Privacy Policy

1. Data Controller

Nexus AI Ltd is the data controller for all personal data processed through the Nexus platform. We are incorporated and registered in England and Wales.

If you have questions about how we handle your personal data, or wish to exercise your data rights, contact our privacy team at privacy@nexus.ai. We will respond within 30 days.

This policy applies to all users of the Nexus platform, including visitors to our website, account holders, and anyone whose data we process in connection with the Service.

2. What We Collect

We only collect data that is necessary to provide and improve the Service. Here is what we collect and why:

Account information

When you create an account, we collect:

• Email address (required for login and service notifications)
• Name (optional, used to personalise the dashboard)
• Password (stored as a salted cryptographic hash — we never store or see your plaintext password)
• Account preferences, notification settings, and dashboard configuration
• Organisation name and team member details (Team and Enterprise plans)

Usage and AI interaction data

When you use the Service, we process:

• Source code from repositories you connect to Nexus
• Task descriptions, instructions, and goals you provide to agents
• Code, documentation, and other outputs generated by AI agents on your behalf
• Agent conversation logs and interaction history
• Pipeline activity, proposal history, and task execution records
• Pull request descriptions, commit messages, and review comments created by agents

Voice and communication data

• Voice call audio processed in real time for the duration of the call; not stored beyond the session unless you explicitly enable call recording
• Text messages sent via Discord integration, the dashboard, or the API
• Notification delivery history and read receipts

Technical and usage data

• IP address and general geographic region
• Browser type and version, operating system
• Pages visited, features used, and time spent on the platform
• API request logs, error logs, and performance metrics
• Cost and token usage data per task and per model

Payment data

Billing is handled by Stripe. When you subscribe to a paid plan, Stripe collects and processes your card details directly. We receive from Stripe only: your subscription status, plan type, billing interval, and payment history. We never store your card number, CVV, or expiry date on our servers.

3. How We Use Your Data

We use your data only for the purposes listed below. We do not sell your data to third parties. We do not use your code or project data to train AI models.

Purpose	Legal basis (GDPR Article 6)
Providing the Service (running tasks, processing code, voice calls)	Contract performance (Art. 6(1)(b))
Account management and authentication	Contract performance (Art. 6(1)(b))
Building the knowledge base and memory for your account	Contract performance (Art. 6(1)(b))
Billing, invoicing, and payment processing	Contract performance (Art. 6(1)(b))
Sending service notifications (task updates, proposals, alerts)	Contract performance (Art. 6(1)(b))
Security monitoring, fraud prevention, and abuse detection	Legitimate interest (Art. 6(1)(f))
Service improvements, bug fixes, and product development	Legitimate interest (Art. 6(1)(f))
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))
Sending product updates and marketing communications	Consent (Art. 6(1)(a)) — opt out any time

4. Legal Basis for Processing

We process your personal data under the following legal bases defined in UK GDPR and EU GDPR Article 6:

• Contract performance — processing necessary to deliver the Service you have signed up for, including running AI agents, processing code, and sending task notifications.
• Legitimate interest — processing for security monitoring, improving the platform, and communicating important service changes. We carry out a balancing test to ensure these interests do not override your data rights.
• Legal obligation — processing required to comply with applicable laws, regulatory requirements, or court orders.
• Consent — for optional activities such as marketing emails. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Retention

We keep your data only for as long as necessary. Our default retention periods are:

• Account data (profile, settings, subscription history): retained for the duration of your active account, plus 90 days after account closure to allow reactivation. After 90 days, all account data is permanently deleted.
• AI interaction and task logs: retained for 30 days from the date of the interaction, then automatically purged. You can configure a shorter retention period in your account settings.
• Encrypted backups: retained for 7 days on a rolling basis, then overwritten.
• Billing records: retained for 7 years as required by UK financial record-keeping regulations.

You may request earlier deletion of your data at any time by contacting privacy@nexus.ai or using the delete function in Settings > Account.

6. Third-Party Services

We share data with the following third-party providers, strictly as needed to deliver the Service. We do not share data for advertising or unrelated commercial purposes.

Stripe — payment processing

Stripe processes your payment information when you subscribe to a paid plan. We do not store card details on our servers. Your payment data is governed by Stripe's Privacy Policy.

Voice synthesis provider

Our voice synthesis provider receives text strings for conversion to speech. It does not receive your source code, project data, or personal identifying information beyond what is embedded in the text sent for synthesis.

