Privacy Policy

This Privacy Policy describes how Fluxon LLC ("we", "us", or "our") collects, uses, and protects your personal information through GateLLM (gatellm.io). We are committed to protecting your privacy and complying with applicable data protection laws.

By using our services, you agree to the data practices described in this Privacy Policy. If you do not agree with this policy, please do not use our services.

Fluxon LLC is the data controller for this website and its services. We are a company registered in the State of Delaware, USA.

To contact us regarding your data rights or any privacy-related questions, please email support@gatellm.io.

We collect the following types of personal information:

• Account Information: When you create an account, we collect your email address, name, and company name. This information is stored via the Supabase authentication system.
• Sales Inquiry Information: When you contact us through the demo request form, we collect your name, company, email, and message.
• Payment Information: Payments are processed by Stripe. We do not directly store your credit card or bank information. Stripe may process necessary payment information to complete transactions.
• Technical Data: We may collect your IP address, browser type, device information, and access timestamps.

GateLLM uses a BYOK (Bring Your Own Key) architecture. This means:

• Your LLM API keys are stored only in the memory of your self-hosted gateway instance and are never uploaded to our servers or persisted to a database.
• Your LLM request data is routed directly through your gateway to the model provider's official API and does not pass through Fluxon's servers.
• Your API keys and request content always remain within your private network.

We use the collected data for the following purposes:

• Providing and improving our services
• Processing payments and managing subscriptions
• Responding to your inquiries and requests
• Sending service-related notifications and updates
• Maintaining security and preventing fraud
• Complying with legal obligations

Under applicable data protection laws (such as the GDPR), the legal bases on which we process your personal information include:

• Contractual Necessity: Processing necessary to provide the services you request and to process subscriptions and payments.
• Legal Obligation: Processing necessary to comply with applicable laws, such as tax, accounting, and regulatory requirements.
• Legitimate Interests: Processing necessary for service security, fraud prevention, product improvement, and internal analytics, where these interests are not overridden by your rights and freedoms.
• Consent: Where processing requires consent (such as enabling Plausible analytics or marketing communications), we proceed only after obtaining your consent, which you may withdraw at any time.

We do not sell your personal information. Except as described in this policy, we do not share your personal information with third parties. We may share information in the following limited circumstances:

• Sub-processors: Providers that deliver our services, as described under "Sub-processors".
• Legal Requirements: In response to court orders, subpoenas, or other legal process, or where necessary to respond to regulatory inquiries, protect rights, or defend against liability.
• Business Transfers: Information may be transferred as an asset in connection with a merger, acquisition, or asset sale; in such transactions we will notify you in advance and require the recipient to continue honoring this policy.
• With Your Consent: In other circumstances where you have explicitly authorized the sharing.

We use the following sub-processors to provide our services:

• Supabase: Database storage and authentication services
• Stripe: Payment processing services
• Resend: Email delivery services
• Cloud hosting providers: Website and infrastructure hosting
• Analytics provider: Plausible Insights Ltd. (EU; cookieless, collects no personal data; data processed in Germany with no cross-border transfer; retention 3 years). Loaded only after you accept analytics.
• Error monitoring (Functional Software, Inc. / Sentry): Used to diagnose frontend and backend errors. Frontend Sentry is consent-gated (loaded only after you accept analytics); backend Edge Functions Sentry is always enabled. May collect error stack traces, browser type, and IP address.

The data you process through GateLLM falls into two categories with different storage locations:

• Control-plane data: Your account information, subscription and license records, and sales inquiries are stored in the hosting environments of our cloud providers and sub-processors (such as Supabase, Stripe, and Resend), and may be located outside the European Union, including in the United States.
• Gateway runtime data: The prompts, completions, and LLM API keys you process through the gateway are stored entirely within your own infrastructure. Fluxon retains no copies and cannot access them.

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, or for a longer period if required by law.

• Account Information: Retained during the account lifetime and for 30 days after account closure.
• Sales Inquiry Information: Retained for 3 years to follow up on potential business opportunities.
• Payment Records: Retained for 7 years in accordance with tax and accounting regulations.
• Log Data: Retained for 90 days for security and troubleshooting purposes.

Under applicable law, you have the following rights:

• Right to Access: Obtain a copy of the personal information we hold about you.
• Right to Rectification: Correct inaccurate personal information.
• Right to Erasure: In certain circumstances, request deletion of your personal information.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Restriction: Request restriction of processing of your information.
• Right to Object: Object to certain types of data processing.
• Right to Withdraw Consent: Withdraw previously given consent at any time.

Our sub-processors may be located in countries outside the European Union. When we transfer your control-plane data outside the EU, we ensure:

• The recipient country has received an adequacy decision from the European Commission, or
• We have entered into Standard Contractual Clauses (SCCs) with the sub-processor.

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption in transit (TLS 1.3)
• Encryption at rest
• Access controls and authentication
• Regular security assessments
• Employee data protection training

We use cookies and similar technologies (such as localStorage) to recognize your browser, remember your preferences, and understand how you use our services.

Specifically, we use localStorage to store your cookie consent status; we use Plausible (a cookieless, privacy-focused analytics tool) to collect aggregated, anonymous usage data, and such collection is gated by your consent (loaded only after you accept analytics).

For details on the types of cookies we use, our consent mechanism, and how to manage or withdraw consent, please see our Cookie Policy.

Cookie Policy

Our services may contain links to third-party websites or services, and under the BYOK model you will connect to services provided by third-party model providers through the gateway.

We are not responsible for the privacy practices, data handling, or availability of these third-party websites or model providers. Each LLM provider is an independent controller of personal information, and your data relationship with them is governed by their respective privacy policies and terms of use.

We recommend that you review the privacy policy of any third-party service you visit.

Our services are intended for business users and are not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us.

We may update this Privacy Policy from time to time. Material changes will be communicated through website notifications or email. Your continued use of our services constitutes acceptance of the updated policy.

If you have any questions or concerns about this Privacy Policy, or wish to exercise your data rights, please contact us at:

• Email: support@gatellm.io
• Company: Fluxon LLC
• Registered in: Delaware, USA