Privacy policy

For any question about this policy or to exercise your rights: contact@aittow.com.

Two distinct flows coexist: on one side the data of your account and your use of the dashboard, on the other the traffic you route through the proxy.

For the former, we are the data controller. For the latter, you are the controller of any personal data contained in your requests and we act as processor: we process it on your behalf and on your instructions, which take the form of your API key settings.

The data below is what the service processes. We carry out no profiling and no automated decision-making producing legal effects concerning you.

The content of requests and responses — messages, system prompt, tool definitions — is not recorded in our databases. Usage logs contain metadata only: timestamp, model, token counts, estimated cost, latency, cache indicators.

That content transits through our servers for the time needed to optimize it and forward it to the provider you have designated.

When optimizations are active, part of that content is temporarily held in cache memory, partitioned per account: the compressed system prompt for 7 days, and the last question asked together with its response for 1 hour. These entries expire automatically.

Some optimizations involve a call to a model operated by TokenHawk on its own account — system prompt compression, history summarisation, embedding computation. A fraction of your content is then sent to that model's provider (OpenAI or Amazon Bedrock, depending on the platform configuration), which is distinct from the one you designated for your own calls.

If you enable AI guardrails on a key (prompt attacks, harmful content, denied topics), the latest message of every request made with that key — and any tool results accompanying it — is analysed by Amazon Bedrock Guardrails, in the European Union. That service returns a verdict; it does not retain the content or use it to train a model. Only the verdict is logged, never the analysed content.

Your content is never used to train a model, nor passed to a third party for commercial purposes.

Your data is accessible to the following recipients only:

• —the model provider you designate (OpenAI, Anthropic, Google, Mistral…), called with your own keys — the processing it performs falls under the contract between you and it;
• —the provider of the model the platform uses for optimizations (OpenAI or Amazon Bedrock), for the single fraction of content described above;
• —Amazon Web Services (Amazon Bedrock Guardrails), for the security analysis of request content on keys where you enabled AI guardrails;
• —Stripe, for signing up, payment and invoicing of the paid tiers;
• —Google, for dashboard authentication and, subject to your consent, audience measurement (Google Analytics);
• —Axeptio, our consent management provider, which records and keeps the choices you make;
• —Amazon Web Services, our infrastructure host, within the European Union;
• —our mail relay, for technical alerts and messages sent from the feedback form.

No data is sold, rented, or passed on for advertising purposes.

The service's infrastructure — application servers, database and caches — is hosted within the European Union, with Amazon Web Services. Your account data, your keys and your usage logs do not leave the European Union as a result of our hosting.

Transfers nonetheless remain, arising from providers established outside the Union: the provider of the model used by the platform for optimizations, and Google, for dashboard authentication and audience measurement. They rely on the mechanisms provided for in Chapter V of the GDPR — the European Commission's standard contractual clauses, or the EU–US Data Privacy Framework where the provider is certified under it (which is the case for Google).

You choose your model provider and, consequently, the location of the processing it performs. Designating a provider established outside the European Union entails a transfer for which you are responsible.

You may obtain a copy of the safeguards governing these transfers by writing to contact@aittow.com.

The periods applied are set out in the table above.

On deletion of your account, your API keys and provider keys are deleted, and the associated logs are deleted or anonymised within 30 days, subject to retention periods imposed by law.

The following measures are in place:

• —API keys are never stored in clear text — only their SHA-256 digest is kept;
• —provider keys are encrypted at rest with AES-256-GCM;
• —traffic is encrypted in transit (TLS 1.3);
• —the application infrastructure, the database and the caches are hosted within the European Union;
• —each key can be restricted by IP allowlist, allowed model list, active time window and emergency stop;
• —dashboard sessions are revocable: logging out invalidates the token server-side;
• —blocked access attempts are logged and can be reviewed from the "Security" page;
• —each account is partitioned, including inside the optimization caches.

Two categories of items may be stored on your device: those strictly necessary for the service to operate, and an audience-measurement tool subject to your consent (described in the next section). The service uses no advertising cookie.

The following items are strictly necessary and setting them does not require your prior consent:

• —tokenhawk_session — session cookie set when signing in through the API, not accessible to JavaScript;
• —oauth_state and oauth_next — temporary cookies of the Google sign-in flow, used to verify its integrity;
• —tokenhawk_token — session token, in the browser's local storage;
• —tokenhawk_theme, tokenhawk_currency, tokenhawk_demo_intro_dismissed — your display preferences, in local storage; they never leave your browser;
• —axeptio_cookies, axeptio_authorized_vendors and a related local-storage entry — record your consent choices so you are not asked again on every visit; set by Axeptio, our consent management platform.

Setting the strictly necessary items does not require your consent. Logging out clears the session token and invalidates it.

We use Google Analytics 4, an audience-measurement tool provided by Google Ireland Limited, to understand how the site and the dashboard are used: pages viewed, navigation paths, device and browser type, and approximate location inferred from the IP address. This data is used only to produce aggregated statistics; it is not used for advertising and is never cross-referenced with the content of your requests.

This tool sets cookies (_ga and _ga_*, lasting at most thirteen months) and is activated only after your consent. It is deployed by means of Google Tag Manager, a tag-management tool that sets no cookie of its own. On your first visit, a banner managed by Axeptio, our consent management platform, lets you accept or refuse it, purpose by purpose. Until you have accepted, no audience-measurement cookie is set and no data that could identify you is sent to Google: Google Consent Mode v2 is configured to deny this processing by default. Anonymised signals, with no cookie or identifier, may be sent to Google for statistical modelling.

The legal basis for this processing is your consent (Article 6(1)(a) GDPR). You may withdraw it at any time, with the same effect as a refusal and with no impact on access to the service or its features, by reopening the Axeptio consent management panel available from the site footer. Withdrawal takes effect for the future only.

Axeptio, a provider established in the European Union, records and keeps proof of your choices for as long as needed to demonstrate them, then shows you the banner again. Google keeps the audience-measurement data attached to your device according to the retention settings applied, up to a maximum of fourteen months.

You have rights of access, rectification, erasure, restriction, objection and portability over your data, the right to withdraw your consent at any time where processing is based on it, as well as the right to give directions as to its fate after your death.

These rights are exercised at contact@aittow.com. We respond within one month.

You may lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.

For personal data contained in the traffic you send us, requests from your own users must be addressed to you; we assist you in answering them.

You remain responsible for the personal data you route through the service and for the legal basis of its processing.

The service provides guardrails — detection of email addresses, phone numbers, card numbers, IBANs and IP addresses, with masking or blocking — enabled per key. They rely on regular expressions and are not exhaustive detection: enabling them does not discharge you of your obligations.

A data processing agreement (DPA) can be entered into on request at contact@aittow.com.

This policy may be updated. The applicable version is the one published on this page; its last update date appears at the top.