Privacy Policy
Effective Date: October 14, 2026 • Last Updated: October 31, 2026 • Operator: SentioGate Team / sentiogate.app
1. Summary
- Bring your own key. Once your Vault holds a provider key, requests are sent only with your own keys; the service never falls back to platform-owned provider keys for your account.
- Community pool (beta) is the exception. Accounts with no Vault keys can use a free, rate-limited community pool from the dashboard and the API. Those requests are sent to Agnes AI with a platform-provided key, and Agnes AI's terms let it use inputs and outputs to improve its service (see Third parties). Do not send personal or confidential data through the pool.
- No markup, no training, no selling. We do not mark up provider prices, do not train models on your data, and do not sell your prompts or completions. We share them only with the provider that serves the request.
- Prompts are not logged. The only prompt-derived data we store is the short-lived response cache (1 hour, on by default, with an opt-out), and community requests you choose to queue (up to 3 days), described below. If you turn on the Langfuse export with prompts and answers included, they are sent to your own Langfuse project, not stored by us.
2. Where data is processed
SentioGate runs on Cloudflare Workers (Cloudflare's global edge network) and stores data in Cloudflare D1 (and Vectorize when it is enabled). Cloudflare encrypts this storage at rest. A request is processed in the Cloudflare location that serves it, then sent over TLS to the provider you chose, under your own agreement with that provider (for example OpenAI, Groq, DeepSeek, Mistral, xAI, OpenRouter, or a custom endpoint you add). Community pool requests go to Agnes AI under SentioGate's agreement with Agnes AI. Your data may therefore be processed in countries other than the one you live in, including the United States and, for community pool requests, Singapore (Agnes AI states it processes data in Singapore, the United States and other countries). No data residency guarantee is provided.
3. What we store and for how long
| Data | What | Where & how | Retention | Your control |
|---|---|---|---|---|
| Prompts & completions (routing) | Your request, held in memory while it is forwarded to the provider you chose (or auto picked) with your key | Worker memory only; not logged | Single request | — |
| Community pool requests (beta) | Prompts and completions of requests served by the free community pool (accounts with no Vault keys) | Held in Worker memory and sent to Agnes AI with a platform-provided key; not logged by SentioGate. Agnes AI may retain them and use inputs and outputs to improve its service unless an opt-out applies (see Third parties) | SentioGate: single request. Agnes AI: under its own terms | Used only while your Vault has no provider keys; add a key to switch to BYOK |
| Community batch queue | Community requests you choose to queue: the chat payload (messages and generation settings), status, and the answer | Cloudflare Queues and D1, readable only by your account (poll by job id) | 3 days after the last update, whatever the status, then deleted by the daily cleanup | Only when you queue (batch endpoint, X-SentioGate-Allow-Queue, Prefer: respond-async, or the Vault setting) |
| Community pool counters | Per account: number of community requests per hour | Cloudflare D1 | 24 hours | Used for the 5-hour allowance |
| Provider API keys (Vault) | Your BYOK keys | Cloudflare D1, encrypted at rest (key derived from a server-side secret, random salt per key); decrypted only in memory to call the provider; shown back masked | Until you delete them | Delete in the Vault at any time |
| Response cache (exact + semantic) | A SHA-256 key of your user ID, parameters and messages; the response body; for semantic matching, an embedding of the conversation | Cloudflare D1 / Vectorize, isolated per user | 1 hour (10 minutes for unset-temperature factual requests), then deleted by the daily cleanup | On for non-streaming requests without tools when temperature ≤ 0.3, or when temperature is unset and the prompt is a single-turn factual question (math, multiple choice, short factual Q&A, classification; never creative prompts), or when you opt in (X-SentioGate-Cache: force or "cache": true). Opt out per request with header X-SentioGate-Cache: off or "cache": false; flush your cache from the dashboard or API |
| Prompt-cache session routing | A SHA-256 hash of the session id you send (X-Session-ID / session_id / prompt_cache_key), the model that served the last turn, and its prompt token count | Cloudflare D1, isolated per user | Ignored after 10 minutes; deleted by the daily cleanup within a day | Only stored when you send a session id; the session id is also forwarded to OpenRouter for its provider sticky routing |
| Embeddings for the semantic cache | The conversation text, sent to an embedding model | Cloudflare Workers AI when it is bound; otherwise OpenAI text-embedding-3-small using your own OpenAI vault key (subject to OpenAI's terms); no semantic layer if neither is available | Vector kept with the cache entry (1 hour) | Disabled together with the cache opt-out |
| Quality grading (when enabled) | Aggregate counts per model and task type: number of answers graded and number judged correct. No prompt or answer text, user ID or request ID | Cloudflare D1, aggregated across accounts | Until the model leaves the routing pool | Off unless quality grading is turned on. When on, a small sample (about 2%, at most one per minute per account) of auto-routed, non-streaming requests without tools that have a checkable answer (math, code, multiple choice, short factual Q&A, classification, reasoning; never open-ended or creative prompts) is sent once more, prompt and answer, to your own provider on your own key, using your cheapest other enabled model, which returns only a correct/incorrect verdict. The provider bills you for that call. Only the aggregate counts are stored, no text |
| Context compression | Your messages, transformed in memory: duplicates and extra whitespace always removed (system prompts, code blocks and tool calls untouched); above ~16k tokens, older turns summarized by your cheapest capable model, using your key, billed to you by that provider | Not stored | — | Per request: compress: off (or lossless); header X-SentioGate-Compress: off |
