Privacy Policy

CloudSitus (“we”, “us”, “our”) is a stateless AI gateway operated from Switzerland. We provide a single OpenAI-compatible API that routes requests to upstream AI model providers (Infomaniak, Scaleway, Microsoft Azure, Mistral, Anthropic, OpenAI, Google and others — the current list is published in our sub-processor register) while enforcing per-region data residency and a hard PHI gate.

Contact: hello@phi-cloud.com

Account & identity data

• Email address — collected at sign-up (email/password or Google OAuth). Stored by Supabase Auth and used to identify your account.
• Google OAuth identity — if you sign in with Google, Supabase Auth receives your Google account ID and email. We do not receive your Google password or other Google profile data.
• Account metadata — stored inside your Supabase Auth user record: your preferred default region (country_code), and, written only by our server, your Stripe customer ID (stripe_customer_id), a record of each Customer Agreement version you accepted and when, whether reseller mode is on, and a display copy of your subscription status and card label (brand and last four digits).
• API key metadata — for each key you create we store its id, the name you give it, a masked preview (never the full key), and its creation time in our key store on Cloudflare (EU). This lets you list and revoke keys; the key itself is never stored and is shown only once, at creation.
• Reseller data — if you enable reseller mode, the same metadata for each end-customer key you mint (plus the label you give it and an opaque customer handle — never the end-customer’s email), optional per-customer spend caps, and monthly cost totals per handle, in the same EU key store.

Billing data

• Payment method, invoices, and subscription state are managed and stored exclusively by Stripe. CloudSitus stores your Stripe customer ID and the display-only card label above in your Supabase Auth metadata, and short-lived caches of your balance and spend in our key store. We never see or store your card number.
• Usage cost (in micro-USD) is reported to Stripe as meter events aggregated per model and region. We do not store per-call records, token counts, or prompt/response content.

Request traffic

• CloudSitus is a stateless proxy. Prompt and response payloads are forwarded to the upstream provider and are never logged or stored by CloudSitus. If a request carries the X-PHI: true header we route it only to a PHI-eligible provider/region pair — we do not inspect or store the content.
• Transient server logs (IP addresses, HTTP method, path, status code) may be retained for a limited period by our hosting provider (Cloudflare) in accordance with their data-processing terms.

No special categories by default

CloudSitus does not knowingly collect health data, financial records, or other special-category personal data for its own purposes. If your application routes PHI through the API, that data passes through to the upstream provider without being stored or processed by CloudSitus beyond the routing decision.

• Contract performance (Art. 6(1)(b) GDPR / nFADP equivalent) — processing your email and account metadata is necessary to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f) GDPR) — transient infrastructure logs (IP, path, status) to detect abuse and maintain security.
• Consent (Art. 6(1)(a) GDPR) — where you have given explicit consent, e.g. for optional communications.

For Swiss users, processing is based on equivalent grounds under the revised nFADP (Federal Act on Data Protection, in force 1 September 2023).

CloudSitus uses the following third-party sub-processors. Each sub-processor handles data only as instructed and under a data-processing agreement (DPA) or equivalent instrument.

Upstream AI providers may process prompt data in accordance with their own data policies. PHI is routed only to providers whose DPA or BAA we have reviewed: Infomaniak and Azure in Switzerland, Scaleway and Azure in the EU, and Azure in the US (OCR and speech only).

The table above lists the processors behind the account and the core inference paths. The sub-processor register is the complete and authoritative list — it also covers the region-resident OCR/speech, media-generation, retrieval and transactional-email processors — and it is the page we update before engaging anyone new.

• Account data (email, metadata) is stored in Supabase Auth, hosted on AWS eu-central-1 (Frankfurt). It is retained for as long as your account is active and deleted within 30 days of account deletion.
• Billing data is retained by Stripe according to their data retention policy and applicable tax/accounting obligations (typically 7 years for invoices).
• API key metadata (key id, name, masked preview, creation time) is stored in our key store on Cloudflare (EU). It is removed the moment you revoke a key, and all of your keys — including any end-customer keys you minted as a reseller — are purged when you delete your account.
• Request payloads are not retained by CloudSitus. Upstream provider retention policies apply to data sent to them.
• Infrastructure logs are retained for a limited period by Cloudflare under their data-processing terms.
• Support requests you send from the dashboard are emailed (through our email provider, Resend) to our support mailbox together with your account identifiers — user id, email, Stripe customer id, default region, API-key count, browser user agent and time. CloudSitus does not store them in its own systems; the email is the support record, kept in the mailbox for 6 months after the request is resolved and then deleted — sooner on request.

• All traffic is encrypted in transit using TLS 1.2+.
• API keys are self-contained HMAC-signed tokens — CloudSitus never stores issued keys. Compromise of the signing secret would require rotation of all keys simultaneously; the secret is stored only in the deployment environment.
• Authentication is handled by Supabase Auth (bcrypt password hashing, OAuth PKCE flow).
• CloudSitus has a minimal attack surface by design: no database holds tenant data (a separate database holds the public model catalogue only), which eliminates whole classes of SQL injection and data-exfiltration risk.

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Portability — receive your data in a machine-readable format.
• Restriction / objection — restrict or object to certain processing activities.

These rights apply under GDPR (EU), nFADP (Switzerland), UK GDPR, and similar laws. To exercise them, see our Data & Privacy page or email us at hello@phi-cloud.com.

You can delete your account and all associated data at any time from the Account page in your dashboard. Alternatively, see the Data & Privacy page or email hello@phi-cloud.com.

Upon deletion: all of your API keys (and, if you are a reseller, every end-customer key you minted) are revoked, auto-recharge and reseller mode are switched off, and your per-account caps and usage totals are cleared; then your Supabase Auth record (email and metadata) is removed, and the dashboard's browser storage is cleared in the browser you delete from. Your Stripe customer record is not deleted — it is marked as deleted and kept, because Stripe retains billing records (invoices, payments, and the email on them) as required by tax and accounting law. Upstream provider logs are subject to their own retention policies.

CloudSitus uses a single session cookie set by Supabase Auth to maintain your login state. No third-party tracking or advertising cookies are set. We do not use analytics cookies.

Website analytics. We measure visits to this site and the dashboard with first-party, cookieless analytics, hosted on Cloudflare by Monopea, which is run by the same operator as CloudSitus. It sets no cookies and stores nothing in your browser. Your IP address and user agent are only used to compute a hash with a salt that rotates daily (each salt is deleted within 48 hours); they are never stored. We keep only the page path (with ids removed), the referring site's host name, UTM campaign tags, your country, your device class (mobile, tablet or desktop), whether you signed up or completed a checkout, and that daily hash, for 90 days. It never sees API traffic, prompts, chat content or model outputs. If your browser sends Do-Not-Track or Global Privacy Control, nothing is sent.

The dashboard also keeps some state in your browser's local storage: your chat conversations and the API key the chat and playground use (plus a session-storage cache of your detected region). CloudSitus does not store them — each chat turn is sent through the API to be answered and is not retained. The dashboard API key expires after 24 hours. This browser state is tied to your account and cleared when you sign out or delete your account.

We may update this policy from time to time. The effective date at the top of this page will reflect the latest revision. For material changes, we will notify registered users by email.

For privacy-related questions or to exercise your rights, contact us at: hello@phi-cloud.com.

CloudSitus is operated from Switzerland. You have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch or your local supervisory authority.