This Privacy Policy explains how we collect, use, process, disclose, retain, and protect personal data when you access or use the SPRO website, router, APIs, applications, integrations, dashboards, and related services (collectively, the "Services").

SPRO is an AI Secure Gateway and Multi-Model Routing Platform that provides a controlled layer between applications, AI agents, developers, organizations, and AI model providers. Depending on the Services and configuration you use, SPRO may provide model routing, provider selection, security controls, AI guardrails, policy enforcement, request and response inspection, monitoring, usage analytics, cost and usage controls, and AI governance capabilities.

This Privacy Policy should be read together with our Terms of Use and any applicable Data Processing Agreement or other contractual terms.

By accessing or using SPRO Services, you expressly acknowledge that you have read, understood, and agree to be bound by the data collection, processing, and protection practices described in this Policy, and if you do not agree with any provision of this Policy, you must immediately discontinue use of the Services and terminate your account.

How We Handle Input and Output Data You Submit

When you or your applications, systems, agents, or integrations transmit, send, or submit prompts, instructions, files, messages, requests, and other input data to SPRO, we process that content as necessary to provide the Services, including routing requests to selected AI model providers, applying security controls and AI guardrails, enforcing configured policies, inspecting requests and responses, monitoring service behavior, and supporting the secure operation of the platform.

SPRO's AI guardrails are designed to operate as part of the request and response flow and may evaluate submitted content for configured security and policy conditions, including sensitive data exposure, personally identifiable information, protected information, credentials, API keys, prompt injection attempts, jailbreak attempts, malicious instructions, unsafe or prohibited content, policy violations, and other risks supported by the applicable SPRO configuration.

Depending on the configuration and Services you use, SPRO may inspect both the input submitted to an AI model and the output returned by that model before the response is delivered back to your application, agent, system, or user. These controls may be applied according to organization-level policies, application policies, user permissions, routing rules, security configurations, and other controls configured for your account.

SPRO processes input and output content within its infrastructure as necessary to perform routing, security analysis, policy enforcement, monitoring, and related Services. Where temporary processing or storage is required for operational purposes, such processing is subject to the retention periods and controls described in this Policy and any applicable contractual terms.

Your submitted content may be temporarily logged in encrypted form solely to support critical system functions including troubleshooting, debugging of security and routing behavior, investigation of security incidents, audit trail generation, anomaly detection, service monitoring, reliability improvements, and responding to support requests where access to relevant information is necessary.

These temporary logs are stored in encrypted, access-controlled systems with role-based permissions limiting access to authorized personnel only when necessary for the specific purposes described in this Policy.

Input and output content retained by SPRO for the purposes described above is subject to the applicable retention period described in the "Data Retention Periods and What We Store" section. Where the current SPRO configuration provides a maximum 24-hour retention period for raw input and output content, automated deletion processes are used to remove such content after that period, subject to legal, security, or contractual requirements that may require limited preservation of specific information.

During any applicable retention period, raw input and output content is used only for the purposes permitted by this Policy, the applicable Services, your configuration, and your contractual relationship with SPRO. Human access to raw content is restricted and occurs only where reasonably necessary for security investigations, technical support requested by you, service operation, or other legitimate operational purposes permitted under applicable law and contractual terms.

AI Model Providers and Third-Party AI Services

SPRO is designed to provide a controlled routing layer between your applications, agents, systems, and one or more AI model providers. When you submit a request through SPRO, the request may be routed to an AI model provider selected automatically or according to routing rules, policies, preferences, availability, model capabilities, cost considerations, latency requirements, data sensitivity requirements, or other criteria configured or supported by the Services.

When SPRO routes a request to an external AI model provider, that provider may receive and process the information necessary to generate the requested response. The processing activities of such AI model providers may be governed by their own privacy policies, terms, data-processing terms, security practices, retention policies, and contractual commitments.

SPRO may apply applicable security and guardrail controls before information is transmitted to a selected model provider and may also evaluate or process returned outputs before delivering them to your application or system. However, SPRO does not control the independent processing practices of third-party model providers and cannot represent that every provider follows identical data retention, training, security, or privacy practices.

