, authentication information, organization membership, roles, permissions, provider preferences, and settings;
• billing contact, invoice information, VAT or tax information, transaction history, Credit balance, payment reference, and the net amount received by wire;
• information submitted for KYB, sanctions, fraud, tax, or other compliance checks;
• support requests, correspondence, surveys, Feedback, and records of disputes or complaints; and
• Inputs, Outputs, uploaded files, and any personal data contained in them.

Data from third parties

• information from an employer, Admin User, reseller, integration, authentication provider, or person who invites a user;
• payment, fraud, and transaction information from Stripe, banks, and payment networks;
• usage, error, availability, pricing, and policy information from Model Providers; and
• lawful public or commercial information used for business verification, sanctions screening, security, or fraud prevention.

Data collected automatically

When a person visits the Site or uses the Service, we may automatically collect:

• IP address, approximate location derived from IP, browser type, operating system, device type, language, time zone, and device or session identifiers;
• pages, screens, links, features, Models, routes, and settings used; timestamps; referring pages; response times; error events; and diagnostic data;
• authentication, API, network, security, fraud, audit, and access logs; and
• cookie identifiers, consent choices, preferences, and other information collected by cookies, local storage, pixels, or similar technologies.

We use Cloudflare for content delivery, network security, bot and abuse protection, and related traffic processing. We may use first-party systems for operational analytics, performance monitoring, billing integrity, and product improvement. We do not currently use third-party advertising cookies or sell personal data for advertising.

Strictly necessary technologies support authentication, security, load balancing, fraud prevention, and core preferences and cannot always be disabled. Where required by law, optional functional or measurement technologies are used only after consent. Browser or device settings can block or delete cookies, but this may prevent parts of the Service from working.

4. Inputs, Outputs, and Model Provider practices

When Customer submits an Input, BoldRouter transmits the Input and necessary routing metadata to the Model Provider selected by Customer or selected through automatic routing. The provider processes it to generate an Output. If fallback routing is enabled, more than one provider may receive a request because of retries, failures, or configured alternatives.

Model Providers have different data-retention, training, safety-review, regional, and security practices. Some providers may retain or use Inputs and Outputs to train, fine-tune, evaluate, or improve their models. Others offer no-training or zero-retention commitments for particular endpoints or accounts.

CYBRIENT DOES NOT USE CUSTOMER INPUTS OR OUTPUTS TO TRAIN CYBRIENT MODELS UNLESS CUSTOMER SEPARATELY AND EXPRESSLY OPTS IN TO A CLEARLY IDENTIFIED PROGRAM.

Provider labels and links are based on information available to Cybrient and may change or be incomplete. Customer must review the current Model Terms and select a provider appropriate for its data. Cybrient cannot reverse provider-side use after data has been transmitted to a provider that permits training or retention.

For enterprise processing governed by a signed DPA or Order Form, that agreement may impose additional restrictions. A Model Provider may be a subprocessor or independent controller depending on the arrangement.

5. Optional privacy-protection processing

When Customer enables the Privacy Protection Feature, BoldRouter processes the original Input within Cybrient systems to apply configured or predefined rules that attempt to detect, remove, mask, replace, or transform selected categories of private or sensitive information before transmission to a Model Provider.

The transformed Input, rather than the original Input, is intended to be routed to the provider, subject to the selected configuration and technical operation. Operational metadata may still be processed for routing, billing, security, and abuse prevention.

NO AUTOMATED RULE CAN GUARANTEE THAT ALL PERSONAL, CONFIDENTIAL, REGULATED, OR IDENTIFYING INFORMATION WILL BE DETECTED OR REMOVED.

Rules can miss context-dependent data, leave re-identifiable information, or alter meaning. Customer is responsible for lawful collection, minimization, rule selection, testing, review, provider choice, and deciding whether the residual data is appropriate to transmit.

