Privacy Policy — Laras Router

1. Introduction

This Privacy Policy explains how Laras Router ("we", "us", or "our") collects, uses, processes, and safeguards information when you visit larasrouter.com, register for an account, access our developer console, or connect to our API gateway.

We are committed to transparency and privacy. We treat developer data with the utmost care, adhering to the provisions of Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and international security standards.

2. Passthrough Proxy Architecture & API Payload Handling

Our Infrastructure Policy: Laras Router operates as an ephemeral-payload proxy. We do not persistently store, retain, or train upon your API request prompts, chat messages, or completion response payloads. To route, meter, and bill each request, we transiently process request and response content in memory — counting tokens, validating payloads, and detecting errors — and discard that content when the request completes. What we retain is operational metadata (model ID, token counts, HTTP status, charges, and timestamps), which forms your auditable usage and billing ledger. We may retain or disclose this metadata where compelled by lawful process under Indonesian law.

When you send requests to POST /v1/chat/completions, your prompts and the returned completions are handled in temporary in-memory buffers while we route the call, count tokens for metering, and detect errors. Once the request completes, that content is discarded and is never written to disk, archived, indexed, or used to train any model. Only the operational telemetry metadata described above is persisted, so that your usage can be metered, billed, and audited accurately.

Important Upstream Provider Notice: Because Laras Router functions as a proxy gateway to third-party artificial intelligence foundation model providers (currently DeepSeek), your request payloads are necessarily transmitted to and processed by the upstream provider to generate completions. DeepSeek processes data in the People's Republic of China, so your prompts are transferred outside Indonesia. Upstream providers handle, process, and may temporarily retain data in accordance with their own independent privacy policies, terms of service, and abuse-monitoring practices. Laras Router does not operate upstream model servers and cannot control or guarantee the independent data policies of third-party providers. We encourage customers to review the respective terms of each upstream provider they select.

3. Information We Collect

A. Account Information

Authentication Data: Email address, hashed credentials (using Argon2id), and account creation timestamps.
Profile Information: Developer display name or organization name, if voluntarily provided.

B. Billing and Transaction Records

Transaction Identifiers: Unique invoice IDs, gateway reference codes, payment status, and timestamps.
Financial Values: Prepaid USD top-up amount, the exchange rate applied, the QRIS admin fee, and the Rupiah total paid.
What We Do NOT Collect: We never receive or store your bank account passwords, debit/credit card numbers, CVVs, or mobile banking PINs. All QRIS processing is executed by our licensed Indonesian payment gateway, Doit.id.

C. Operational Telemetry and Metadata

API Metadata: Request ID, model requested (e.g. deepseek-flash), prompt token count, completion token count, charge, and HTTP status code.
Technical Diagnostics: IP address, user-agent string, and error logs collected solely to detect network abuse, prevent DDoS attacks, and diagnose infrastructure outages.

4. How We Use Your Information

We process collected data exclusively for the following purposes:

To provide, operate, and maintain the Laras Router API gateway.
To calculate real-time token usage, update your Account Balance, and generate billing ledgers.
To authenticate API requests and verify bearer key authorization.
To reconcile QRIS payments with our payment gateway.
To protect the platform against fraud, security exploits, and infrastructure abuse.
To provide customer support and notify you of critical service or balance updates.

5. Service Providers We Share Data With

We use the following third parties to operate the Service:

DeepSeek (model provider): receives the prompts and parameters of your API requests and returns completions. DeepSeek processes data in the People's Republic of China under its own terms and privacy policy.
Cloudflare: hosts and delivers our website and console, and provides network security. Cloudflare Turnstile checks account forms (such as sign-up and login) for automated abuse using browser signals and your IP address.
Doit.id (payment gateway): creates and processes QRIS payments for top-ups and receives the payment details needed to do so, such as the invoice amount and reference.
Resend (transactional email): delivers account emails, such as email verification messages, and receives your email address and the message content.

Prompt inputs are sent to the model provider over encrypted (TLS) connections. Upstream providers are independent data controllers or processors operating under their own legal jurisdictions and terms. Laras Router cannot control upstream providers' internal data processing, temporary retention, or logging practices.

6. Data Security and Storage

We implement industry-standard technical and organizational security controls to protect your data. All communication between your application and Laras Router is encrypted in transit using modern TLS protocols. API secret keys are cryptographically hashed before storage. Telemetry metadata is stored in hardened, access-restricted databases.

7. Data Retention Periods

Account Data: Retained for the lifetime of your active account until you request deletion.
Billing & Financial Records: Retained for at least five (5) years in compliance with Indonesian commercial and tax regulations.
Usage Metadata and Ledger Records: Request metadata and balance ledger entries are retained for as long as needed to provide your usage and billing history and to meet our billing, accounting, tax, and legal obligations.

8. Your Rights and Data Deletion

Under Indonesian Law No. 27 of 2022 (UU PDP), you have the right to access, rectify, or request the deletion of your personal account data. If you wish to delete your account or request an export of your transaction history, please submit a request to [email protected].

9. Language

This Privacy Policy is provided in English and Bahasa Indonesia. If there is any inconsistency or difference in interpretation between the two versions, the Bahasa Indonesia version prevails, consistent with Law No. 24 of 2009 on the National Flag, Language, Emblem, and Anthem.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us at:

Laras Router
Privacy & Data Protection Team
Email: [email protected]
Yogyakarta, Indonesia