Privacy Policy
This policy explains what NexusAI Gear Platforms Inc. collects, why we collect it, how long we keep it, and the choices you have. It is written to be read, not to be survived. If anything here is unclear, email hello@nexusaigear.com and a person will answer.
1. Who we are
NexusAI Gear Platforms Inc. ("NexusAI Gear", "we", "us") is a company headquartered in Aurora, Ontario, Canada. We operate the NexusAI Studio content generation platform, the NexusAI Docs operational systems marketplace, the NexusAI Gear Store marketplace, and we build custom platforms and marketplaces for clients. We are the data controller for personal information we collect directly from you.
Where we process personal information on behalf of a client under a custom engagement, that client is the controller and we act as a processor under the data processing addendum signed with them. This policy does not govern that processing; the client's own notice to you does.
2. Information we collect
2.1 Account information
When you create an account we collect your name, email address, company name (if provided), job title (if provided), a hashed password credential, your plan and billing preferences, and the identity provider details if you sign in through SSO. We also record which products you use, which features you enable, and your role within a workspace.
2.2 Content, prompts, and uploaded material
NexusAI Studio stores the prompts you submit, the reference files you upload, and the assets we generate for you so that you can revisit and re-edit your projects. NexusAI Docs stores account, order, product file, and payout records for the operational systems marketplace. Creator submissions are validated and reviewed before listing.
2.3 Usage analytics
We collect information about how the services are used: pages viewed, features clicked, generation counts, generation duration, error events, approximate location derived from IP address, device and browser type, and referring source. We use this to keep the products working and to decide what to build next. Analytics are aggregated and are not linked to your identity in our reporting.
2.4 Payments
Payments for subscriptions and for Gear Store orders are processed by third-party processors - Stripe for subscriptions and card payments, and our logistics and payment partners for hardware orders. We never store full card numbers. What we retain is the transaction identifier, the billing country, the last four digits of the card where provided by the processor, invoice records, and the amount, date, and status of each transaction.
2.5 Cookies and similar technologies
We use strictly necessary cookies for session management, authentication, and preference storage - these keep you signed in and cannot be disabled without breaking the service. We use analytics cookies to understand aggregate usage, and a small number of preference cookies to remember choices such as theme and language. We do not use advertising cookies and we do not sell behavioural data to third-party advertisers.
2.6 Communications
When you contact us we keep your message and our reply, along with your contact details. If you subscribe to product updates, we keep your email address and the delivery history of each campaign until you unsubscribe.
3. How we use your information
- To provide the service. To authenticate you, run generations, store and render your documents, process orders, and send transactional messages such as receipts and password resets.
- To improve the products. To analyse feature usage, prioritise roadmap work, and fix defects. Where analysis requires identifying an individual account, it is done by our team under access controls.
- To secure the service. To detect fraud, prevent abuse of generation credits, investigate incidents, and enforce our acceptable use rules.
- To communicate with you. To send service announcements, respond to support requests, and - only if you opt in - send product news.
- To meet legal obligations. To retain transactional records, respond to lawful requests, and enforce our agreements.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you.
4. AI model data handling
This section is the one most people want to read, so we are explicit about it.
- Your prompts and outputs are never used to train shared models. Content you submit to NexusAI Studio and content you store in NexusAI Docs are not used to train models that serve other customers or the public. There is no opt-in and no opt-out toggle, because the behaviour is the same for everyone on every plan.
- Processing is limited to what is needed to serve you. Prompts and files are passed to the model providers we use for inference, under contractual terms that restrict them from retaining or training on that data. We configure provider zero-retention endpoints where the provider offers them.
- Your content stays yours. You own your prompts, uploads, and outputs. We claim only the limited licence needed to operate the service: to process your input, store your data, and display your results to you and to the people you share them with in your workspace.
- Workspace content is not used for other customers. Data in a NexusAI Docs creator account is visible to that creator and the platform operators, and is not used to train or improve anything for anyone else.
- Model improvements are opt-in and specific. Where we test a new model version against a sample of workspace data, that data is de-identified, drawn from opted-in accounts, and used only for evaluation - never for training a shared model.
You can delete a Studio project or a Docs page at any time, and that content is removed from our primary systems within 30 days and from backups within 90 days.
5. Sharing of information
We share personal information only in the following situations, and never sell it:
- Service providers. Infrastructure and cloud hosting, payment processing, email delivery, customer support tooling, error monitoring, and analytics. Each is bound by contract, permitted to process data only for the service we buy, and subject to confidentiality and security obligations.
- Model and inference providers. Prompts and files you submit to NexusAI Studio are routed to the providers that perform generation, under the terms described in section 4.