You are responsible for reviewing the applicable provider configurations and contractual terms where required for your use case, particularly where your applications process regulated, confidential, sensitive, or otherwise restricted information. Enterprise customers may have additional contractual controls governing which model providers may receive their data and under what conditions.

Where supported by the Services, SPRO may provide controls that allow organizations to restrict provider access, define routing policies, apply data sensitivity rules, select permitted models or providers, and enforce organizational policies before requests are forwarded to third-party AI services.

Use for Model Training and Data Improvement

SPRO may use certain information to improve its security capabilities, routing functionality, threat detection accuracy, guardrail effectiveness, system reliability, and overall Services. Where the "Use for Model Training" setting is enabled for your account, SPRO may use anonymized, de-identified, and aggregated information derived from security and operational analysis for these improvement purposes.

When this setting is enabled, SPRO may use appropriately processed and de-identified information to improve threat detection algorithms, identify emerging attack patterns, refine security rules, improve guardrail sensitivity and accuracy, develop new security capabilities, improve routing behavior, and enhance the overall performance and reliability of the Services.

The data used for these improvement purposes is intended to undergo anonymization, de-identification, aggregation, or other appropriate processing designed to reduce the ability to associate the resulting information with an identifiable individual, organization, account, or specific customer content.

SPRO does not intentionally use raw customer input or output content for purposes beyond those permitted by this Policy, your account configuration, applicable contractual terms, or applicable law. Where information is transformed into anonymized or aggregated derivatives for security or product improvement, such derivatives may be retained for as long as reasonably necessary for those purposes.

You may opt out of model improvement where the applicable SPRO Services provide a "Use for Model Training" or equivalent privacy control. When you disable the applicable setting, SPRO will cease using newly processed data from your account for the purposes covered by that setting, subject to limited processing that may be necessary to complete previously initiated operations, comply with law, maintain security, or fulfill other legitimate obligations.

Regardless of your model improvement preference, third-party AI model providers may independently process requests routed to them according to their own applicable terms, policies, and contractual arrangements. Your configuration of SPRO's model improvement settings does not automatically change the independent data practices of a third-party model provider.

Data Retention Periods and What We Store

SPRO follows different retention periods for different categories of information based on the purpose, necessity, operational requirements, contractual commitments, and applicable legal requirements associated with each data type. We seek to retain information only for as long as reasonably necessary for the purposes for which it was collected or as required to provide the Services, maintain security, comply with legal obligations, resolve disputes, and enforce agreements.

Raw input and output content, including prompts and responses processed through SPRO, may be retained for a maximum of 24 hours under the current SPRO retention configuration and is then subject to automated deletion processes, except where a longer period is required by law, an active security investigation, a legal preservation obligation, or an applicable contractual arrangement.

Temporary security and operational logs that may contain limited fragments of content for debugging, security investigation, or service operation are subject to the applicable retention controls and, where they contain raw content, are intended to follow the same 24-hour content retention cycle unless a longer retention period is required for a specific legal, security, or operational reason.

Anonymized, de-identified, or aggregated information used for security research, product improvement, analytics, or model improvement may be retained for longer periods where such information no longer reasonably identifies an individual, organization, or specific customer content and where retention is necessary for the relevant purpose.

Configuration data including guardrail settings, routing policies, provider preferences, security policies, threshold preferences, custom rules, allowlists and blocklists, access controls, and other account configurations is retained for as long as your account remains active or as necessary to provide the Services. Following account closure, such information may be retained for a limited period to support account administration, legal obligations, dispute resolution, security, or legitimate business purposes.

Account information including usernames, email addresses, organization information, contact information, user roles, authentication information, subscription details, billing information, API credentials, and related account records may be retained for as long as your account is active or as necessary to provide the Services, comply with applicable legal obligations, resolve disputes, prevent abuse, and enforce our agreements.

System and diagnostic metadata that does not contain actual user content, including request timestamps, processing duration, routing information, model or provider identifiers, response status codes, system performance metrics, security event information, and service usage information may be retained for operational, security, analytics, capacity planning, troubleshooting, compliance, and service improvement purposes.

Billing and financial records including invoices, payment history, transaction records, and tax documentation may be retained for the period required by applicable accounting, tax, financial, or other legal requirements.

