Data Processing
These terms apply whenever what you send to Nexus includes personal data about other people, for example the messages of your own customers. They are part of the terms of service.
1. Who does what
You decide what data is sent and why, so you are the controller. We process it for you, so we are the processor. Where you yourself act for someone else, we are your sub-processor.
2. What is processed
| Purpose | To run the service: learn the material you provide, keep it, and answer conversations from it. |
|---|---|
| For how long | For as long as you use Nexus, then until deletion as set out in section 8. |
| Kinds of data | Whatever you choose to send: messages, the user reference you attach to a conversation, and anything personal contained in teaching material. |
| People concerned | Your end users, your staff, and anyone named in the content. |
Nexus is not built for data that needs special protection under the law, such as health data. Do not send it unless we have agreed to it in writing.
3. Your instructions
We process personal data only on your instructions. Your API calls and your settings are those instructions. If we believe an instruction breaks data protection law, we tell you.
4. Confidentiality
Only the operator has access to the systems, and that access is used only to run, secure and support the service.
5. Security
- Encrypted connections to and from the service.
- API keys stored as one-way hashes. Keys for your own AI provider stored encrypted.
- Each customer’s data kept apart, and every request checked against the owner of the key that made it.
- Limits on how fast and how much any one key can send.
- Regular backups, and a tested way to restore them.
6. Sub-processors
You agree to our using the companies listed in the privacy policy. Before a new one starts handling personal data, we update that list and tell customers by email. If you object on reasonable grounds, you can stop using the service and have your data deleted.
An AI provider that you connect with your own key is your choice and your processor, not ours.
7. Helping you with people’s requests
The API lets you export everything held about one of your users, and erase it. If someone writes to us about data you control, we pass the request to you and do not answer it ourselves.
8. Deletion
You can delete memories and whole brains at any time, and erase what is held about any one of your users. When you stop using Nexus and ask for it, we delete your content and confirm in writing once it is done. Data in backups leaves them as the backups roll over. Records we must keep by law, such as billing records, are kept only as long as that law requires.
9. If something goes wrong
If a breach affects personal data we process for you, we tell you without undue delay and give you what we know: what happened, what data is concerned and what we are doing about it.
10. Showing that we keep to this
We answer reasonable questions about how your data is handled and give you the information you need to show that you comply with data protection law.
11. Data leaving the EU
Some sub-processors are based in the United States. Where personal data is sent to them, the transfer relies on the safeguards they offer under EU law, such as standard contractual clauses.
12. Contact
Write to [email protected].