- Business partners. The Gear Store works with vendors who supply products. Vendors receive only the order details needed to fulfil an order - name, delivery address, items, and contact details. Vendors do not receive your NexusAI account data or your browsing history on the store.
- Professional advisers and authorities. Auditors, lawyers, and accountants as needed, and public authorities where we are legally obliged to disclose.
- Corporate transactions. In a merger, acquisition, or asset sale, information may transfer to the successor entity. We will give notice before your data becomes subject to a materially different privacy notice.
6. Retention
We keep personal information only for as long as it serves the purpose described in this policy, or as long as law requires us to keep it. The default periods below apply unless a longer period is needed for an active dispute, an open security investigation, or a legal obligation.
| Data category | Retention period | Notes |
|---|---|---|
| Account profile and authentication data | Duration of the account plus 12 months | Deleted or anonymised after account closure |
| Studio prompts, uploads, and generated outputs | Until you delete them, then 30 days | Erased from backups within 90 days |
| Docs pages, comments, and revision history | Until you delete them, then 30 days | Guest accounts expire on the date set by the workspace owner |
| Raw usage and analytics events | 14 months | Aggregated into counts that are retained longer |
| Server and application logs | 12 months | Access and security logs retained 24 months |
| Support correspondence | 24 months | Longer if attached to a custom engagement |
| Billing and transaction records | 7 years | Required by Canadian tax and accounting law |
| Gear Store order and shipping records | 7 years | Includes vendor fulfilment records |
| Deleted account data in backups | Up to 90 days | Rotated out on the normal backup cycle |
| Job applications and candidate records | 12 months | Extended only with your written consent |
7. Security
We apply encryption in transit (TLS 1.2 or higher) and at rest for stored data, least-privilege access controls with multi-factor authentication for all staff, mandatory security training, logged and reviewed administrative actions, environment separation between production and non-production, and annual third-party penetration testing. Our full security programme is described on the Security page, and we run a vulnerability disclosure programme for responsible researchers.
No system is perfectly secure. If a breach affects your personal information and creates a legally reportable risk, we will notify the affected individuals and the relevant regulator without undue delay and within the timeframe required by applicable law.
8. Your rights
Depending on where you live, you may have some or all of the following rights over your personal information. We extend our standard set of rights to every user regardless of jurisdiction, and we do not charge for making a request.
- Access. Ask for a copy of the personal information we hold about you, including the sources we collected it from and the purposes we use it for.
- Correction. Ask us to correct information that is inaccurate or incomplete. Most fields can be edited directly from your account settings.
- Deletion. Ask us to delete your account and associated data. We will confirm the scope with you first and then complete the request within 30 days.
- Portability. Request your data in a structured, machine-readable format - JSON or Markdown - so you can move it to another provider.
- Withdraw consent. Withdraw consent for marketing email, for optional analytics, or for any other processing that relies on consent. This does not affect processing carried out before the withdrawal.
- Object and restrict. Object to processing based on legitimate interests, and ask us to restrict processing in specific circumstances such as a disputed accuracy issue.
- Complain. Lodge a complaint with your local data protection authority. In Canada, that is the Office of the Privacy Commissioner; in the EEA, your national supervisory authority.
To exercise any of these rights, email hello@nexusaigear.com from the address on your account, or use the request form in your account settings. We verify identity before acting on a request, usually by replying from your registered email address. We respond within 30 days, and we will tell you if we need more information.
9. International transfers
NexusAI Gear is headquartered in Aurora, Ontario, Canada. Our infrastructure is primarily hosted in Canada and the United States, with some processing performed in the United Kingdom and the European Economic Area to serve customers in those regions. Some service providers - including model inference providers and payment processors - process data in the United States.
Where personal information leaves Canada or the EEA, we rely on an appropriate safeguard: Standard Contractual Clauses, an adequacy decision where one applies, or a data processing addendum that includes transfer terms. We conduct a transfer impact assessment before adding a new processing region or provider. You may request a copy of the safeguards we use by writing to us.
10. Children
Our services are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly. For customers under 18, a parent or guardian must create and manage the account.
11. Changes to this policy
We update this policy when our practices change. The effective date at the top always reflects the current version. For material changes - expanding the categories of data we collect, or a new sharing arrangement - we will notify account holders by email and post a notice on this page at least 30 days before the change takes effect. Earlier versions are available on request.
12. Contact us
NexusAI Gear Platforms Inc.
Aurora, Ontario, Canada
Privacy questions and rights requests: hello@nexusaigear.com
Security disclosures: security@nexusaigear.com
You can also reach us through the contact page or review our FAQ.