Security & Compliance

Privacy Policy

Effective Date: October 5, 2026 · Last Updated: October 5, 2026

1. Overview & Commitment

AInovation PH ("AInovation", "we", "our", or "us"), directed by Calixto Ong II, operates enterprise software solutions, developer tools, autonomous AI agents, and gateway proxy services accessible across ainovation.top and associated subdomains (including llm.ainovation.top and auth.ainovation.top).

We are committed to maintaining the highest standards of data protection, privacy, and confidentiality. This Privacy Policy details how we collect, use, store, protect, and process user data when you interact with our websites, software, Single Sign-On (SSO) gateways, and AI services.

2. Information We Collect

A. Google OAuth Account Information

When you choose to authenticate and sign in to AInovation PH applications (such as LiteLLM Gateway or AInovation SSO) using Google Single Sign-On ("Sign in with Google"), we request access to basic profile scopes:

  • Google User ID (unique identifier associated with your Google account)
  • Primary Email Address (used for authentication, session attribution, and team access control)
  • Display Name (first and last name as configured in your Google account)
  • Profile Picture URL (used solely to personalize your dashboard avatar)

B. Operational & Technical Telemetry

To monitor service health, ensure high availability, and prevent malicious attacks, our gateways automatically log technical connection metrics:

  • IP address, HTTP request method, timestamps, response latency, and user-agent string.
  • Token usage metrics, model endpoint calls, and rate-limiting counters.

Zero Plaintext Storage of Secrets: We never store passwords, Google account passwords, or sensitive OAuth tokens in plaintext. All secrets and session tokens are cryptographically secured using standard salting and encryption.

3. How We Use Collected Data

We use your information exclusively for the following operational purposes:

  • Identity Verification & Access Control: Authenticating legitimate users into the LiteLLM Proxy admin dashboard, development sandboxes, and enterprise APIs.
  • Role-Based Access Control (RBAC): Assigning administrative roles (proxy_admin, internal_user) based on verified email domains and authorization matrices.
  • Audit Logging & Security Sentinel: Detecting unauthorized ingress attempts, brute-force attacks, or abuse against public endpoints.
  • Communication: Responding directly to technical support requests, bug submissions, or critical security advisories.

4. Google API Services User Data Policy Compliance

Limited Use Disclosure: AInovation PH's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In accordance with Google's Limited Use requirements:

  • We only use Google user data to provide and improve user-facing features that are prominent in the requesting application's user interface.
  • We do NOT transfer Google user data to third parties, unless necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger/acquisition with user notification.
  • We do NOT use or transfer Google user data for serving advertisements, including personalized, re-targeted, or interest-based advertising.
  • We do NOT allow humans to read Google user data unless we have obtained your affirmative agreement for specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the data has been aggregated and anonymized.
  • We do NOT use Google user data to train, fine-tune, or improve generalized machine learning or artificial intelligence foundation models.

5. Data Storage, Retention & Security Architecture

AInovation PH implements defense-in-depth security engineering modeled after SOC 2 and ISO/IEC 27001 best practices:

  • Encryption in Transit: All web traffic and API invocations strictly enforce TLS 1.3 encryption with HTTP Strict Transport Security (HSTS).
  • Network Isolation: Production databases and backends run within private virtual networks (Tailscale encrypted mesh / internal Docker bridges), completely unexposed to the public internet.
  • Data Retention: Session and profile data are retained only for as long as your account remains active or as required by law.

6. Third-Party Sharing & Disclosure

We do not sell, rent, monetize, or trade personal data or Google user data under any circumstances.

Information is only shared under strictly bounded conditions:

  • Infrastructure Providers: Trusted enterprise infrastructure vendors (Cloudflare for edge security/DDoS defense, Oracle Cloud Infrastructure for private hosting) operating under strict data processing agreements.
  • Legal Compliance: When required by lawful process, court order, or governmental regulation under the laws of the Republic of the Philippines.

7. User Rights, Revocation & Data Deletion

You maintain complete control over your data:

  • Revoking Google Access: You can revoke AInovation PH's access to your Google account at any time via your Google Account Security Permissions.
  • Data Deletion Requests: You have the right to request immediate, permanent deletion of your account, authentication records, and associated metadata. Submit your deletion request to [email protected] or [email protected]. Requests are confirmed and purged within 48 hours.

8. Contact Information

If you have any questions, concerns, or inquiries regarding this Privacy Policy or our security practices, contact our Data Controller directly:

AInovation PH
Attention: Calixto Ong II (Founder & Chief Systems Architect)
Email: [email protected] / [email protected]
Location: Manila, Philippines