Privacy policy
Effective and last updated: November 7, 2026
This policy explains how INFO INLET Co., Ltd. ("InfoInlet", "we", "us", "our") collects, uses, keeps and protects personal data when you use AI Cloud Gateway (the "Service"). The Service includes the website aicloudgateway.com, the dashboard at dashboard.aicloudgateway.com and the API at api.aicloudgateway.com.
AI Cloud Gateway is a business service. You buy it through AWS Marketplace on behalf of an organisation, and it is not meant for personal or household use.
Summary
- We never store your prompts or the model's answers. Requests pass through our router in memory, and the model runs in your own AWS account.
- We keep what we need to run and bill the Service: your account, subscription, usage counts, API key hashes and your AWS connection settings.
- We don't sell personal data, share it for advertising, or use it to train models.
- The website uses no cookies, analytics or advertising trackers.
Who we are
The Service is operated by INFO INLET Co., Ltd. (INFO INLET株式会社), a company incorporated in Japan (corporate number 3013301044430):
- Address: Wizard Building 402, 1-4-3 Sengencho, Nishi-ku, Yokohama, Kanagawa 220-0072, Japan
- Phone: +81 45-550-5370
InfoInlet is the controller (under Japan's Act on the Protection of Personal Information, the "business operator handling personal information") of the personal data described in this policy, except for the content of your API requests (see "Your requests and prompts" below). For any privacy question or request, email contact@aicloudgateway.com.
This policy covers AI Cloud Gateway only. InfoInlet's other products and its own website are covered by the InfoInlet privacy policy. Where the two differ, this policy governs for the Service.
What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, and optionally your name and company. Your password is held by our sign-in provider (Amazon Cognito); we never see or store it. | You, when you sign up |
| Marketplace | Your AWS customer identifier, AWS account ID, product, plan, subscription status, license ID and included-request usage | AWS Marketplace, when you subscribe or change plans |
| AWS connection | The IAM role ARN you create (it contains your AWS account ID), the External ID we generate, your region, which models are enabled and, if you set one, your Bedrock Guardrail ID and version | You, in the dashboard |
| API keys | A one-way hash of each key, its short prefix, name, creation and last-used times, revocation time and any budget you set. We show the full key once and never store it. | Created by you |
| Usage | Request and token counts per subscription, per model, per hour. Month-to-date request, token and estimated-spend counters per subscription and per API key, used to enforce budgets. | Generated when you use the API |
| Routing records | For each API request: a request ID, your subscription ID, the model chosen, models tried, token counts, and the routing signals behind the choice (task type, difficulty and similar numbers and flags) | Generated when you use the API |
| Technical logs | For calls to our dashboard API: request ID, IP address, method, path, status code and response time | Generated when you use the dashboard |
| Support | What you send through the contact form or by email to contact@aicloudgateway.com: name, email, company, topic, subject, message and, for email, any attachments | You |
| Contact-form protection | A truncated one-way hash of your IP address, used to limit how many messages one address can send in an hour | Generated when you send the contact form |
We don't knowingly collect special categories of personal data, and we ask you not to send them to us through support channels.
Your requests and prompts
When you call the API, the request (including your prompts, images and tool definitions) passes through our router in AWS us-east-1. The router reads it in memory to choose a model, then sends it to Amazon Bedrock in your AWS account and region, using the IAM role you created. The model's answer returns the same way.
- We do not store or log prompt text, images, tool results or completions.
- We do not use them to train or improve any model.
- When you set a Bedrock Guardrail, we don't request its trace, so matched text is neither returned to us nor stored.
- Bedrock processes your requests under your own agreement with AWS, in your account.
For the content of your requests, you (or your organisation) are the controller and we act as your processor or service provider. We handle that content only to route and deliver it.
How we use personal data, and why
| Purpose | Data used | Legal basis (where GDPR or UK GDPR applies) |
|---|---|---|
| Run the Service: sign-in, routing, budgets, guardrails, the dashboard | Account, connection, API keys, usage | Performance of our contract with you |
| Bill through AWS Marketplace and keep billing records | Marketplace, usage | Contract; legal obligation to keep financial records |
| Answer support requests | Support | Contract; our legitimate interest in helping our customers |
| Keep the Service secure, prevent abuse and fix problems | Technical logs, routing records, rate limit | Legitimate interest in a secure, reliable service |
| Send service emails: sign-up codes, account recovery, replies to your tickets | Account, support | Contract |
| Meet legal obligations and respond to lawful requests | Any, as needed | Legal obligation |
We don't send marketing email, and we make no automated decisions with legal or similarly significant effects. Model routing picks a model for a request; it doesn't evaluate people.