6. Cookies, logs, and similar technologies

When a person visits the Site or uses the Service, we may automatically collect:

• IP address, approximate location derived from IP, browser type, operating system, device type, language, time zone, and device or session identifiers;
• pages, screens, links, features, Models, routes, and settings used; timestamps; referring pages; response times; error events; and diagnostic data;
• authentication, API, network, security, fraud, audit, and access logs; and
• cookie identifiers, consent choices, preferences, and other information collected by cookies, local storage, pixels, or similar technologies.

We use Cloudflare for content delivery, network security, bot and abuse protection, and related traffic processing. We may use first-party systems for operational analytics, performance monitoring, billing integrity, and product improvement. We do not currently use third-party advertising cookies or sell personal data for advertising.

Strictly necessary technologies support authentication, security, load balancing, fraud prevention, and core preferences and cannot always be disabled. Where required by law, optional functional or measurement technologies are used only after consent. Browser or device settings can block or delete cookies, but this may prevent parts of the Service from working.

7. How and why we use personal data

We process personal data for the following purposes and, where the GDPR or a similar law requires a legal basis, on the following bases:

• Provide and administer BoldRouter; authenticate users; route or generate requested results; maintain accounts and settings — performance of a contract; steps requested before a contract.
• Process purchases, wire receipts, Credits, invoices, taxes, and accounting records — contract; legal obligation; legitimate interests in payment and record integrity.
• Secure systems; detect fraud, abuse, malware, prohibited use, and account compromise; investigate incidents — legitimate interests; legal obligation; protection of rights and systems.
• Support, troubleshoot, monitor reliability, measure performance, and improve features — contract; legitimate interests in operating and improving the Service.
• Communicate service notices, policy changes, security alerts, and requested support — contract; legal obligation; legitimate interests.
• Send product news or marketing — consent where required; otherwise legitimate interests, with an opt-out.
• Comply with law, sanctions, lawful requests, tax, audit, litigation, and enforcement of terms — legal obligation; legitimate interests; establishment or defense of legal claims.
• Corporate transactions, restructuring, financing, or due diligence — legitimate interests, subject to confidentiality and applicable law.

Where processing is based on consent, consent may be withdrawn at any time without affecting processing already performed. Where based on legitimate interests, we consider the relevant business need, necessity, safeguards, and impact on individuals.

8. How we share personal data

We may disclose personal data to the following categories of recipients, only as reasonably necessary for the purposes described in this Policy:

• Model Providers. Inputs and related metadata are sent to the provider selected by Customer or selected through configured routing. Providers may process Inputs and Outputs under their own Model Terms and data practices.
• Hosting and infrastructure. Infomaniak provides hosting or cloud infrastructure; Cloudflare provides content delivery, network, security, and traffic services.
• Payments. Stripe processes card payments and related fraud and compliance information. Banks and correspondent institutions process wire transfers. Cybrient receives and credits only the net funds actually received.
• Communications. Microsoft and Resend may process contact details, message content, delivery data, and related metadata for email and business communications.
• Professional advisers and vendors. Lawyers, auditors, accountants, insurers, security specialists, and contractors may receive data where needed and subject to duties of confidentiality.
• Affiliates and corporate transactions. Data may be shared within the Cybrient group or with a buyer, investor, lender, or successor in a merger, acquisition, reorganization, financing, insolvency, or asset transfer, subject to appropriate safeguards.
• Authorities and protection. We may preserve or disclose data when required by law or a valid order, or where reasonably necessary to protect rights, safety, systems, users, providers, or the public; investigate fraud or abuse; or enforce agreements.
• Customer-directed recipients. We disclose Inputs, Outputs, and account data to integrations, workspace members, shared-link recipients, or other parties when Customer or an Authorized User directs or enables that disclosure.

Service providers are required by contract to process personal data only for permitted purposes and with appropriate confidentiality and security obligations, except where a recipient acts as an independent controller under its own legal duties and terms.

