PRIVACY POLICY

IonRouter.io

Operated by Cumulus Compute Labs Corporation
Effective Date: March 4, 2026

1. Introduction

This Privacy Policy describes how Cumulus Compute Labs Corporation (“Cumulus,” “we,” “us,” or “our”) collects, uses, stores, and discloses information when you use the IonRouter platform, API, playground, and related services (collectively, the “Service”). By using the Service, you agree to the practices described in this Privacy Policy. We are committed to protecting your privacy and handling your data responsibly. This Privacy Policy applies to all users of the Service, including API consumers, playground users, and enterprise customers.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Name and email address
  • Organization or company name (if applicable)
  • Account credentials (passwords are stored in hashed form)
  • API keys associated with your account

2.2 Payment and Billing Information

When you purchase services, our third-party payment processor (Stripe) collects your payment information, including credit card number, billing address, and related details. Cumulus does not directly store your full credit card number. We receive and retain transaction records, billing history, and a tokenized reference to your payment method from Stripe.

2.3 API Request Logs and Prompts

When you use the Service, we collect and store:

  • API request metadata (timestamps, model used, token counts, request duration)
  • Input prompts and parameters submitted to the API
  • Model configuration settings (temperature, max tokens, etc.)
    We retain API request logs for operational, security, and abuse prevention purposes. Logs may be reviewed to enforce our Terms of Service and Acceptable Use Policy.

2.4 Generated Content

The Service generates outputs including text, images, video, and audio (“Generated Content”). We may temporarily store Generated Content on our servers for the purpose of delivering it to you and for a limited retention period thereafter for abuse detection, debugging, and service improvement.

2.5 Usage Analytics

We collect usage analytics to operate and improve the Service, including:

  • Model usage patterns and frequency
  • Request volume and throughput metrics
  • GPU resource utilization and load balancing data
  • Error rates and latency measurements
  • Feature usage within the playground and console
    We do not collect IP addresses as part of our usage analytics. Usage analytics are collected in aggregate or pseudonymized form and are used primarily for infrastructure provisioning, capacity planning, and service optimization.

2.6 Information We Do NOT Collect

For clarity, Cumulus does not collect:

  • IP addresses
  • Precise geolocation data
  • Device fingerprints or advertising identifiers
  • Browsing history or cross-site tracking data

3. How We Use Your Information

We use the information we collect for the following purposes:

Category Purpose
Account Information To create and manage your account, authenticate access, and communicate with you about the Service.
Payment Information To process payments, manage billing, prevent fraud, and comply with financial regulations.
API Request Logs To provide the Service, enforce our Acceptable Use Policy, detect and prevent abuse (including CSAM), debug errors, and improve model performance.
Generated Content To deliver outputs to you, detect prohibited content, investigate policy violations, and improve content safety systems.
Usage Analytics To provision GPU infrastructure, optimize load balancing, plan capacity, monitor service health, and improve the Service.

4. Legal Bases for Processing

We process your information on the following legal bases:

  • Contractual Necessity: Processing necessary to provide the Service and fulfill our obligations under the Terms of Service.
  • Legitimate Interests: Processing for abuse prevention, security, service improvement, and infrastructure optimization, where these interests are not overridden by your privacy rights.

5. How We Share Your Information

  • Legal Compliance and Safety: We may disclose information if required by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Cumulus, our users, or the public. This includes mandatory reporting of CSAM to the National Center for Missing & Exploited Children (NCMEC) and law enforcement.
  • Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. We will provide notice before your information becomes subject to a different privacy policy.
  • With Your Consent: We may share information with your explicit consent or at your direction.

6. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:

  • Account Information: Retained for the duration of your account and for a reasonable period thereafter for legal and business purposes.
  • Payment Information: Transaction records retained as required by financial regulations and tax law (typically 7 years).
  • API Request Logs: Retained for up to 90 days for operational purposes, unless longer retention is required for abuse investigation or legal compliance.
  • Generated Content: Retained for up to 30 days after generation, unless longer retention is required for abuse investigation. You may request earlier deletion.
  • Usage Analytics: Retained in aggregated or pseudonymized form indefinitely for service improvement.

7. Data Security

We implement industry-standard technical and organizational measures to protect your information, including encryption in transit (TLS) and at rest, access controls, and regular security assessments. However, no system is perfectly secure, and we cannot guarantee the absolute security of your information. If we become aware of a data breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate personal information.
  • Deletion: Request deletion of your personal information, subject to legal retention requirements.
  • Data Portability: Request a copy of your data in a structured, machine-readable format.
  • Objection: Object to processing of your personal information based on legitimate interests.
  • Restriction: Request that we restrict processing of your personal information in certain circumstances.

To exercise any of these rights, please contact us at legal@cumuluslabs.io. We will respond to your request within 30 days (or such shorter period as required by applicable law).

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information. As stated above, we do not sell personal information. To exercise your CCPA rights, contact us at legal@cumuluslabs.io. We will not discriminate against you for exercising your privacy rights.

10. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, where data protection laws may differ from those in your jurisdiction.

11. Children’s Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will promptly delete such information and terminate the associated account. If you believe a minor has provided us with personal information, please contact us at legal@cumuluslabs.io.

12. Third-Party Services and Links

The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access.

13. Cookies and Similar Technologies

The IonRouter website and console may use essential cookies to maintain your session and authenticate your account. We do not use third-party advertising cookies or cross-site tracking technologies. You can manage cookie preferences through your browser settings.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy on our website and updating the “Effective Date” above. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Cumulus Compute Labs Corporation
Email: legal@cumuluslabs.io
San Francisco, California, United States