Legal

Sub-processors

A gateway is a chain of third parties. This page names them and says what each one receives: including the ones that see your prompt, which are the ones that matter.

Who receives your prompt

When you make a request, the text goes to whichever provider serves the model you reached: either a model provider's own API or a routing service that fronts several of them. That party processes your prompt in order to return a completion, under its own terms and privacy policy. This is unavoidable for any gateway: a request cannot reach a model without reaching whoever hosts it.

The specific providers in the routing pool change as supply changes — that is the point of the router, and a fixed list published today would be wrong next month. We will name the current set on request: privacy@freemodel.online.

If you bring your own provider key, the request goes to that provider under your own account and their billing. Our route in between is the only added party. We never see your provider key in plain text outside the request path.

Infrastructure

ProviderRoleWhat it can see
Cloudflare DNS and reverse proxy for this site Visitor IP, request path; TLS termination for the web pages
Tencent Cloud Hosting the gateway and its database Request metadata at rest; network-level logs
Alibaba Cloud Hosting for part of the legacy gateway stack Request metadata; network-level logs
UCloud Hosting for this website Web server access logs

Accounts, payments and abuse prevention

ProviderRoleWhat it receives
Cloudflare Turnstile Bot challenge on registration and sign-in IP address and browser signals
GitHub OAuth Optional third-party sign-in Returns your GitHub account identifier and email
Google OAuth Optional third-party sign-in Returns your Google account identifier and email
Alibaba Cloud DirectMail Transactional email Your email address
Creem Payment collection for paid plans (merchant of record) Your email address, and the payment details you enter at its checkout — card data never reaches our servers

Sign-in through GitHub or Google is optional. An account with an email and password uses none of those three, only the bot challenge.

What we do not run

Worth listing, because the absence is the point: there is no advertising network, no analytics platform, no session-recording tool, no error-tracking SDK that ships page content, and no data broker on either the site or the gateway. Nothing on these pages loads a script from a third-party domain except the bot challenge on the sign-in form.

Payments

The free tier needs no payment method and no card. Paid plans are bought on the account portal at alli.website, and the charge is collected by Creem, a third-party merchant-of-record provider. Creem is the seller of record for the transaction and takes the payment details at its own checkout; card data never reaches our servers, and we hold none of it.

Because Creem is the seller of record, its name is what appears on a card statement, and its receipt is where the Customer Portal link comes from. Cancelling and refunds both run through it: the portal cancels the subscription — which is what stops the next charge — and carries the support route for a refund or a charge that looks wrong. Access runs to the end of the period already paid for, and an approved refund goes back to the original payment method.

Changes

When a sub-processor is added or replaced, this page is updated with the date below. Because the routing pool turns over as supply changes, the provider list in the first section is described by category rather than frozen; ask us for the current set at any time.

The path a request takes

Which party sees what is decided by where the request goes, not by any setting you control. Your client sends the call; the gateway terminates it at its host, decides which candidate should serve it, and forwards the prompt to that provider or routing service. The answer returns along the same path. Only the forward carries the prompt itself; the hosting layer stores metadata at rest, and the web layer in front of these pages serves the documentation rather than the API.

The recipient list for a prompt is not fixed, and that is a property of the product rather than an omission. Six of the 199 listed models (3%) are modality routes that resolve to a provider at request time, and the pool behind them turns over as supply changes. Of the remaining entries, 77% are chat models and 9% generate images, spread across model providers and routing services. A list frozen today would be wrong next month, so the first section of this page is written by category and the current set is available on request.

Sub-processor FAQ

Can I get a fixed list of the providers behind the router?
Not a useful one, and that is deliberate. The pool turns over as supply changes, so a list published today would be wrong next month — worse than no list, because you would rely on it. We will name the current set on request at privacy@freemodel.online.
Does Cloudflare see my prompt?
Its role here is DNS and reverse proxy for this website, with TLS termination for the pages: visitor IP and request path. Its other appearance in the stack is the bot challenge on registration and sign-in, which sees the IP address and browser signals of whoever is signing in.
What does the hosting provider actually store?
Request metadata at rest, plus network-level logs. It does not hold prompt content, because prompt content is not written to the database; the one exception being the agent endpoint's truncated task text, described on the privacy page.
Which parties receive my email address?
Alibaba Cloud DirectMail, for transactional email, and that is the only one. If you sign in through GitHub or Google, that provider returns an identifier and an email address to us. An account with an email and a password uses neither, only the bot challenge.
Is there a payment processor in this stack?
Yes, one: Creem, for paid plans only. It collects the charge as the merchant of record and takes the payment details at its checkout, so card data never reaches our servers. The free tier involves no payment processor at all, because it involves no payment.
How do I cancel a plan, or ask for a refund?
Through Creem, which is the seller of record. Every payment arrives with a receipt that links to their Customer Portal: cancelling there stops the next charge, and the same portal carries the support route for a refund or a charge that looks wrong. Access runs to the end of the period already paid for, and an approved refund goes back to the original payment method.
Does bringing my own key change who sees the request?
It changes who is billed, not who receives the prompt. The request goes to that provider under your account and their terms, and our route in between is the only added party. Your provider key is not readable outside the request path.

FreeModel is a product of Aiglade. Last updated 2026-09-21.