9. International data transfers

Cybrient is established in Switzerland and uses Swiss hosting through Infomaniak for core infrastructure. However, the Service is global. Cloudflare, Stripe, Microsoft, Resend, Model Providers, banks, support personnel, and other recipients may process personal data in Switzerland, the EEA, the United Kingdom, the United States, or other countries.

The destination of an AI request may depend on the Model Provider, route, configuration, and provider capacity. Customer should review provider information before selecting a Model if data residency is important.

Where personal data is transferred to a country that is not recognized as providing adequate protection, we use an available lawful transfer mechanism, such as contractual clauses recognized under Swiss data protection law, the European Commission's Standard Contractual Clauses with Swiss adaptations where appropriate, binding contractual safeguards, or a statutory exception. Copies or information about relevant safeguards may be requested at [email protected], subject to confidentiality and legal restrictions.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purpose collected, Customer instructions, contractual commitments, security, dispute resolution, and legal, tax, accounting, and regulatory obligations. Retention may differ by data type, configuration, provider, and jurisdiction.

• Account, contract, and business contact data is generally retained while the account or commercial relationship is active and for a reasonable period afterward.
• Transaction, invoice, tax, wire-transfer, and accounting records are retained for applicable statutory periods.
• Security, fraud, abuse, access, and diagnostic logs are retained for periods reasonably necessary to investigate incidents, enforce terms, protect systems, and meet legal obligations.
• Support and legal correspondence is retained for the time necessary to resolve the matter and establish, exercise, or defend claims.
• By default, Inputs and Outputs are processed for routing and are not intended to be persistently stored by Cybrient beyond what is needed to complete the request, unless Customer enables logging, private storage, debugging, or another retention feature.
• Even without Customer-enabled storage, limited content or metadata may be retained where reasonably necessary for abuse detection, security, incident investigation, billing, debugging, legal compliance, or dispute resolution.
• Image, audio, and video Inputs are transmitted to the selected provider and are not intended to be persisted by Cybrient beyond routing unless storage is enabled or retention is required for the purposes stated above.
• Content stored through an optional logging or private-storage feature is retained according to the applicable setting, product documentation, account status, deletion request, and reasonable backup cycles.

Deletion from active systems may be followed by deletion from backups on a rolling cycle. We may retain limited information where required by law, to prevent fraud or repeated abuse, to document a rights request, or to establish or defend claims. Where feasible, data no longer needed may be deleted or irreversibly anonymized.

Model Providers apply their own retention periods. Deleting data from Cybrient does not necessarily delete copies independently retained by a Model Provider or a recipient to whom Customer disclosed it.

11. Data security

We use technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures are selected according to risk and may include access controls, authentication, encryption in transit, network protection, logging, monitoring, backup practices, vendor controls, and incident procedures.

No internet transmission, Model Provider, storage system, or security measure is completely secure. Customer is responsible for protecting credentials, configuring permissions, limiting submitted data, maintaining endpoints and backups, and promptly reporting suspected compromise.

Where required by applicable law or contract, we will notify the competent authority, affected Customer, or affected individuals of a qualifying personal-data breach.

12. Privacy rights and complaints

Depending on applicable law and subject to conditions and exceptions, an individual may have rights to:

• obtain information about processing and access personal data;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests or to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time where processing is based on consent;
• request review of certain solely automated decisions, where applicable; and
• lodge a complaint with a competent data protection authority.

Requests may be sent to [email protected]. We may need to verify identity and authority and may ask for information needed to locate the data. We may refuse or limit a request where permitted by law, including to protect others, preserve legal privileges, comply with retention duties, or address manifestly unfounded or excessive requests.

For personal data controlled by a business Customer, the individual should contact that Customer. We will assist the Customer as required by a DPA and applicable law.

Individuals in Switzerland may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). Individuals in the EEA or United Kingdom may complain to the supervisory authority for their place of residence, work, or alleged infringement.

13. Marketing, cookies, and sale choices

A recipient may unsubscribe from marketing messages using the link in the message or by contacting [email protected]. The opt-out does not stop transactional, account, security, billing, or legal communications needed to provide the Service.