Audit logs documenting system access, configuration changes, administrative actions, authentication events, authorization decisions, routing policy changes, and security events may be retained for a period appropriate to the applicable security, compliance, contractual, and operational requirements.

In the event of an active security incident, legal investigation, litigation hold, regulatory inquiry, fraud investigation, or other legally recognized preservation requirement, SPRO may retain specific information beyond its standard retention periods to the extent reasonably necessary to address the matter. Any such extended retention will be limited to information relevant to the applicable purpose where reasonably practicable.

Information We Collect Beyond Input/Output Content

In addition to the input and output information processed through SPRO, we collect and process information necessary to create and manage accounts, configure routing and security policies, operate the platform, provide support, maintain security, process payments, monitor performance, and fulfill our legal and contractual obligations.

We may collect account and configuration information including your name, email address, organization name, account identifiers, user roles, permissions, authentication information, subscription information, routing preferences, model and provider preferences, guardrail configurations, security policies, threshold settings, custom rules, allowlists and blocklists, API credentials, notification preferences, and other information required to configure and administer the Services.

We may collect technical and operational metadata including request timestamps, request and response status information, processing duration, routing decisions, selected model or provider identifiers, API endpoints accessed, system performance information, usage volumes, error information, security events, authentication attempts, authorization decisions, and other metadata required to operate, secure, troubleshoot, and improve SPRO.

We may automatically collect technical information through your use of the Services, including IP addresses, browser and device information, operating system information, user-agent information, referring URLs, access dates and times, network information, approximate geographic information at the country or regional level, cookie identifiers, and similar technical information where applicable.

We collect communication and support information when you contact SPRO or interact with our support team, including support tickets, emails, chat communications, feedback, survey responses, feature requests, bug reports, documentation requests, and attachments or screenshots that you voluntarily provide for troubleshooting or support purposes.

We may also collect aggregated usage analytics and service interaction information to understand how customers use SPRO, including feature usage, routing configurations, security control usage, dashboard interactions, API usage trends, and general platform behavior. Such analytics are designed to support service improvement and operational planning and are not intended to include raw customer content unless expressly permitted under the applicable processing purpose.

How We Use Information

We use the information we collect for limited and legitimate purposes necessary to provide, secure, maintain, improve, and administer SPRO Services, including the following:

• to operate, provide, maintain, and deliver SPRO's AI Secure Gateway and Multi-Model Routing Platform and its associated routing, security, guardrail, governance, monitoring, and management capabilities;
• to receive, process, inspect, secure, route, and return AI requests and responses in accordance with your configured policies, routing rules, security controls, and applicable service configuration;
• to select or facilitate selection of AI models and model providers based on configured routing policies, model availability, capabilities, cost, latency, data sensitivity, business rules, or other supported criteria;
• to apply AI guardrails and security controls to detect and mitigate supported threats, policy violations, sensitive data exposure, prompt injection, jailbreak attempts, malicious content, and other configured risks;
• to monitor system performance, availability, reliability, routing behavior, security events, and service health;
• to detect, investigate, prevent, and respond to fraud, abuse, unauthorized access, security incidents, malicious activity, and violations of our Terms of Use;
• to maintain audit records, security records, operational logs, and governance information required to administer enterprise AI environments;
• to improve SPRO's security capabilities, routing functionality, guardrails, threat detection, performance, and user experience in accordance with applicable privacy settings and contractual terms;
• to troubleshoot technical problems, investigate errors, resolve service disruptions, and provide customer support;
• to communicate with you regarding your account, service updates, security notifications, policy changes, billing matters, product information, and support requests;
• to process payments, manage subscriptions, administer accounts, and maintain appropriate business and financial records;
• to comply with applicable laws, regulations, legal processes, court orders, governmental requests, and other lawful obligations;
• to enforce our agreements, protect the rights and safety of SPRO, our users, customers, employees, and third parties, and investigate suspected violations; and
• to conduct internal analytics, testing, research, development, and operational planning necessary to improve and expand the Services.

SPRO does not use customer content for targeted advertising based on the substance of your prompts or responses, and we do not sell personal information to data brokers or advertisers. We may use limited account, usage, or business information for legitimate business communications, service announcements, product communications, and other purposes permitted by applicable law and your relationship with SPRO.

