NexusAXI

Privacy Policy

Privacy Policy

Last updated: September 5, 2026

1. Who this applies to

This Privacy Policy describes how Irena Kalėda, an individual based in Kaunas, Lithuania ("we," "us"), collects, uses, and protects personal data of users of NexusAXI ("Service"). We process data as a controller for the purposes described below.

2. What we collect

  • Account data: email, authentication credentials (hashed), account settings.
  • Usage data: chat messages, generated content, memory facts extracted from conversations, model/feature usage, timestamps.
  • Payment data: we do not store full card numbers. Payment processing is handled by Stripe; we retain transaction metadata (amount, timestamp, status, wallet balance changes) but not card details.
  • BYO-key data: third-party API keys you provide are encrypted at rest (AES-256-GCM) and never displayed in full after entry.
  • Technical data: IP address, device/browser information, log data for security and abuse prevention.

3. Why we collect it (legal basis under GDPR)

  • To provide the Service you requested (contract necessity)
  • To process payments and prevent fraud (contract necessity, legitimate interest)
  • To improve the Service and maintain memory continuity across your sessions (legitimate interest / consent where required)
  • To comply with legal obligations (e.g., tax, fraud prevention)

4. Memory and personalization

NexusAXI extracts and stores facts from your conversations to provide continuity across sessions. This memory is walled per account — never shared with or visible to other users. You can review, edit, or delete stored memory from account settings.

5. Sharing your data

We do not sell your personal data. We share data only with:

  • Stripe (payment processing) — does not use your payment data to train AI models
  • AI model providers, only the content of the specific request needed to generate a response:
    • Together AI — does not use your data to train models by default (zero data retention available; training only occurs if explicitly opted in at the organization level, which we do not do)
    • fal.ai (image generation) — contractually commits not to use customer data to train its models
    • NVIDIA NIM — some requests on our free service tier may be served through NVIDIA's hosted inference infrastructure. Where that is the case, NVIDIA's own privacy policy governs how those specific inputs and outputs are handled. Requests served through our paid or BYO model routing are not affected by this.
    • Your own BYO provider, if you supply your own API key — governed entirely by that provider's own terms, not ours
  • Infrastructure providers (Vercel, Supabase) for hosting and storage — do not train models on your data; see Section 8 for how they handle cross-border transfers
  • Authorities, where required by law

6. Data retention

We retain account and usage data for as long as your account is active. If you close your account, we delete or anonymize your account and usage data within 90 days, except for payment and transaction records, which we retain for the period required by Lithuanian tax and accounting law (typically up to 10 years for financial records) regardless of account status. You may request deletion at any time, subject to these legal retention requirements.

7. Your rights (GDPR)

If you are in the EU/EEA, you have the right to: access your data, correct it, delete it, restrict or object to processing, and data portability. Contact us at support@nexusaxi.com to exercise these rights. You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate or your local supervisory authority.

8. International transfers

Some of our providers process data outside the EU/EEA. Where this occurs, we rely on the EU Standard Contractual Clauses (2021/914) as implemented in each provider's own data processing agreement:

  • Vercel — EU SCCs (2021/914) and UK Addendum, per Vercel's published Data Processing Addendum
  • Supabase — EU SCCs (2021/914), Module Two/Three as applicable, per Supabase's published Data Processing Addendum
  • Stripe — Stripe's own published Data Processing Agreement and SCCs for payment data
  • AI model providers — governed by each provider's own data processing terms; we do not send personal data beyond what's needed for the specific request

9. Security

We use encryption at rest for sensitive data (including BYO API keys), access controls, and account isolation for memory data. No system is perfectly secure; we will notify affected users and authorities as required by law in the event of a breach.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time; material changes will be communicated via the Service or email.

12. Contact

Data controller: Irena Kalėda, Kaunas, Lithuania Privacy contact: support@nexusaxi.com