Privacy Policy
This Privacy Policy outlines how Nicrron Inc. (“Nicrron”, “we”, “us”, or “our”) collects, processes, transmits, and protects data when you use the Nicrron Universal AI Gateway, APIs, web interfaces, and developer observability tooling.
Zero-Retention Default
Prompt text and generated model tokens pass through RAM ephemerally and are never persisted to disk.
End-to-End TLS 1.3
All gateway traffic is strictly encrypted in transit using TLS 1.3 with forward secrecy ciphers.
No Model Training
Customer prompt data and completions are never utilized to train, fine-tune, or calibrate public AI models.
Complete Data Control
Full compliance with European GDPR, UK-GDPR, CCPA/CPRA, and right to instant erasure.
011. Scope & Architecture Overview
Nicrron operates a specialized high-performance AI inference routing gateway. Our infrastructure serves as an intelligent proxy layer sitting between your client software applications (e.g. web servers, mobile apps, background worker agents) and upstream foundation model inference endpoints (including OpenAI, Anthropic, Google Cloud Vertex, and DeepSeek).
This Privacy Policy applies to all services hosted at gateway.nicrron.com, nicrron.com, associated SDK packages, command-line interfaces, and dashboard management tools.
022. Controller vs. Processor Roles
Under global data protection regulations (including Regulation (EU) 2016/679 “GDPR” and the California Consumer Privacy Act “CCPA”):
033. Request Payloads & Ephemeral Streaming
Our routing gateway is engineered with a strict Zero-Buffer, Ephemeral Streaming Architecture:
- In-Memory Decryption: When your client transmits an HTTP POST request to
/v1/chat/completions, the TLS connection terminates inside secure memory. - Endpoint Resolution & Wallet Verification: The gateway inspects the model header, validates your SHA-256 hashed API key, and confirms available balance in the cryptographic credit ledger.
- Server-Sent Events (SSE) Pipe: Response chunks generated by the upstream provider are piped byte-for-byte in real-time directly to your client connection.
- Memory Purge: Once the HTTP stream terminates or the socket closes, raw prompt text and completion tokens are immediately evicted from working memory. No prompt text is written to persistent disk.
044. Telemetry, Logs & Billing Metering
To maintain gateway uptime, detect distributed denial-of-service (DDoS) attempts, and generate audited usage billing, we collect non-payload metadata:
| Data Category | Sample Fields | Purpose & Retention |
|---|---|---|
| Request Telemetry | model, provider, latency_ms, ttft_ms, status_code | Performance routing optimization (30 days) |
| Token Metering | prompt_tokens, completion_tokens, total_cost_usd | Audited billing ledger & customer invoice history (7 years) |
| Network Security & Fraud Prevention | origin_ip, user_agent, rate_limit_bucket | Abuse prevention, rate-limiting, and forensic dispute resolution. In the event of a fraudulent chargeback, this telemetry is securely transmitted to our payment processor (Stripe) and the issuing bank as evidence (7 years for disputed transactions, 7 days otherwise). |
055. Upstream Foundation Model Providers & Subprocessors
To fulfill inference requests, Nicrron transmits encrypted payloads to designated upstream foundation model providers based on your routing configuration:
Other infrastructure subprocessors: Stripe Inc. (Payment Processing), Supabase Inc. / Neon Inc. (Transactional Ledger Storage), and Cloudflare Inc. (DDoS Shield & Edge Routing).
066. No AI Model Training Guarantee
Nicrron operates under enterprise API terms with all upstream model vendors. Neither Nicrron nor our upstream foundation providers utilize your prompt inputs, customer embeddings, or model completions to train, retrain, or improve machine learning weights or public LLM architectures.
077. Technical & Organizational Security Measures
- API Key Cryptography: All generated API secret keys (
sk-af-...) are hashed immediately upon generation using one-way SHA-256 hashes. Nicrron staff cannot retrieve your plaintext key once displayed. - Transport Security: Strict HTTPS / TLS 1.3 enforcement with HSTS (HTTP Strict Transport Security) enabled.
- Isolation: Gateway routing pods execute in isolated micro-containers with zero shared cross-tenant memory buffers.
088. International Data Transfers
When data originates within the European Economic Area (EEA), United Kingdom, or Switzerland and is transferred internationally, Nicrron implements Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring equivalent levels of data protection.
099. Data Retention & Destruction Schedules
We retain account identifiers and financial transaction ledgers for the minimum duration required to satisfy statutory financial record-keeping obligations. If you close your organization workspace, all API keys, team memberships, and associated metadata are purged within 30 days.
1010. User & Data Subject Rights (GDPR / CCPA)
Depending on your jurisdiction, you maintain legal rights regarding your personal data:
1111. Children's Privacy Protection
Nicrron is an enterprise B2B developer tool and is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors.
1212. Amendments & Contact Information
We may periodically revise this Privacy Policy to reflect infrastructure improvements or legal requirements. Material updates will be communicated via your registered account email or dashboard notifications.