Data Sharing and Disclosure

SPRO does not sell, rent, lease, trade, or broker personal information or customer content to third parties for their independent commercial purposes. We may disclose or provide access to information only where reasonably necessary to provide the Services, operate our business, protect users and systems, comply with law, or fulfill contractual and legitimate business purposes.

We may share limited information with trusted service providers and infrastructure partners that support SPRO's operation, including cloud hosting providers, database providers, content delivery networks, logging and monitoring providers, security providers, payment processors, communications providers, analytics providers, and other infrastructure or technology providers. Such providers may process information on our behalf and are expected to maintain appropriate confidentiality, security, and data protection obligations.

Where your use of SPRO requires routing requests to third-party AI model providers, relevant request and response information may be transmitted to those providers as necessary to provide the requested AI functionality. Such providers may process information under their own privacy policies, contractual terms, and data handling practices, and their processing may differ depending on the provider, model, service configuration, and applicable enterprise agreement.

We may disclose information when required by applicable law, regulation, subpoena, court order, governmental request, regulatory investigation, or other lawful process. Where legally permitted, we may provide reasonable notice before disclosure, challenge requests that we reasonably believe are unlawful or overbroad, and limit disclosure to information reasonably necessary to satisfy the applicable obligation.

We may disclose information where reasonably necessary to investigate, prevent, or respond to security incidents, fraud, abuse, malicious activity, threats to safety, unauthorized access, or violations of our Terms of Use, provided that such disclosure is limited to what is reasonably necessary for the applicable purpose.

In connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, corporate restructuring, or similar transaction, information associated with the Services may be transferred to a successor, acquiring entity, or relevant transaction party subject to applicable confidentiality, contractual, and legal requirements.

We may also use or disclose aggregated, anonymized, or appropriately de-identified information that cannot reasonably be used to identify you, your organization, or your specific content for purposes such as security research, industry analysis, benchmarking, service improvement, and reporting.

Security Measures

SPRO maintains technical, organizational, and administrative safeguards designed to protect information against unauthorized access, disclosure, alteration, loss, misuse, or destruction. Depending on the applicable environment and Services, these safeguards may include encryption of data in transit and at rest, access controls, role-based permissions, authentication mechanisms, least-privilege principles, secure infrastructure configuration, monitoring, logging, vulnerability management, security testing, incident response procedures, backup controls, and secure software development practices.

SPRO is designed with security controls integrated into the AI request lifecycle, including configurable AI guardrails, policy enforcement, request inspection, response inspection, routing controls, access controls, and monitoring capabilities. These controls are intended to provide organizations with an additional layer of protection and governance when applications and agents interact with multiple AI models and providers.

Access to systems containing customer information is restricted to authorized personnel and service providers with a legitimate operational requirement. Where appropriate, access is controlled using authentication, authorization, role-based access controls, logging, and monitoring mechanisms.

SPRO may conduct security assessments, vulnerability management activities, penetration testing, monitoring, incident response exercises, and other security activities appropriate to the Services and infrastructure used to operate the platform. Specific security controls and certifications applicable to enterprise customers may also be governed by separate contractual documentation, security documentation, or Data Processing Agreements.

While we implement safeguards designed to protect information, no internet-based service, cloud infrastructure, software system, or method of electronic transmission can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your credentials, API keys, authentication tokens, and account access information and for promptly reporting suspected unauthorized access or security incidents.

International Data Handling

SPRO may process information across different geographic locations, data centers, cloud regions, or infrastructure environments depending on the Services, infrastructure configuration, performance requirements, availability requirements, security architecture, and applicable contractual arrangements. As a result, information may be processed in countries or jurisdictions that have privacy laws different from those in your place of residence or establishment.

Where required by applicable law, SPRO will implement appropriate safeguards for international transfers of personal data, which may include contractual safeguards, adequacy mechanisms, Standard Contractual Clauses, or other legally recognized transfer mechanisms appropriate to the relevant jurisdiction and processing activity.

Enterprise customers may have additional requirements concerning data residency, geographic processing restrictions, approved model providers, or cross-border data transfers. Where such requirements are supported by the applicable Services or contractual arrangements, SPRO will process information in accordance with those requirements.