Cookie or similar-technology choices can be managed through any consent control provided on the Site and through browser settings. A user may also disable optional analytics where such a control is offered.

Cybrient does not sell personal data for money and does not currently share personal data for cross-context behavioral advertising. If that practice changes, this Policy and any legally required choice mechanism will be updated before the change applies.

14. Sensitive, image, audio, video, and biometric data

Some Models accept or generate images, audio, video, voice, faces, documents, health information, identifiers, financial information, or other sensitive data. Certain features may analyze voice or facial characteristics in a manner treated as biometric processing under applicable law.

A Customer that submits an image, voice, video, or other data relating to another person is responsible for providing required notice, obtaining valid consent or another lawful basis, and ensuring that the selected Model and use are permitted. Customer must not submit another person's biometric or highly sensitive data without appropriate authority and safeguards.

BoldRouter is intended to route image, audio, and video data only for the time needed to process the request, unless Customer enables storage or retention is required for abuse detection, security, billing, debugging, or law.

Cybrient does not independently use Customer Content to identify individuals through biometric templates or train Cybrient models unless a separate feature and notice expressly state otherwise. Model Providers may perform or retain biometric processing under their own terms.

15. Business use and age eligibility

BoldRouter is intended only for business users and is not directed to consumers or children. Every user must be at least 18 years old. We do not knowingly offer accounts to or collect account data directly from a person under 18.

If we learn that a person under 18 has provided personal data in violation of this restriction, we may suspend the account and delete the data, subject to legal retention duties. Business Customers must not submit children's data unless the processing is lawful, necessary, appropriately safeguarded, and permitted by the selected Model Terms.

16. Additional disclosures for U.S. residents

Where a U.S. state privacy law applies, residents may have rights to know or access categories and specific pieces of personal data, correct inaccuracies, delete data, obtain a portable copy, opt out of sale or certain sharing or profiling, and appeal a refusal. We will not discriminate against a person for exercising an applicable privacy right.

During the preceding twelve months, the categories of personal data we may have collected are identifiers and contact details; account credentials; commercial and transaction information; internet or network activity; approximate location; communications; professional or employment information supplied for business use; Customer Content; and inferences or usage statistics. Sources, purposes, and recipients are described in this Policy.

We do not sell personal data for monetary consideration. Model Provider processing is part of providing the requested Service; a provider may independently use data under its Model Terms. Customers that do not want provider training should select a provider and configuration that contractually or publicly commits not to use Inputs and Outputs for training.

An authorized agent may submit a request where law permits, but we may require proof of authority and direct identity verification. Requests and appeals should be sent to [email protected].

17. Third-party sites and integrations

The Site and Service may link to or interoperate with third-party websites, repositories, authentication services, applications, and integrations. Their privacy practices are governed by their own notices. Cybrient is not responsible for data a third party collects directly or independently after Customer directs a disclosure.

Customer should review third-party terms before connecting an integration. Disconnecting an integration stops future authorized transfers but may not delete data already received by that third party.

18. Policy changes and contact

We may update this Policy to reflect changes in law, providers, features, or practices. The updated version will be posted with a revised date. Where a change materially affects how account holders' personal data is used or their rights, we will provide advance notice by email or in-product message where reasonably practicable or legally required.

Continued use after the effective date means the updated Policy applies to processing from that date, subject to applicable law. Where consent is legally required for a new purpose, we will request it.

Questions, complaints, rights requests, and privacy notices may be sent to [email protected].

Controller: Cybrient Technologies SA, Rue Liotard 6, 1202 Genève, Switzerland. UID CHE-211.912.834. VAT CHE-211.912.834 MWST.

Service website: https://boldrouter.com

To the extent legally permitted, this Policy is governed by Swiss law and disputes are subject to the courts of Geneva, Switzerland, without limiting non-waivable privacy rights or a person's right to complain to a competent supervisory authority.