Pilot terms and privacy

Taking part costs nothing, and we do not ask for a payment method.

The sidecar, the website and the dashboard are provided as they are, without warranty of any kind. We make no commitment about uptime, latency or results. Not an SLA.

You run the sidecar with your own provider API keys, and your provider bills you for every call it makes, including the second copy of a raced call, which may be billed in full even when it is cancelled. The sidecar keeps your keys on your machines and never sends them to us.

We may change or end the pilot, or change these terms, at any time; if a change matters to you, we will tell you by email. You can stop whenever you like.

To the extent the law allows, we are not liable for loss or damage from taking part in the pilot, including provider charges, lost data and lost profits. Liability that Dutch law does not allow to be limited, such as for intent or deliberate recklessness, is not limited.

Dutch law applies to these terms; disputes go to the competent court in Amsterdam. Write to [email protected].

The controller of your personal data is Airmet, a sole proprietorship (eenmanszaak) registered in the Netherlands, KvK 42172545, Amstelboulevard 110, Amsterdam. We follow the GDPR and the Dutch UAVG.

Your work email, the optional “What are you building?” line, the tag of the link you arrived by (such as gtc on our business cards), and a keyed hash of your IP address (never the address itself) to limit sign-ups per network. Why: to send you the install link and talk about the pilot. When you sign up we tell ourselves: by an email to our own mailbox with your address, your line and the tag, or, once our phone notice is on, by a Grafana Cloud alert that carries only the internal number of your sign-up and the tag if it is one of our own campaigns, never your address or your line; we then read who it was on a page only our staff can open. Basis: your consent, given by sending the form; withdraw it any time by email. Kept: no fixed period yet; we delete it by hand when you ask. Copies in our database backups expire after 90 days.

You sign in with GitHub, Google or a one-time link sent to your email. We store your email, the name and avatar the provider shares, its account id and the sign-in tokens it issues; your machine’s hostname, which names the CLI token the login creates; and which sidecar installs are yours. Why: to link your sidecars to you; when your account is created we tell ourselves, so we know you have joined: by an email to our own mailbox with your address and how you signed in, or, once our phone notice is on, by a Grafana Cloud alert that carries only your account id and how you signed in, never your address, and we read who it is on a page only our staff can open. Basis: our agreement with you (contract). Kept: while the account exists; we delete it by hand when you ask. Copies in our database backups expire after 90 days.

On by default; --no-telemetry stops it at once. The sidecar sends one record per request: its timings; its size (message counts and bytes, never content); the policy decision (whether it raced, and why); for each leg, the route it took (provider, model and region; a private gateway, your own server or a model id that names your account reads as “custom”), its token counts, the cost the provider reported and the cost the sidecar computed from that provider’s published prices, and its status and error class; a session link (a random session id, the turn, and the request it continues); and labels as you configured them: your pool, your scenario and each leg’s id exactly as you named it in your config. Every push carries the install id, a random value (am_…) made on your machine at first run, not derived from your hardware, name or account, and kept across restarts so one install’s pushes can be told apart. Each push also carries the sidecar’s version and settings (its policy, its other serving settings and each leg’s route and settings, never a key, a URL or a file path), its request counters, the state of its routing data and any cost-guard trip. Opting out stops the pushes but keeps the id in your local config, where the choice is saved too; a sidecar that starts without that config, such as a new Docker container with no volume on /data, is a new install, with telemetry on unless it is given --no-telemetry again. A signed-in install still sends the id, with your account token, when it registers and fetches routing data, and when it fetches routing data it also sends the public catalog routes its legs use (for a marketplace endpoint, with the price its catalog lists). We keep the models those routes name with your account for 14 days after the last request that named one; the prices, and the routes we hold no current data for, are kept without your account or install id. A record never contains prompts, completions, model outputs, API keys, error bodies or URLs, and airmet traffic lists everything the sidecar sends (traffic transparency). With AIRMET_TELEMETRY_SCHEMA=v1 the sidecar sends small aggregate windows instead: latency percentiles, counts and the same labels. Why: to see how racing performs and improve routing for everyone. Basis: legitimate interest; object any time by turning it off. Kept: raw records and windows 90 days; per-account usage rollups 36 months; telemetry backups, once we take them, 30 days at most.

When your browser or a sidecar connects to airmet.ai or our telemetry endpoint, Cloudflare (which terminates TLS in front of both) and our web server see your IP address and the request. Why: security and abuse handling. Basis: legitimate interest. Kept: our server logs 14 days, without query strings; Cloudflare’s edge logs under Cloudflare’s own retention.

Pseudonymous page views (the page path, browser and screen size, and a random id kept in your browser), with IP addresses discarded and no name or email attached. Decline, or ignore the banner, and none of it loads. Basis: consent. Kept: 1 year, the analytics provider’s fixed retention.

Our servers are in the United States, and Cloudflare, Resend, Google Workspace, PostHog (which stores in Frankfurt but may process elsewhere) and Grafana Cloud (the same, in Germany) can process data outside the EEA. These transfers rely on the EU Standard Contractual Clauses in each provider’s data processing terms.

You can ask to see, correct, export or delete your data, restrict its use, object to processing based on legitimate interest (for telemetry, turning it off does that at once) and withdraw consent at any time. Write to [email protected]; we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

If this page changes in a way that matters, we update the date above and tell pilots by email.