If OpenRouter is sold, merges with another company, or goes through bankruptcy or a similar business transaction, your personal data may be transferred to a new owner as part of that deal.
This analysis describes what OpenRouter's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy authorizes transfer of user personal data, including account information and transaction records, to acquiring or successor entities as part of corporate transactions, without requiring user notification or consent at the time of transfer.
In the event of a sale, merger, or bankruptcy involving OpenRouter, personal data including account details, usage history, and transaction records may be transferred to a third party whose privacy practices may differ from those described in this policy.
Cross-platform context
See how other platforms handle Corporate Transaction Data Transfer and similar clauses.
Compare across platforms →Monitoring
OpenRouter has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.— Excerpt from OpenRouter's OpenRouter Privacy Policy
1. REGULATORY LANDSCAPE: The FTC has previously taken enforcement action in cases where data was transferred in corporate transactions contrary to prior privacy representations. CCPA requires that data transferred in business transactions continue to be subject to CCPA obligations. GDPR requires that any change in data controller be communicated to data subjects and that a lawful basis for the new processing relationship be established. 2. GOVERNANCE EXPOSURE: Medium. This is a standard corporate transaction clause present in most privacy policies, but it creates exposure for users if an acquiring entity's privacy practices are materially different. The phrase 'as permitted by law and/or contract' provides some constraint but does not commit to specific protections post-transfer. 3. JURISDICTION FLAGS: EU and UK users have the strongest protections, as GDPR requires notification of a change in data controller. California users retain CCPA rights regardless of corporate transaction. US users generally have fewer protections and may not receive direct notification of a data transfer in a corporate transaction. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should include provisions in their contracts with OpenRouter requiring notification of any corporate transaction that would result in transfer of their data to a successor entity, and should request data return or deletion rights in that event. 5. COMPLIANCE CONSIDERATIONS: Legal teams onboarding OpenRouter should evaluate whether their data processing agreements include change of control provisions requiring notification and the ability to terminate or request data return. GDPR-subject organizations should ensure any successor entity is evaluated as a data processor or controller before data transfer occurs.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy authorizes transfer of user personal data, including account information and transaction records, to acquiring or successor entities as part of corporate transactions, without requiring user notification or consent at the time of transfer.
In the event of a sale, merger, or bankruptcy involving OpenRouter, personal data including account details, usage history, and transaction records may be transferred to a third party whose privacy practices may differ from those described in this policy.
ConductAtlas has identified this type of provision across 18 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenRouter.