DevPass Supplemental Privacy Policy

Effective Date: April 26, 2026
Last Updated: August 2, 2026

This Supplemental Privacy Policy describes how LLM Gateway(“we”, “our”, or “us”) collects, uses, and protects information when you use DevPass, our flat-rate subscription for AI coding tools, available at devpass.llmgateway.io.

This DevPass Privacy Policy is an addendum to, and incorporates by reference, the main LLM Gateway Privacy Policy (the “Base Policy”), which forms the base of how we handle your data. The Base Policy applies in full to DevPass and governs all topics not specifically addressed here — including our role as controller and processor, legal bases for processing, your privacy rights (GDPR, UK GDPR, CCPA/CPRA), security, international transfers, and children’s privacy. This DevPass Privacy Policy only adds DevPass- specific detail to the Base Policy.

Order of precedence. If there is a direct conflict between this DevPass Privacy Policy and the Base Policy with respect to DevPass, this DevPass Privacy Policy controls for that conflict only. In all other respects, the Base Policy remains in full force and effect.

1. Information We Collect

a. Account Information

When you sign up, we collect your name, email address, and authentication credentials. For paid plans, we also collect billing details (company name, country, payment method) processed securely through Stripe.

b. Usage and Request Data

We log technical metadata for every request routed through DevPass, including:

Request and response timestamps, latency, finish reasons, and HTTP status codes
Token counts (prompt, completion, cached, reasoning) and computed cost
The model and provider used, the routing tier, and the source coding tool (Claude Code, Cursor, Cline, OpenCode, Codex, Autohand, etc.)
IP address, user agent, and approximate region

DevPass is metadata only: we keep the counts, costs, and routing information listed above, and full request and response payloads (your prompts and the model output) are not retained in your DevPass logs or dashboard. There is no setting to turn payload storage on, on any DevPass plan — the configurable data retention available on pay-as-you-go LLM Gateway organizations does not apply to DevPass.

Exception — the Responses API. Requests to /v1/responses (used by tools such as Codex CLI) are stateful by design: so that previous_response_id chaining and GET /v1/responses/{id} work, the input and output items of those requests are held in dedicated storage for up to 30 days, after which they are automatically deleted. This applies regardless of retention settings and matches OpenAI’s own Responses API retention. Send store: false with the request to opt out; other endpoints, such as /v1/chat/completions and /v1/messages, are unaffected. Payloads may also be held transiently in memory or cache while a request is being processed.

c. Cookies and Local Storage

We use first-party cookies and local storage to keep you signed in, remember your UI preferences, and operate basic product analytics (PostHog). Browser-level Do Not Track signals are not currently a supported opt-out mechanism. To opt out of analytics, contact us at contact@llmgateway.io; we are working on a self-serve in-app toggle.

2. How We Use Information

To operate, secure, and improve the DevPass service
To meter usage, enforce plan allowances, and process billing
To power dashboards (per-agent costs, sessions, and usage trends)
To detect abuse, fraud, and policy violations
To send transactional emails (receipts, plan changes) and, with consent, occasional product updates

As stated in the Base Policy, we do not sell your personal data, and we do not use your prompts or completions to train any model of ours.

3. Sharing With AI Providers

When you make a request, your prompt is forwarded to the AI provider you selected (e.g., Anthropic, OpenAI, Google, Mistral, DeepSeek). Each provider applies its own privacy and data-retention policy to that traffic. We pass through provider-side opt-outs where supported (for example, “no training” flags). You are responsible for reviewing the privacy policies of any provider you use. The Base Policy’s sections on AI Providers and on stealth/undisclosed providers also apply to DevPass.

4. Sub-processors

We rely on a small set of vetted sub-processors:

Stripe — billing and subscription management
PostgreSQL / Redis hosting — application data and caching
PostHog — product analytics
Email delivery providers — transactional email
AI providers, as listed in the DevPass model catalog

Each sub-processor is bound by contractual data-protection obligations.

5. Data Retention

This section supplements the Base Policy’s Data Retention terms:

Account and billing data — kept for the life of your account, and deleted promptly when you delete it. Billing and accounting records — purchases, payments, and the transaction history of credits bought and spent — are retained to meet legal, tax, and accounting obligations for 10 years, even after you delete your account, after which they are deleted or anonymized
Request metadata — kept for the life of your active DevPass subscription on every plan (Lite, Pro, and Max)
Request payloads— not retained; prompts and responses are discarded once the request completes. The one exception is the Responses API described in Section 1b, whose stored responses are kept for up to 30 days and then deleted
Logs and audit trails — kept for security and integrity for up to 12 months

6. Your Rights and Contact

Your privacy rights (including access, correction, deletion, export, objection, and the right to lodge a complaint with a supervisory authority), our security practices, and international transfer safeguards are described in the LLM Gateway Privacy Policy and apply to DevPass. To exercise any of these rights, or for questions about this Policy, email contact@llmgateway.io from the address associated with your account.