Enterprise AI Governance and Regulatory Compliance

SPRO is designed to provide organizations with technical controls that may assist with enterprise AI governance, security, privacy, risk management, and regulatory requirements. These capabilities may include model and provider routing controls, access management, security guardrails, policy enforcement, auditability, monitoring, usage visibility, data handling controls, and configurable governance policies.

Depending on the applicable Services and configuration, SPRO may help organizations establish policies governing which applications, users, agents, models, or providers may access particular AI capabilities and under what conditions. Organizations may also use available routing and security controls to establish rules relating to data sensitivity, provider selection, model capabilities, cost, latency, availability, and other business requirements.

SPRO provides technical capabilities that may support customers in implementing their own privacy, security, AI governance, and regulatory compliance programs. However, the availability of a technical control does not by itself establish compliance with any particular law, regulation, standard, or contractual requirement. Customers remain responsible for determining the requirements applicable to their organization, data, users, applications, and AI use cases and for configuring and operating SPRO appropriately to meet those requirements.

Where required, additional security, privacy, data processing, data residency, audit, or compliance commitments may be established through a Data Processing Agreement, enterprise agreement, security addendum, or other contractual documentation.

Your Responsibilities

You are responsible for ensuring that your use of SPRO and the information you submit through the Services comply with applicable laws, regulations, contractual obligations, organizational policies, and third-party rights. You should not submit information to SPRO unless you have the necessary rights, permissions, authorizations, or legal basis to process that information through the Services and, where applicable, through the selected AI model providers.

You are responsible for configuring routing policies, security policies, guardrails, provider restrictions, access controls, and other available controls appropriately for your organization's requirements. You are also responsible for reviewing the privacy, security, and data-processing terms applicable to any third-party AI model providers or integrations you choose to use through SPRO.

You must maintain the confidentiality of your account credentials, API keys, authentication tokens, and other access mechanisms and must promptly notify SPRO if you believe that your account or credentials have been compromised, misused, or accessed without authorization.

Your Privacy Rights

Depending on your jurisdiction and the nature of our processing activities, you may have rights relating to your personal data, including the right to request access to personal information, request correction of inaccurate information, request deletion of information subject to applicable legal and contractual requirements, request restriction of processing, object to certain processing activities, request data portability where applicable, withdraw consent where processing is based on consent, and lodge a complaint with an applicable data protection or supervisory authority.

Where applicable, you may also have rights concerning certain automated processing activities or other rights provided by local privacy and data protection laws. The availability and scope of these rights may vary depending on your jurisdiction, the nature of the information, our role in the applicable processing activity, and the legal basis for processing.

Exercise applicable privacy rights by contacting our Privacy Officer at admin@hridaai.com with sufficient information to identify your account and understand your request. We may request reasonable information to verify your identity and protect against unauthorized requests, and we will respond within the timeframe required by applicable law.

Children's Privacy

SPRO Services are not intended for children who are below the minimum age required to independently use the Services under applicable law. SPRO does not knowingly collect personal information from children in violation of applicable children's privacy laws. If you believe that a child has provided personal information to SPRO without appropriate authorization or consent, please contact us at admin@hridaai.com so that we can investigate and take appropriate action.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes to SPRO Services, our processing practices, security measures, legal requirements, contractual requirements, or other operational circumstances. When we make material changes, we may update the effective and updated dates shown at the beginning of this Policy and, where appropriate, provide additional notice through email, the Services, or other reasonable communication channels.

We encourage you to review this Privacy Policy periodically so that you remain informed about how SPRO collects, uses, processes, shares, and protects information. Your continued use of the Services following the effective date of an updated Policy constitutes acknowledgment of the updated Policy to the extent permitted by applicable law.

The current version of this Policy is available through the SPRO website at https://spro.hridaai.com/.

Contact Information

For questions, concerns, requests, complaints, or inquiries regarding this Privacy Policy, our data practices, privacy rights, security measures, AI governance controls, or data subject requests, contact us at admin@hridaai.com.

We are committed to reviewing privacy inquiries and requests in accordance with applicable law, investigating legitimate concerns, addressing identified issues, and working with customers and data subjects to maintain appropriate privacy and security practices across the SPRO Services.