Privacy

What Padma keeps

Your account: name, organisation if you give one, email address, a scrypt hash of your password (never the password itself), language, time zone and settings. Sessions are kept as a cookie in your browser and a record on the server.

Your API keys: a SHA-256 hash of each key and its first characters, so you can tell them apart. The full key is shown once, when you create it, and never stored.

Each request: when it was made, the key, the model and host, token counts, the charge, how long it took and whether it succeeded. These records are your bill and are kept for as long as the account exists.

Payments: the amount, the method and the payment reference the gateway returns. Padma never sees your wallet PIN or card number.

Failed sign-ins: a one-way hash of the email address and of the network address tried, kept for a day, to slow down password guessing.

Prompts and answers

By default Padma does not keep the content of your requests — prompts and answers pass through to the provider and back. If you turn on payload logging in Settings, they are kept for 7 days so you can inspect them in Activity, then deleted.

To answer a request, its content is sent to the provider that serves the model, which handles it under its own API terms — some keep API traffic for a limited time to detect abuse. The providers Padma may send a request to are OpenAI (openai.com/policies), Anthropic (anthropic.com/legal), Google (ai.google.dev/gemini-api/terms), DeepSeek (deepseek.com), Mistral AI (mistral.ai/terms), Alibaba Cloud for Qwen (alibabacloud.com), DeepInfra (deepinfra.com) and Together AI (together.ai). Each model's page names the host that serves it.

Who else processes your data

Vercel hosts the site and the API, Neon hosts the database, and Resend delivers Padma's emails. Payment gateways (bKash first) process top-ups. These services may store data outside Bangladesh.

Padma does not sell your data, show advertising, or use your requests to train models.

Emails

Padma emails you to confirm your address, reset your password, and about your account and wallet: an email change, a low balance, a budget reached, or a daily summary if you turn one on. Alerts and summaries can be turned off in the dashboard.

Cookies

Padma sets two cookies: one that keeps you signed in, and one that remembers the language of the page you are reading. There are no analytics or advertising cookies.

Your choices

You can change your name, email and settings in the dashboard, and turn payload logging off at any time. To get a copy of your data or close your account, write to api@padmarouter.com from the account's email address. When an account is closed its details are deleted, except the payment and charge records the law requires Padma to keep.