Privacy Policy

Hiway2llm.com, registered in France, is the data controller for HiWay2LLM. Contact: [email protected]

3.1. Account Data (legal basis: contract execution)

• Email address
• Password hash (PBKDF2-SHA256 - we never store plaintext passwords)
• API key hashes (SHA-256 - we never store plaintext API keys)
• Account creation date
• Preferred locale (en / fr / es), captured from your browser at signup so emails and onboarding are in the right language
• Country code (2-letter ISO) at signup and at each login, derived from your IP via a fail-open lookup (used to detect cross-country logins for security and to pick the right marketing language)
• IANA timezone (e.g. Europe/Paris) when your browser provides it, so we display timestamps in your local time

3.2. Usage Metadata (legal basis: contract execution + legitimate interest)

• Request timestamp
• Model selected by the router
• Token count (input/output)
• Cost in USD
• Routing tier (light/standard/heavy)
• Routing latency (milliseconds)
• Complexity score (0.0 to 1.0)

This data is used for billing, analytics, and Service improvement. It does NOT contain any prompt content, response content, or personally identifiable information beyond the account email.

3.3. Payment Data (legal basis: contract execution)

Payment is processed by Stripe, Inc. The Company does not store credit card numbers. See Stripe's Privacy Policy.

3.4. Anonymous Visitor Analytics (legal basis: legitimate interest, art. 6 § 1 f GDPR)

To measure which marketing pages and acquisition channels work, we record anonymous funnel events on our public pages (landing, blog, comparison pages, docs). Each event captures:

• The page path visited (no query string content beyond UTM parameters)
• The event type (pageview, signup_start, signup_complete, cta_click, etc.)
• The HTTP referer reduced to its domain (e.g. news.ycombinator.com)
• UTM parameters (utm_source, utm_medium, utm_campaign) when present in the URL
• Approximate country (2-letter ISO code) and your Accept-Language header
• Device family (desktop/mobile/tablet), OS family, browser family - derived from your User-Agent string
• An anonymous session identifier - random UUID stored in sessionStorage (cleared when you close the tab), HMAC-SHA256 hashed server-side before storage
• Your IP address truncated to a /24 network for IPv4 or /48 for IPv6 - the truncation happens immediately after the country lookup, the raw IP is never written to any database

No cookies are set for visitor analytics. We use sessionStorage only, which is per-tab and self-clears.

We respect both DNT (navigator.doNotTrack === "1") and Sec-GPC (Global Privacy Control). When either signal is set by your browser, the tracker fires nothing - no event is sent to our servers.

Anonymous visitor data is stored in our self-hosted ClickHouse instance in France (no transfer outside the EU), automatically purged after 90 days. Aggregated daily statistics that contain no individual sessions are retained for long-term trend analysis.

• Prompt content (messages sent to LLMs)
• LLM response content
• System prompts
• Tool definitions or tool call results
• Raw IP addresses on visitor analytics - always truncated to /24 (IPv4) or /48 (IPv6) before storage
• Tracking cookies for anonymous visitors - we use sessionStorage only
• Browser fingerprints, mouse movements, keystrokes, scroll heatmaps, or session replays
• Precise geolocation (only the 2-letter country code is recorded)

5.1. LLM Providers: Your prompts are forwarded to the LLM provider selected by the routing engine (Anthropic, OpenAI, Google, Mistral, DeepSeek). Each provider has its own privacy policy. HiWay2LLM uses the provider's API - we do not add any tracking or metadata to your prompts.

5.2. Stripe: Payment data is processed by Stripe. No credit card data passes through HiWay2LLM servers.

5.3. We do NOT sell, rent, or share personal data with any other third party.

5bis.1. What loads only after cookie consent

When you accept cookies via our banner, we load two third-party scripts for the sole purpose of measuring marketing campaign effectiveness:

• Reddit Ads Pixel (Reddit, Inc., USA), fires PageVisit on page load and Lead events on CTA clicks. Reddit's Auto-Advanced Matching may collect emails and phone numbers visible on the page or typed into forms, hashed client-side (SHA-256) before transmission. Reddit Privacy Policy
• Google Analytics 4 (Google LLC, USA), page views and events, IP-anonymized. Google Privacy Policy

5bis.2. Your control

These scripts do NOT load if you decline cookies or ignore the banner. You can withdraw consent at any time by clearing hw_cookie_consent in your browser's local storage. Both vendors implement Standard Contractual Clauses (SCC) for EU→US data transfers under GDPR.

5bis.3. What we do NOT do

• We do NOT load these trackers inside the authenticated app, they fire only on public marketing pages
• We do NOT combine pixel data with your prompt usage data
• We do NOT sell tracker data, it is consumed by Reddit/Google for ad measurement only

• Account data: retained until account deletion
• Usage metadata: retained for 24 months for billing and analytics
• Payment records: retained for 10 years (French accounting law)
• Prompt/response content: NOT retained (zero seconds)
• Anonymous visitor analytics events: 90 days, then automatically purged
• Aggregated daily visitor statistics (no individual sessions): retained indefinitely for long-term trend analysis
• Login events with country code: 12 months (security audit, new-country challenge)

Under the General Data Protection Regulation (EU) 2016/679, you have the right to:

• Access - request a copy of your data
• Rectification - correct inaccurate data
• Erasure - request deletion of your account and data
• Portability - receive your usage data in JSON format
• Objection - object to processing based on legitimate interest
• Restriction - request restriction of processing

To exercise these rights, contact [email protected]. We respond within 30 days.

8.1. HiWay2LLM is a routing proxy, not an AI system as defined by the EU AI Act (Regulation 2024/1689). We do not train, fine-tune, or deploy AI models.

8.2. The routing scoring engine uses deterministic heuristics (CPU-based pattern matching), not machine learning. It does not make decisions that affect natural persons.

8.3. We provide full transparency on routing decisions: every response includes headers indicating which model was selected, the complexity score, and the routing latency.

8.4. Clients using HiWay2LLM to deploy AI systems remain responsible for their own AI Act compliance obligations.

• All connections use TLS 1.3 (HTTPS enforced by Caddy)
• Passwords hashed with PBKDF2-SHA256 (100,000 iterations)
• API keys hashed with SHA-256
• Redis data encrypted at rest (when using managed Redis)
• Server hosted in OVH datacenter (France, EU)
• No prompt data touches persistent storage

Enterprise clients can request a Data Processing Agreement (DPA) compliant with GDPR Article 28. Contact [email protected].

You may file a complaint with the French data protection authority (CNIL): www.cnil.fr