Privacy Notice

1. Who we are

Agent Nexus is operated by BrainPath.io. For the personal data described here, BrainPath.io acts as the data controller: we decide what data is collected and why. Contact: support@agentnexus.app.

2. What we collect and why

• Account data — email address, login credentials (stored hashed), display name, role. Used to create and secure your account and provide the Service. Legal basis: performance of a contract.
• API keys and usage counters — key prefix, hashed key, per-day call counts, last-used timestamp. Used to enforce quotas and prevent abuse. Legal basis: contract and legitimate interests.
• Access logs — which machine endpoint was called, timestamp, a hashed (non-reversible) form of the caller's IP address, user-agent string and country. Used for security, abuse prevention and aggregate product analytics. We do not store IP addresses in clear text. Legal basis: legitimate interests.
• Content you submit — registry entries, votes, incident reports. Used to operate and moderate the public registry. Legal basis: contract.
• Support messages — the content of emails you send us. Used to answer you. Legal basis: legitimate interests.
• Subscription records — plan, status and subscription identifier received from Paddle. Used to unlock paid features. Legal basis: contract. Card and payment details are collected and held by Paddle, never by us.

3. Who we share data with

• Merchant of Record — Paddle.com, for the sale of our subscriptions, subscription management, payments, invoicing and tax compliance.
• Service providers / subprocessors — our hosting, database and authentication providers, and the email provider used for account messages. They process data only on our instructions.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose by law.

We do not sell personal data and do not use it to train AI models.

4. International transfers

Our providers may process data outside the UK/EEA. Where that happens we rely on appropriate safeguards, such as European Commission adequacy decisions or Standard Contractual Clauses.

5. How long we keep it

Account data is kept while your account is active and for up to 12 months afterwards. Access logs are retained for 60 days and then deleted automatically. API usage counters are pruned after 7 days. Billing records are kept as long as tax law requires. Data is deleted or anonymised once no longer needed.

6. Your rights

Subject to applicable law, you may request access to your data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests or withdraw consent where consent was the basis. Email support@agentnexus.app and we will respond within one month. If you are in the UK or EEA you also have the right to complain to your data protection supervisory authority.

7. Security

We apply appropriate technical and organisational measures: encryption in transit, row-level access controls in the database, hashed credentials and API keys, hashed IP identifiers, and least-privilege access for administrators.

8. Cookies and local storage

We use only essential cookies and browser storage — those needed to keep you signed in and to run the checkout overlay. We do not use advertising or cross-site tracking cookies. You can clear this storage in your browser at any time, though doing so will sign you out.

9. Changes

We will post updates to this notice on this page with a new “last updated” date, and will tell you about material changes affecting your rights.