Privacy

Operated by Nytto Labs, Sweden. GateZero (https://getgatezero.com) is an API spend router. This page describes the real data flow of that product. It does not claim that provider keys stay on your device.

Who we are

Operator: Nytto Labs, Sweden. Website: nyttolabs.com. Privacy and GDPR requests: privacy@nyttolabs.com.

What GateZero does with keys

The money path is a server-side proxy at /api/proxy. It is not the leftover demo at /api/gate.

• When you vault an OpenAI or Anthropic key, it leaves your device and is stored at rest with AES-256-GCM, wrapped by a server key (GATEZERO_VAULT_KEY).
• On each hop, the server decrypts that credential in memory so it can authenticate the upstream request to the provider. Keys leave the device for that hop. We do not pretend this is “keys never leave the device.”
• Use a restricted provider key with a spend cap — not a master secret. You can burn a vaulted key at any time from the booth.
• The credentials table stores ciphertext plus a masked preview (first and last characters only), not the plaintext key.

Browser demos (on-device IndexedDB vault, YubiKey, passkeys, Service Worker /api/gate) are labeled as demos. They are not the spend router.

Hop data, cost, and the ledger

Cost is computed after the upstream response, from real token usage when the provider returns it. Unknown models have no price row: they are forwarded without a cheaper alias, and we do not invent savings or a savings fee.

Model list prices used for that comparison are OpenAI and Anthropic public list prices, as of 2026-08. If we cannot verify a saving against that table, the savings fee is $0.

The spend-router ledger records hop metadata, not a copy of your prompt as a ledger field:

• provider, model, path, action, HTTP status
• baseline / actual / savings / fee amounts derived from tokens and the price table
• workspace id, optional idempotency key, timestamps

Request and response bodies are processed in memory to route the model and price the hop. If a client sends an Idempotency-Key, the upstream response may be stored so a retry does not hit the provider twice. GET hops may be cached briefly in memory for the same reason.

Billing

Seat subscriptions and the metered savings fee run through Stripe after Checkout binds a customer to the workspace. Free workspaces can track a fee on the ledger; Stripe is not charged unless there is verified savings and a Stripe customer. Billing and refunds: billing@nyttolabs.com.

Infrastructure we use to run the product

GateZero is hosted on Vercel. Workspace, vault ciphertext, and ledger data are stored in Supabase. Payments use Stripe. Those processors see what they need to provide hosting, database, and billing — not a separate marketing profile we invented for this page.

What we do not collect here

This site does not run a third-party product analytics pixel. Operational logs record workspace id, provider, status, and cost. Secrets must not appear in logs or error bodies; report a leak to privacy@nyttolabs.com.

Your rights (GDPR)

If the GDPR applies to you, you may ask to access, correct, delete, restrict, or export personal data we hold, or object to processing, by writing to privacy@nyttolabs.com. You may also contact your local supervisory authority. Product support is support@nyttolabs.com.

Contact

Operated by Nytto Labs, Sweden. Full list: Contact.