1. Introduction
Nexus AI Orchestrator ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our multi-platform social media management service.
2. Information We Collect
Account Information: When you register, we collect your username, email address, and password (stored as a secure hash).
Social Media Data: When you connect social media accounts (X/Twitter, Threads, YouTube, Facebook, Instagram, LinkedIn, TikTok, Pinterest, Reddit, Snapchat, Bluesky), we access only the data necessary to provide our services, such as posting content, retrieving profile information, and managing scheduled posts. We access this data through official platform APIs using OAuth tokens you explicitly authorize.
Content Data: Text, images, and media you create or upload through our content creation tools.
Usage Data: Pipeline execution traces, API request logs, feature usage patterns, and error reports to improve service quality.
Device Information: Browser type, operating system, IP address, and timezone for security and functionality purposes.
Contact Inquiry Data: When you use our public contact form or email us, we collect the name, email address, subject, message, and related correspondence you provide.
3. How We Use Your Data
- Providing and maintaining our service, including content creation, scheduling, and cross-platform posting
- Posting content to connected social media platforms only with your explicit permission
- Analyzing pipeline performance and service quality through aggregate analytics
- Sending service notifications (account security, feature updates)
- Responding to your support requests
- Responding to business, partnership, press, correction, and other contact inquiries
4. Social Media Data Handling
We access only the minimum data necessary from connected social media platforms. We never sell your social media data to third parties. OAuth tokens are kept only in our access-controlled server-side database; they are never returned to the browser or displayed in the application. When you disconnect a social account, we immediately delete its stored connection record and tokens. For TikTok connections, Nexus also calls TikTok's OAuth revocation endpoint so the grant is removed at TikTok.
5. Data Sharing
We may share your information only in the following circumstances:
- Service Providers: AI providers (Anthropic, OpenAI, Groq, HuggingFace, Ollama) process content generation requests. Only the prompt content is shared, not your personal data.
- Email Delivery Provider: Contact-form submissions and related correspondence are processed by the email delivery provider used to route messages to the Nexus support inbox.
- Legal Requirements: When required by law, subpoena, or legal process.
- With Your Consent: When you explicitly opt in to data sharing (e.g., the Nexus benchmark program).
6. Data Retention
We retain your data for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us. Pipeline traces and execution logs are retained for up to 90 days for debugging purposes, then automatically purged. Contact inquiries and related correspondence are retained only as long as reasonably necessary to respond, follow up, keep appropriate business records, or meet legal obligations.
7. Your Rights
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your account and associated data by contacting us
- Withdraw consent for data processing at any time
- Data portability — request a copy of your data in a machine-readable format
- Disconnect any linked social media account at any time
8. Security
We implement security measures including HTTPS encryption for data in transit, bcrypt password hashing, short-lived JWT authentication, server-side storage of OAuth credentials, access controls, and application responses that exclude OAuth tokens. We conduct regular security reviews of our codebase.
9. Children's Privacy
Our service is not intended for individuals under 13 years of age. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will promptly delete it.
10. International Data Transfers
Your data may be processed by third-party AI providers located in various jurisdictions. We ensure that any data transfers comply with applicable data protection laws, including GDPR and the Indian Digital Personal Data Protection Act (DPDP) 2023 where applicable.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date.
12. Contact
If you have questions about this Privacy Policy or wish to exercise your data rights, email [email protected] or use the public contact page.