| Discover uploads | Log files you upload for a savings analysis | Processed in memory; neither the file nor the report is stored | Single request | — |
| Usage counters | Per user, provider and model: request counts and spend (for caps, analytics and the dashboard) | Cloudflare D1 | Per-minute counters 2 hours; daily counters up to 400 days; provider-level daily ledger until account deletion | Deleted with your account |
| Request log | Per request: user ID, provider, model, status, latency, token counts, cost and which of your keys was used. No prompt or answer text | Cloudflare D1 | 14 days, then deleted by the daily cleanup | Deleted with your account |
| Usage analytics | Per request: a SHA-256 hash of your user ID, provider, model, status, latency, token counts and cost. No prompt or answer text, key or email | Cloudflare Workers Analytics Engine | Up to 3 months, per Cloudflare | Rolls off automatically |
| Edge logs | Per request: method, URL without the query string, request headers including your IP address (Cloudflare redacts Authorization and Cookie), status and timing. Request and response bodies are not logged | Cloudflare Workers Logs | 7 days, per Cloudflare | Rolls off automatically |
| Latency & error statistics | Per provider/model aggregates (sample counts, averaged latency/TTFT, success rate); not linked to a user | Cloudflare D1 | Used for 24 hours, deleted after 7 days | Shown publicly (homepage, /v1/benchmarks) as per-model aggregates |
| Account data | Email, name, password hash, workspace, SHA-256 hashes of your gateway keys, cache hit/miss counters | Cloudflare D1 | Until account deletion | Email security@sentiogate.app to delete your account |
| Launch waitlist ("Notify me") | Your email, the coming-soon plan you asked about (Pro or Team), when you signed up and, if you were signed in, your user ID. No IP address or other details | Our database, one entry per email and plan; used only to email you when that plan launches, never for marketing or shared | Until that plan launches and you have been told, or until you ask us to remove it | Email security@sentiogate.app to be removed from the list |
| Verification codes & reset tokens | One-time codes for sign-up / password reset | Cloudflare D1 | Expire after 10 minutes; deleted a day after expiry | — |
| Session handoffs & evaluations (retired) | Nothing new: the session handoff and evaluation APIs no longer store data | Cloudflare D1 (older rows only) | Older rows are deleted by the daily cleanup within 30 days | Delete via the API |
| Langfuse export (opt-in, off by default) | Your Langfuse host, public key and secret key (encrypted). When on, each chat request sends a trace to your own Langfuse project: model, provider, token usage, cost, latency, status and the session id you send. Prompts and answers are included only if you turn on “Include prompts and answers” | Settings in Cloudflare D1; traces go only to your Langfuse project and SentioGate keeps no copy | Settings until you remove them | Turn off or remove in the Vault |
| Backups | Database history | Cloudflare D1 point-in-time recovery (Time Travel) | Up to 30 days, per Cloudflare | Rolls off automatically |
Expired rows are removed by a daily cleanup job, so data can remain for up to a day after the retention period ends.
4. Third parties
- Model providers receive the requests you route to them, including summarization calls made by context compression (sent to your cheapest capable model, using your key, billed to you).
- OpenAI receives conversation text for embeddings when the semantic cache uses your OpenAI key (only when Cloudflare Workers AI is not available).
- Agnes AI (subprocessor for the community pool only) receives the prompts of community-pool requests and returns the answers. The pool uses an Agnes AI Token Plan. Agnes AI's Privacy Policy (last updated July 9, 2026) says content sent under Paid Token Plans is "not used to train or improve our AI models by default". Its Terms of Service (effective April 1, 2026) still say, in section 8.1, that "Agnes AI retains the right to use the Output to improve the Service (unless you have opted out of such use, where available)", and in section 8.2 that it may "use Client Data to improve the Service's AI models, algorithms, and functionality (including but not limited to training and fine-tuning the models), unless you have opted out". Treat pool requests as data Agnes AI may keep and use under those terms. Agnes AI retains data "for as long as necessary to provide the Service" (section 8.4) and may process it in Singapore, the United States and other countries. Requests on your own keys never go to Agnes AI unless you add an Agnes key yourself.
- Cloudflare (processor) hosts the service: Workers, D1, Queues, Vectorize, Workers AI, Analytics Engine and Workers Logs. Cloudflare Turnstile checks sign-up, sign-in, password-reset and anonymous Discover requests for bots; Cloudflare receives the challenge result and your IP address. Cloudflare Email Service delivers verification, password-reset and alert emails from no-reply@notify.sentiogate.app to your address.
5. Security
- Vault keys are encrypted at rest using a key derived from a server-side secret and a random salt per key. This is a single service-managed secret; there are no per-customer data keys and no external KMS.
- Gateway API keys are stored only as SHA-256 hashes; passwords as salted hashes.
- All traffic to sentiogate.app and to providers uses HTTPS (TLS).
6. Your rights
Depending on where you live (including India's Digital Personal Data Protection Act, the EU GDPR and the CCPA), you can ask to access, correct, export or delete your data. You can delete Vault keys and flush your cache yourself at any time. For account deletion or a data export, email security@sentiogate.app; we delete the account's rows from D1, and they roll out of Cloudflare's point-in-time backups within 30 days.
7. Contact
- Security & Privacy: security@sentiogate.app
- Customer Support: support@sentiogate.app
- Enterprise Inquiries: sales@sentiogate.app