Privacy Policy

1. Account Information

When you create an account with OneRouter, we collect:

• Email address and name (via Clerk authentication)
• Profile information you voluntarily provide
• Account preferences and settings
• Authentication tokens and session data

2. Payment Gateway Credentials

We store your payment gateway API credentials securely:

• API keys and secrets (encrypted at rest using AES-256)
• Provider-specific configuration data (Razorpay, PayPal, Stripe)
• Environment settings (test/live)

3. Transaction Data

We collect and process:

• Payment transactions initiated through our platform
• API request/response logs for debugging
• Usage analytics and statistics
• Error logs for troubleshooting
• Webhook events from payment providers

4. Device and Usage Information

• IP address for security and rate limiting
• Browser type and version for compatibility
• Operating system information
• Timestamps and session identifiers

Service Delivery

We use your information to:

• Process and route payment transactions to payment gateways
• Authenticate your API requests
• Provide usage analytics and dashboards
• Send transaction status updates via webhooks
• Manage your payment gateway credentials
• Provide customer support

Security & Fraud Prevention

Your data is used to:

• Enforce rate limits to prevent abuse
• Detect and block suspicious API activity
• Verify webhook signatures for authenticity
• Implement CSRF protection for web requests
• Monitor for unauthorized access attempts

Analytics & Improvement

We use aggregated data to:

• Improve API performance and reliability
• Identify and fix bugs
• Develop new features
• Optimize user experience
• Analyze usage patterns for capacity planning

Payment Gateway Providers

We share necessary transaction data with your chosen payment gateway providers (Razorpay, PayPal, Stripe) to process payments. This includes:

• Payment amounts and currency
• Customer information (required by providers)
• Transaction metadata for order tracking

What We Don't Share

• We never sell your personal data to third parties
• We don't share your data with advertisers
• We don't use your payment gateway credentials for any purpose other than processing your requests
• We don't provide your credentials to anyone, including law enforcement, without proper legal process

Data Transfers

If we transfer your business or assets to another entity:

• You will be notified in advance
• Your personal data will only be transferred with your consent
• The transferee will be bound by this privacy policy

Encryption

All sensitive data is protected:

• Payment Gateway Credentials: AES-256-GCM encryption at rest
• API Keys: SHA-256 hashing for storage
• Data in Transit: HTTPS/TLS 1.3 encryption
• Database: Encrypted PostgreSQL with access controls

Access Controls

We implement strict access controls:

• Authentication via Clerk (OAuth 2.0 / JWT)
• Role-based access control for admin functions
• API key-based authentication with rate limiting
• Session management with secure tokens
• IP-based rate limiting and monitoring

Infrastructure Security

• Secure hosting with DDoS protection
• Regular security audits and penetration testing
• Web application firewall (WAF)
• Real-time threat monitoring
• Automatic security updates

Access & Control

• Access Your Data: You can request a copy of all personal data we have about you
• Data Portability: Export your data in a machine-readable format
• Delete Your Data: Request deletion of your account and all associated data
• Opt-Out: Disable data collection for analytics (may affect some features)

Notification Rights

You will be notified if:

• There is a data breach or security incident
• Your credentials are accessed without authorization
• We change how we handle your data
• We receive legal request to disclose your information

Consent Withdrawal

You can withdraw your consent at any time by:

• Deleting your account
• Revoking API key access
• Removing payment gateway credentials
• Contacting our support team

Note: Withdrawal of consent may result in inability to use some features of our service.

Retention Periods

• Transaction Logs: Retained for 90 days for analytics
• Error Logs: Retained for 30 days for debugging
• Account Data: Retained until account deletion
• API Keys: Retained until revocation or account closure

Deletion

When you delete your account:

• All personal information is permanently deleted
• API keys are revoked immediately
• Payment gateway credentials are deleted from our systems
• Some data may be retained for legal compliance purposes

Legal Requirements

We may retain data longer than specified if required by:

• Law or legal obligations
• Dispute resolution
• Fraud investigation
• Financial record-keeping requirements