Privacy Policy
Nexus is a memory service for AI assistants. Businesses and developers connect their own apps to it. This page says what data Nexus holds, why, who else handles it and how to get it deleted.
1. Who is responsible
Nexus is run as an independent project by a sole operator based in Romania. A postal address will be published here once a registered company is in place. Until then, write to us:
- [email protected] for support and anything about your data.
- [email protected] for business matters and legal notices.
2. Who this covers
- Visitors to this website.
- Customers: the businesses and developers who hold a Nexus API key.
- End users: people who talk to an assistant that a customer built on Nexus.
3. What we hold
If you visit this website
Nothing that identifies you. These pages set no cookies, run no analytics and load nothing from another company’s servers. As with any website, the server sees the IP address of each request and keeps standard access logs (address, time, page) for a limited time, for security and troubleshooting.
If you are a customer
- What you tell us when you write to us: your name, email address and message.
- Your account: its name, its settings, and your API keys, stored only as a one-way hash. We cannot read a key back.
- Usage records: for each request, the time, the model used, how much was processed and what it cost. Limits and billing are worked out from these.
What customers send through the API
- Teaching material: the documents, pages and text given to a brain, and the memories made from them.
- Conversations: the messages sent to an assistant and its replies, a short summary of long conversations, and a record of what was looked up to answer.
- A user reference: an identifier the customer chooses, such as an account number, that ties a conversation to a person.
- Attachments: images and files are passed to the AI model to answer the message and are not stored. Only their name, type and size are kept.
We do not decide what goes into this content. The customer does.
4. Why we use it
- To run the service a customer asked for: learn what it is taught, answer what it is asked. This is done under our agreement with the customer.
- To measure usage, apply limits and bill. Accounting rules can require us to keep billing records.
- To keep the service secure and working: error logs, abuse prevention. We have a legitimate interest in a service that stays up and is not misused.
- To answer you when you write to us.
We do not sell data. We do not use it for advertising. We do not use it to train AI models.
5. If you are an end user
The business whose assistant you talked to decides what is collected and why. In data protection terms it is the controller and Nexus is its processor: we hold the data on its behalf and follow its instructions. To see or delete what an assistant holds about you, ask that business. It has the tools to do both. If you write to us instead, we pass your request on to it.
6. Who else handles data
These companies process data for Nexus. None of them may use it for their own purposes beyond what their terms with us allow.
| Company | What it does | What it receives | Where |
|---|---|---|---|
| Anthropic | Runs the AI model that reads a conversation and writes the reply. The default for every brain. | The conversation, the memories needed to answer it, and teaching material while it is being learned. | United States |
| Voyage AI | Indexes memories so the right one can be found, and ranks the matches. | Memory text and search queries. Not whole conversations. | United States |
| Brave Search | Web search, only for brains where the customer has it switched on. | The search terms. | United States |
| Hetzner Online GmbH | Hosts the servers and the database. | Everything that is stored. | European Union |
A customer can connect a brain to an AI provider of its own choice, with its own key. That provider is chosen by the customer and works for the customer, not for us.
Anthropic states that it does not train its models on data sent through its commercial API. Each provider’s own terms apply to what it receives.
Anthropic, Voyage AI and Brave are based in the United States. Where personal data is sent to them, the transfer relies on the safeguards those providers offer under EU law, such as the standard contractual clauses in their data processing terms.
7. How long we keep it
| What | Kept for |
|---|---|
| Memories and teaching material | Until the customer deletes them or closes the brain. |
| Conversation messages | Up to 12 months. |
| Conversation summaries | Up to 12 months. The bare record that a conversation took place is removed after 24 months. |
| Usage and billing records | 24 months, or longer where accounting law requires it. |
| Error logs | 90 days. |
| The operator’s record of changes made to accounts | 24 months. |
Backups are overwritten on a rolling schedule, so deleted data leaves them when they roll over.
8. Your rights
Under EU data protection law you can ask to:
- see the data held about you and get a copy of it;
- have it corrected or deleted;
- have its use restricted, or object to its use;
- receive it in a form you can take elsewhere.
Write to [email protected]. We answer within one month. When data is deleted on request, we confirm it in writing once it is done.
You can also complain to a data protection authority. In Romania that is ANSPDCP (dataprotection.ro). You may use the authority of the EU country where you live instead.
9. Cookies
This website sets none, and the API does not use them. See the cookies page.
10. Security
- Connections are encrypted (HTTPS).
- API keys are stored as one-way hashes. Keys for a customer’s own AI provider are stored encrypted.
- Each customer’s data is kept apart, and every request is checked against the owner of the key that made it.
- Only the operator has access to the systems.
No system is perfectly secure. If a breach affects personal data we tell the customers concerned without undue delay, and the authorities where the law requires it.
11. Children
Nexus is a service for businesses and developers and is not directed at children. Customers decide who may use what they build and are responsible for the age rules that apply to them.
12. Changes to this policy
When this policy changes, the new version is published here with a new effective date. Customers are told by email about changes that matter.
13. Contact
[email protected] for anything about your data. [email protected] for legal notices.