OpenRouter

[ToS] Section 5.1 states OpenRouter has "opted out of model training with the AI Models it uses" where possible, but this is not a blanket guarantee. The section also notes some AI Models "may store or train on your Inputs" and users "may allow you to opt-out." [ToS] Section 5.2 describes an opt-in license for using inputs/outputs to improve the product, but the default status and whether free vs. paid tiers differ is unclear. The language is conditional ("where possible") rather than absolute.

“[ToS] "Where possible, OpenRouter has opted out of model training with the AI Models it uses... Some AI Models may store or train on your Inputs for improving their own large language models and may allow you to opt-out."”

[ToS] Section 5.2 grants OpenRouter a "worldwide, perpetual, irrevocable, non-exclusive, royalty-free, fully paid right and license (with the right to sublicense)" to use, reproduce, modify, adapt, translate, and prepare derivative works of User Content for "our own commercial and business purposes." The license explicitly permits OpenRouter to "license or sell your User Content in anonymized form." This is a broad, perpetual license with sublicensing rights that extends beyond service delivery.

“[ToS] "you grant OpenRouter a worldwide, perpetual, irrevocable, non-exclusive, royalty-free, fully paid right and license (with the right to sublicense)... for purposes of providing the Services to you and for our own commercial and business purposes... license or sell your User Content in anonymized form."”

[Privacy] Section 3 states OpenRouter may share personal data with "Service Providers" (bound by confidentiality), "Affiliates and Corporate Partners," and "Analytics" partners with aggregated/de-identified data. However, the scope of "affiliates and partners" is not clearly defined, and the Privacy Policy does not provide a published sub-processor list. [Privacy] Section 6 notes third-party platforms are linked but OpenRouter is "not responsible for the privacy practices" of those third parties. The language is vague regarding which specific third parties receive what data.

“[Privacy] "We may share your personal data with our subsidiaries, affiliates, and partners... We may share aggregated, de-identified information... with our affiliates, subsidiaries, and partners."”

[Privacy] Section 7 states OpenRouter will "retain your information for as long as is reasonably necessary to comply with our business and legal obligations" but does not specify concrete retention periods. [ToS] Section 5.3 mentions Private Input & Output Logging can be configured with "data retention" options available "here" (link not provided in documents). The Privacy Policy lacks specific timelines for deletion, backup retention, or automatic purge upon account termination, using only vague language like "reasonably necessary."

“[Privacy] "We are subject to applicable laws on the retention of information and will retain your information for as long as is reasonably necessary to comply with our business and legal obligations."”

[ToS] Section 5.1 states "You retain copyright and any other proprietary rights that you may hold in the Input" but notes "Your ownership rights in the Output are set forth in terms for each AI Model you use." This defers output ownership to third-party AI Model Terms, creating ambiguity. [ToS] Section 5.2 grants OpenRouter a perpetual license to use outputs for commercial purposes, which suggests OpenRouter claims some rights to outputs even if the user retains nominal ownership. The ownership of outputs is not clearly stated as belonging exclusively to the user.

“[ToS] "You retain copyright and any other proprietary rights that you may hold in the Input. Your ownership rights in the Output are set forth in terms for each AI Model you use."”

Neither the ToS, Privacy Policy, nor any provided DPA excerpt mentions SOC 2 Type II, ISO 27001, HIPAA, or formal GDPR compliance certifications. [Privacy] Section 9 mentions reliance on GDPR standard contractual clauses and adequacy decisions, but this is a legal mechanism, not a certification. [Privacy] Section 5 describes general security measures ("physical, technical and administrative security measures") but provides no third-party audit or certification evidence. No trust page, security documentation, or DPA is referenced in the provided documents.

“Not found in documents — scored conservatively”