Who we share it with
We don't sell personal data or share it for cross-context behavioural advertising. We share it only with:
- Amazon Web Services, which hosts the Service in the United States (us-east-1). We use Lambda, API Gateway, DynamoDB, Cognito, SES, S3, SQS, CloudFront and CloudWatch. AWS acts as our processor under the AWS Data Processing Addendum.
- AWS Marketplace, which handles your purchase and billing and sends us the subscription details listed above.
- Our business email provider, which receives a notice of each new support ticket for our staff, with your name, email, company, subject and a short preview.
- Authorities or other parties when the law requires it, or to protect our rights, our users or the public.
- A successor, if InfoInlet is involved in a merger, acquisition or sale of assets. This policy would continue to apply to your data.
How long we keep it
| Data | How long |
|---|---|
| Prompts, images, completions | Not kept. Processed in memory only. |
| Account, subscription, AWS connection, API key hashes | While your account exists. After you cancel, we keep them as billing records until you ask us to delete them. |
| Hourly usage counts | While your account exists, and as billing records after you cancel, unless you ask us to delete them |
| Budget counters | Deleted automatically 40 days after the end of each month |
| Routing records and technical logs | 365 days, then deleted automatically |
| Support tickets | Until the matter is closed and you ask us to delete them, or we delete them |
| Raw emails sent to contact@aicloudgateway.com | 90 days, then deleted automatically. The ticket text is kept as described above. |
| Contact-form IP hash | 3 hours |
| Database backups | Our databases keep point-in-time backups for up to 35 days |
When you cancel, we stop routing, revoke your API keys and send a final usage report to AWS Marketplace. To have your remaining data deleted, email us. We'll delete it within 30 days, except what we must keep for tax, accounting or legal reasons, and we'll tell you what we kept.
Security
- Encryption: data is encrypted in transit (TLS 1.2 or later) and at rest (AWS-managed encryption for databases, storage and queues).
- API keys: stored only as one-way hashes.
- Access to your AWS account: we reach it only through the role you create. That role can only invoke and list Bedrock models and apply your guardrails, and it can only be assumed with an External ID unique to your subscription. We receive short-lived credentials, never long-term keys. You can delete the role at any time.
- Least privilege: each part of the Service has only the permissions it needs, and staff and customers sign in through separate identity pools.
No system is perfectly secure. If a breach affects your personal data, we'll notify you and the relevant authorities as the law requires.
Where it's processed
InfoInlet is based in Japan, and the Service runs on AWS in the United States, so we process personal data in the United States and our staff may access it from Japan.
- Under Japan's APPI: we provide personal data to AWS in the United States, a foreign country. AWS handles it under the AWS Data Processing Addendum, which binds it to measures equivalent to those the APPI requires, and we check that these measures stay in place. The United States has no single federal privacy law; state laws such as the CCPA apply in some states. On request, we'll give you more detail about these measures.
- If you are in the European Economic Area, the United Kingdom or Switzerland: your data is transferred to the United States under the safeguards in the AWS Data Processing Addendum, which include the European Commission's Standard Contractual Clauses. Japan has an adequacy decision from the European Commission.
Bedrock inference itself runs in the AWS region you choose in your own account (us-east-1, us-east-2 or us-west-2). Requests still pass through our router in us-east-1 on the way.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and get a copy in a portable format
- correct inaccurate data
- delete your data
- object to, or ask us to restrict, how we use it
- withdraw consent, where we rely on consent
- not be discriminated against for using these rights
Under Japan's APPI, you can ask us to disclose, correct, add to, delete, or stop using or providing the personal data we hold about you, and to disclose records of its provision to third parties. California residents have the rights above under the CCPA, as amended by the CPRA. We don't sell or "share" personal information as those laws define it, and we use sensitive personal information only to provide the Service.
To make a request, email contact@aicloudgateway.com from the address on your account, or tell us how to verify that the account is yours. We'll answer within 30 days (45 days where the CCPA applies), and tell you if we need more time. You can also complain to your local data protection authority. We'd appreciate the chance to resolve your concern first.
If your organisation bought the Service and you are one of its users, some requests are best made to your organisation, which controls its account.
Website and browser storage
aicloudgateway.com sets no cookies and loads no analytics or advertising scripts. Its fonts are served from our own domain. The dashboard keeps your sign-in session in your browser's local storage, and the AWS Marketplace sign-up step briefly keeps a one-time token in session storage. Both are needed for the Service to work and are not used for tracking. Signing out clears your session.
Children
The Service is for businesses. It is not directed to anyone under 18, and we don't knowingly collect data from children.
Changes to this policy
We'll post any change here and update the date at the top. If a change materially affects how we use your personal data, we'll email account holders before it takes effect.
Contact
Email contact@aicloudgateway.com or use the contact form with the topic "Other". By post: INFO INLET Co., Ltd., Wizard Building 402, 1-4-3 Sengencho, Nishi-ku, Yokohama, Kanagawa 220-0072, Japan.