Nexus
Sign in

Privacy Policy

Last updated

This policy explains what personal data Nexus processes, why, who helps us process it and how long we keep it. Saatvik Sharma, a sole proprietor in India trading as Nexus, is responsible for this data. Contact saatvik333sharma@gmail.com with any privacy question.

1. Data we collect

  • Sign-in details. When you sign in with GitHub or GitLab, we receive your name, email address, profile picture link and account ID from that provider. We store the provider’s access token encrypted.
  • Sessions. We store a session record with your IP address and browser user agent, and set a session cookie in your browser.
  • Workspace data. Organization and workspace names, members and roles, invitation email addresses, notes, handoffs, triage choices, action approvals and an audit record of who changed what and when.
  • Data from connected services. When an administrator connects a service, we receive its webhooks and read its API. We keep the fields Nexus shows: titles, states, links, repository and project names, commit identifiers, branches, environments and timestamps. We do not keep full webhook payloads, descriptions, actor email addresses or pipeline variables.
  • Credentials. Webhook secrets and API tokens for connected services are stored encrypted and are never shown again after you save them. Agent tokens are stored only as a one-way hash.
  • Agent activity. Run status reports and handoffs that your coding agents send. Nexus does not collect agent transcripts.
  • Attachments. Files that members upload, where this deployment offers attachment storage.
  • Billing. Paddle collects your payment details. We receive only the Paddle customer and subscription IDs, the plan, the subscription status and billing dates. We never see full card numbers.
  • Usage and security. Monthly counts of events, API and MCP requests and actions per organization, so plan limits work. Rate limits use a hashed form of your IP address over short time windows. Our hosting provider keeps request logs.

2. How we use it

We use this data to run Nexus for you, keep accounts and connected services secure, enforce plan limits, bill subscriptions through Paddle and answer your messages. We rely on our contract with you, our legitimate interest in keeping Nexus secure, and our legal obligations, such as tax records.

We do not sell personal data, show advertising, or use your content to train machine learning models.

3. Who processes it

  • Cloudflare hosts the application on Cloudflare Workers, runs its job queues on Cloudflare Queues, connects it to the database through Cloudflare Hyperdrive, and keeps request logs.
  • Neon hosts the PostgreSQL database and stores the attachments that members upload in Neon Object Storage.
  • Paddle.com is our reseller and Merchant of Record. It processes checkout and payment data as an independent controller under the Paddle Privacy Policy.
  • Resend sends invitation emails. It receives the invitee’s email address, the inviter’s name and email address, the workspace name, the role offered and the invitation link.
  • GitHub and GitLab authenticate you under their own privacy policies. When your workspace connects them, Nexus calls their APIs on your organization’s behalf to read its work and to make the changes your workspace approves, such as a comment or a merge.
  • Services your workspace connects, such as Slack or Discord for digests, receive the information an administrator configures Nexus to send them.

These providers may process data outside India, including in the United States and the European Union.

4. Cookies and browser storage

Nexus sets only the cookies needed to sign you in and keep your session. Your theme choice stays in your browser’s local storage. We use no analytics or advertising cookies. Paddle’s checkout sets its own cookies when you open it.

5. How long we keep it

  • Work item history: 7 days on Free and 90 days on Team after an item was last updated. Work that is still running, or that a pending action refers to, stays until it finishes. When Team ends, the Team history is kept for 30 more days so you can export it.
  • Sessions expire about a week after you last use Nexus.
  • Account, organization and workspace data: while the account or organization exists.
  • Billing records: as long as tax and accounting law requires.

6. Security

Connections use HTTPS. Credentials and provider access tokens are encrypted, agent tokens are hashed, and every workspace request is checked against the member’s role in that workspace.

7. Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, or stop processing it. Workspace administrators can export workspace data from Nexus at any time. Email saatvik333sharma@gmail.com and we will reply within 30 days. You can also complain to your data protection authority, such as the Data Protection Board of India or the authority in your country.

8. Children

Nexus is not intended for anyone under 18.

9. Changes to this policy

We will publish any change here and update the date above. We will tell account holders about significant changes before they take effect. The Terms and Conditions cover the rest of our agreement with you.