LLM providers — AI processing

To execute tasks, we send code snippets and task context to the AI providers active on your account. We use enterprise API agreements with each provider that include data processing protections and prohibit use of your data to train their models.

• Anthropic (Local) — Privacy Policy
• OpenAI (GPT models) — Privacy Policy
• Google (Gemini) — Privacy Policy

You can configure which providers are active for your account and disable any provider you do not wish to use from Settings > AI Providers.

Other integrations

If you connect optional integrations (Discord, GitHub, Microsoft 365, etc.), data exchanged through those integrations is also subject to the respective provider's privacy policy. You can disconnect any integration at any time from Settings > Integrations.

7. Data Security

We take reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Encryption in transit: All connections to the Nexus platform use TLS 1.2 or higher. We enforce HTTPS across the entire service.
• Encryption at rest: Sensitive data (API keys, tokens, passwords, and secrets) is encrypted at rest using AES-256.
• Access controls: Internal access to customer data is restricted on a strict need-to-know basis. All access is logged and auditable.
• Regular backups: Automated encrypted backups run daily to guard against data loss.
• Vulnerability management: We regularly review our codebase, dependencies, and infrastructure for security issues.

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to privacy@nexus.ai. In the event of a data breach that affects your personal data, we will notify you and the relevant supervisory authority as required by law.

8. Your Rights

Under UK GDPR (and EU GDPR for EEA residents), you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of any inaccurate or incomplete personal data.
• Erasure ("right to be forgotten"): Request deletion of your personal data where we no longer have a lawful basis to retain it.
• Data portability: Request a structured, machine-readable export of your data so you can transfer it to another service.
• Restriction: Request that we restrict processing of your data while a dispute is resolved.
• Objection: Object to processing based on legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent: Withdraw consent for marketing communications at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, submit your request to privacy@nexus.ai. We will respond within 30 days as required by GDPR. There is no charge for reasonable requests.

You can also delete your account and all associated data directly from Settings > Account > Delete Account in the dashboard.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use a minimal number of cookies, strictly necessary for the Service to function. We do not use advertising cookies, tracking pixels, or third-party analytics.

• Session cookie (nexus_session): Required for authentication. Identifies your logged-in session and expires when you close your browser or after 24 hours of inactivity.
• Preferences cookie (nexus_prefs): Stores your dashboard layout preferences (sidebar state, column widths, etc.). Persists for 1 year. You can clear it at any time without affecting your account.

We do not use Google Analytics, Facebook Pixel, or any third-party tracking services. We do not use cookies for advertising. Because we only use strictly necessary and functional cookies, we do not display a cookie consent banner — but we wanted you to know exactly what we set and why.

10. Children

The Nexus Service is intended for adults and is not directed at anyone under the age of 16. We do not knowingly collect or process personal data from children under 16. If you are under 16, please do not use the Service or provide us with any personal data.

If you are a parent or guardian and believe your child has provided us with personal data, contact us at privacy@nexus.ai and we will delete it promptly.

11. International Transfers

Your data is primarily stored on servers located in the United Kingdom and the European Economic Area (EEA). However, some of the third-party AI providers we use (Anthropic, OpenAI, Google) process data on servers in the United States and potentially other countries outside the EEA.

For transfers of personal data outside the UK and EEA, we rely on appropriate safeguards as required by UK GDPR and EU GDPR, including:

• Standard Contractual Clauses (SCCs) with each third-party provider that processes data outside the EEA
• UK International Data Transfer Agreements (IDTAs) where applicable
• Adequacy decisions made by UK or EU authorities

These safeguards ensure your data receives a level of protection equivalent to that provided under UK and EU law, regardless of where it is processed. You may request a copy of the relevant transfer safeguards by contacting privacy@nexus.ai.

12. Changes to This Policy

We may update this Privacy Policy as the Service evolves or regulations change. When we make material changes, we will notify you by email at least 30 days before the changes take effect and post a prominent notice on the Service.

The "Effective date" at the top of this page shows when the current version took effect. We encourage you to review this policy periodically.

Your continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not accept the changes, you should stop using the Service and contact us to request deletion of your data.

13. Contact

For privacy-related questions, data subject requests, or to exercise any of the rights described in this policy:

Nexus AI Ltd — Privacy Team
Registered in England & Wales
Email: privacy@nexus.ai
Web: nexus.ai

We aim to acknowledge all privacy requests within 5 business days and provide a full response within 30 days.

If you are not satisfied with how we have handled your data or responded to a request, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Web: ico.org.uk
Tel: 0303 123 1113