01What this covers
This policy explains what Vinspe.ai Private Limited ("Vinspe", "we", "us") does with data — on this website, in the dashboard, and in the gateway that your AI requests pass through.
The gateway is the part worth reading carefully, because that is where your own users’ data can reach us. It has its own sections below.
Where you use Vinspe as a company, your organisation decides what traffic to send us and is the controller of the personal data inside it. We process it on your instructions, which are the configuration you set.
02Information you give us
When you create an account we ask for your name, your work email address, your company name, and a password. We ask for a work address because accounts belong to organisations rather than individuals.
When you book a call we ask for your name, your email address, what you would like to discuss, and a preferred date and time. Your browser’s timezone is read locally so the slots shown make sense to you.
If you become a paying customer we hold billing details and the invoices raised against your account. Card details are handled by our payment processor and are not stored on our systems.
If you email us, we keep the correspondence so we can pick up where the last conversation left off.
03What passes through the gateway
To route a request and to check it against the cache, Vinspe has to process its content — the prompt you send and the response that comes back. There is no version of the product that optimises a request it cannot read.
We process that content for one purpose: serving and optimising the traffic you send us. Specifically, to authenticate the request, apply your limits and model policy, look for an eligible cache match, forward what remains to a provider you approved, and record the result in your ledger.
We do not use the content of your requests or responses to train models, and we do not sell it, share it for advertising, or make it available to other customers.
You decide how much of this ever reaches us. Route all your AI traffic through Vinspe or only the workloads you choose — the boundary is yours to draw, and we only ever see what crosses it.
04The usage ledger
Every request that passes through Vinspe produces a record you can inspect. That ledger holds what the request would have cost, what it actually cost, which model answered it, which optimization changed it, token counts, and timing.
We generate it for two reasons: it is the visibility the product exists to give you, and it is what your savings-share fee is calculated from. There is no separate accounting you cannot see.
Ledger entries describe a request rather than reproducing it. They are held for as long as your account is open, so that historical spend stays comparable.
05The semantic cache
Semantic caching works by recognising when a new request is meaningfully similar to one already answered, and reusing the existing response instead of paying for another model call. That requires storing responses and a representation of the requests they answer.
Cached responses are scoped to your account and reused only for your traffic. One customer’s cache is never consulted to answer another customer’s request.
You control what is cacheable. Workloads you pin to a specific model, or exclude from caching in your policy, are not served from cache.
06Provider credentials
Vinspe works on a bring-your-own-keys basis, so we hold the provider credentials you choose to add. They stay yours: you decide which ones we may use, and which providers we may reach at all.
Credentials are stored encrypted and used only to make the requests you route to us. Remove one, or narrow your provider allowlist, and we stop using it.
07This website
This site sets no cookies, stores nothing in your browser, and loads no analytics, advertising, or session-recording scripts.
The dashboard is different: once you sign in, we set a strictly-necessary session cookie to keep you logged in. It is not used for tracking or advertising, it is not shared with any third party, and it is removed when you sign out. Because it is strictly necessary for the service you asked for, no consent banner is required or shown for it — there is nothing else on the site to consent to.
Our hosting provider keeps standard server logs — IP address, timestamp, requested URL, user agent — which exist to serve the page and to spot abuse. We do not build profiles from them.
If we ever add analytics or a non-essential cookie, this section changes before it ships.
08Why we process any of it
We use what we hold to:
- run the gateway — authenticate, route, cache, and forward your requests;
- produce your ledger and calculate the savings share you are billed;
- operate your account, including access control, limits, and spending controls;
- answer your questions and provide support;
- keep the service secure and investigate abuse;
- meet legal, tax, and accounting obligations.
Where the law asks us to name a basis: processing your account and traffic is necessary to perform our contract with you; security, abuse prevention, and improving the service rest on our legitimate interests; billing records are kept to meet a legal obligation.
We do not use your data for automated decision-making that produces legal effects for anyone.
09Who else sees it
We share data in four situations, and no others:
- AI providers you have enabled. Requests we cannot answer from cache go to a provider on your allowlist, using your credentials. What that provider then does is governed by its own terms and privacy policy — a relationship that stays yours.
- Anthropic, for the Playground. The dashboard’s Playground feature sends the prompt you type to Anthropic under our own account, not your provider credentials, so you can test a model before routing real traffic to it. This is separate from the AI providers you have enabled for the gateway itself.
- Supabase and Resend, for infrastructure. Supabase hosts our database and handles account authentication; Resend delivers transactional email such as booking confirmations. Both act on our instructions under written terms. We keep a current list and will share it on request.
- A payment processor, once billing goes live. Card payments will be handled by a payment processor acting on our instructions. Card details will not be stored on our systems.
- Where the law requires it. A valid legal order, or where disclosure is needed to establish or defend a legal claim. We will tell you unless we are prohibited from doing so.
- If the business changes hands. In a merger or acquisition, data may transfer to the acquirer under this same policy. You would be told before anything about your data changed.
We do not sell personal data, and we do not share it for advertising.
10Where data goes
Our infrastructure and the providers you route to may be located in countries other than your own. Where personal data moves across a border, we rely on the safeguards the law provides for such transfers and require the same standard of protection from the vendors involved.
You have a direct lever here: your provider allowlist and model policy decide which providers, and therefore which regions, your traffic can reach.
11How long we keep things
The principle is that data lives as long as the purpose it was collected for, and no longer:
- Account details for as long as your account is open.
- Ledger entries for as long as your account is open, so historical spend stays comparable.
- Cached responses until they expire under your cache policy, or you clear them.
- Provider credentials until you remove them, or the account closes.
- Billing and invoice records for as long as tax and accounting law requires, which outlasts the account itself.
When your account closes we make your ledger history available for export for 30 days, then delete or anonymise what we are not required to keep.
12How we protect it
We describe the controls we have built rather than the badges we could display. If something is not listed here, assume we have not claimed it.
- Every request to the gateway is authenticated against the key that sent it.
- Vinspe API keys are scoped, so you can issue separate keys per application, service, or environment and revoke one without touching the rest.
- Provider credentials are stored encrypted, and data is encrypted in transit.
- Access controls determine who on your team can reach Vinspe and change how it is configured.
- Usage limits and spending controls cap what a compromised or runaway key can do before it reaches a provider.
No system is perfectly secure. If a breach affects your data we will tell you and the relevant regulator within the time the law allows, with what we know and what we are doing about it.
13Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, to receive a portable copy, and to complain to your data protection regulator.
Write to support@vinspe.ai to exercise any of these and we will respond within the time the law allows. We will ask enough to confirm who you are, and nothing more.
If you are an end user of a company that routes its traffic through Vinspe, that company decides what happens to your data. Ask them first — and if they ask us to act, we will.
14Children
Vinspe is a product sold to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, tell us and we will remove it.
15Changes to this policy
We will update this page as the product changes. The "last updated" date at the top always reflects the current version.
If a change materially affects how we handle your data, we will tell you by email or in the dashboard before it takes effect rather than quietly editing this page.
16How to reach us
Write to support@vinspe.ai. A person answers.
If you would rather talk it through than write, book a call and we will go through whatever you need.