Privacy Policy

Who we are

CenovaGate operates the service available at cenovagate.com. When your organisation uses CenovaGate, your organisation is the controller of the request data it sends, and CenovaGate acts as the processor of that data on its behalf.

Information we collect

• Account information. Your name, email address and profile picture, taken from the sign-in method you choose (email and password, or Google sign-in). If you sign in with Google we receive only your basic profile and email address; we never receive your Google password and we do not access Gmail, Drive or any other Google service.
• Organisation information. Workspace name, membership, roles, application and environment names, routing rules and settings you configure.
• AI request information. Metadata about each request routed through the gateway: timestamp, application, environment, model, token counts, latency, cost, caching and routing outcomes. Whether prompt and response content is stored depends on the privacy mode your administrators select (full content, redacted, or metadata only).
• Billing information. Subscription plan and payment status. Card details are handled by our payment provider; CenovaGate never sees or stores full card numbers.
• Technical information. Log and security data such as IP address, browser type and error reports, used to keep the service secure and reliable.

How we use information

• To provide, secure and operate the gateway and the workspace console.
• To authenticate users and enforce organisation roles and permissions.
• To calculate usage, cost, savings and optimisation recommendations.
• To provide support, detect abuse and troubleshoot faults.
• To process subscriptions and billing.

We do not sell personal data, and we do not use your prompts or responses to train our own models or any third-party model.

Providers and sub-processors

To fulfil a request, CenovaGate forwards it to the AI provider your organisation has configured (for example OpenAI, Anthropic or Google). Those providers process the request under their own terms. We also use infrastructure, database, email and payment providers that process data strictly on our instructions under contractual confidentiality and security obligations.

Security

Provider credentials and API keys are encrypted at rest and are never displayed again after creation. Access to organisation data is restricted by row-level security so that members can only see data belonging to their own organisation. Administrative and privilege changes are recorded in an append-only audit log.

Data retention

Organisation administrators choose how long request records are kept and whether content is stored at all. Records are purged automatically once the retention period expires. Account and billing records are kept for as long as the account is active and afterwards only where required by law.

Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. You can exercise these rights, including deleting your account and its data, by contacting us at privacy@cenovagate.com. You can also revoke CenovaGate's access to your Google account at any time in your Google account security settings.

International transfers

Data may be processed in countries other than your own. Where data leaves the European Economic Area we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

Children

CenovaGate is a business service and is not directed to anyone under 16.

Changes to this policy

We will update this page when our practices change and revise the date above. Material changes will be communicated to account owners.