Privacy Policy

01 Who We Are and How to Contact Us

Nexus.AI operates this AI tools portal. For any privacy-related question, request, or complaint, contact us at:

Email: [email protected]
Website: verkkotyo24h.life

We are the “data controller” for the personal information described in this policy, except where we act as a “data processor” on behalf of a third-party model provider (see Section 06).

02 Personal Information We Collect

We collect only the minimum information necessary to operate the generation service and respond to your inquiries. The categories are:

• Generation request data: the prompt text you submit; the selected generation type (image or video); the email address you provide to receive results.
• Technical log data: request timestamps, HTTP status codes, approximate request volume, and error diagnostics. We do not intentionally log full IP addresses in persistent storage, and any transient IP data is used only for rate-limiting and abuse prevention.
• Communication data: the content of any email or message you send to us, including attachments you choose to include.
• Website interaction data: language preference (stored locally in your browser via `localStorage`), and anonymous interaction events (such as filter clicks in the Inspiration Plaza) that are processed in your browser and not transmitted to our servers.

We do not intentionally collect: government identifiers, financial account numbers, precise geolocation, biometric data, health data, or information from children under 13 (see Section 09). If you include such information in a prompt, you do so at your own risk and we will treat it as part of the generation request.

03 Purposes and Legal Bases for Processing

We process personal information for the following purposes and, where GDPR or similar laws apply, on the following legal bases:

• To process and deliver generation requests: We use your prompt, selected type, and email to route the request to an appropriate model provider and deliver the generated output to your email. Legal basis: performance of a contract or steps preparatory to a contract (Art. 6(1)(b) GDPR).
• To maintain service security and prevent abuse: We use technical logs and request patterns to detect automated abuse, excessive request volumes, and malicious payloads. Legal basis: legitimate interests in protecting the service and other users (Art. 6(1)(f) GDPR).
• To respond to your inquiries and rights requests: We use your communication data and any relevant request records to answer your questions and fulfill legal obligations. Legal basis: legitimate interests and compliance with legal obligations (Art. 6(1)(c) and (f) GDPR).
• To improve reliability and delivery quality: We may analyze aggregated, non-identifying error patterns to diagnose failures. We do not use your prompt content to train models or build user profiles. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Where we rely on consent for any future feature (for example, optional newsletter subscriptions), you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

04 Data Minimization and Purpose Limitation

Consistent with the GDPR principles of data minimization and purpose limitation[citation:1], we:

• Collect prompt content only because it is the essential input to the generation service you requested.
• Collect your email only because it is the delivery channel you selected for receiving the output.
• Do not repurpose generation request data for advertising, profiling, model training, or sale to third parties.
• Do not require you to create an account to submit a generation request or exercise your privacy rights.

05 Retention and Deletion

We retain personal information only as long as necessary for the purposes described above:

• Generation request records (prompt, type, email, delivery status): retained for up to 90 days after the request is processed, to allow delivery troubleshooting and abuse investigation. After this period, records are deleted or irreversibly anonymized.
• Technical logs: retained for up to 30 days in identifiable form, then aggregated or deleted.
• Communication data: retained for up to 12 months after the last exchange, unless a longer period is required by law or for the establishment, exercise, or defense of legal claims.
• Rights request records: retained for the period required to demonstrate compliance (typically 3 years under GDPR accountability principles), then deleted.

You may request earlier deletion of your generation records at any time by contacting us at [email protected]. We will honor valid deletion requests within the timeframes required by applicable law (see Section 08).

06 Disclosure to Third Parties and Model Providers

To deliver AI-generated results, we must transmit your prompt and selected generation type to one or more third-party model providers. This is an integral part of the service you request.

• Model providers: We disclose prompt content and generation type to providers that operate image or video generation models. These providers process the data under their own terms and privacy policies. We select providers that contractually commit to reasonable data protection standards, but we do not control their independent processing practices. You should review the applicable provider’s privacy policy if you have specific concerns.
• Email delivery: Your email address is used by our delivery infrastructure to send the generated result. We do not sell or rent your email address to any third party.
• Infrastructure and security providers: We may use hosting and security service providers that process technical data on our behalf under data processing agreements. These providers are contractually restricted from using your data for their own purposes.
• Legal disclosures: We may disclose information if required by law, regulation, legal process, or governmental request, or if necessary to protect the rights, property, or safety of Nexus .AI, our users, or the public.

We do not sell your personal information as “sale” is defined under the CCPA/CPRA or similar laws. We do not share your information for cross-context behavioral advertising.

07 International Data Transfers

Our service may involve transfers of personal information to countries outside your country of residence, including to model providers and infrastructure located in various jurisdictions. Where GDPR applies and we transfer personal data to a country without an adequacy decision, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs)[citation:7], together with any supplementary measures necessary to ensure an essentially equivalent level of protection.

For transfers from the European Economic Area, the SCCs are incorporated into our agreements with relevant processors. You may request a copy of the applicable safeguards by contacting us, subject to redaction of commercially sensitive information.

08 Your Rights

Depending on your location and applicable law, you may have some or all of the following rights:

• Right of access: to obtain confirmation of whether we process your personal information and, where applicable, a copy of that information.
• Right to rectification: to correct inaccurate or incomplete personal information.
• Right to erasure (“right to be forgotten”): to request deletion of your personal information where there is no overriding legal ground for retention. Note that model providers may retain prompt data under their own policies; deletion requests directed to us cover records under our control.
• Right to restriction of processing: to request that we limit processing while a dispute is resolved.
• Right to data portability: to receive your personal information in a structured, commonly used, machine-readable format, where technically feasible.
• Right to object: to object to processing based on legitimate interests, including processing for direct marketing (which we do not carry out).
• Right to lodge a complaint: with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred.

How to exercise your rights: Send a request to [email protected] with sufficient information for us to verify your identity and locate the relevant records (for example, the email address used for generation and approximate request date). We will respond within 30 days for GDPR requests, or within the timeframe required by other applicable laws. We may extend this period where permitted by law, and we will notify you of any extension and the reasons.

California residents: Under the CCPA/CPRA, you have the right to know the categories and specific pieces of personal information we have collected, the right to delete, the right to correct, and the right to non-discrimination for exercising these rights[citation:6]. To submit a request, contact us at the email above. We will verify your request using the email address associated with your generation activity. Authorized agents may submit requests on your behalf with written permission.

09 Children’s Privacy

Our service is not directed to children under 13 (or under 16 where required by local law). We do not knowingly collect personal information from children. If you are a parent or guardian and believe that a child has submitted a generation request or otherwise provided personal information to us, please contact us immediately at [email protected]. We will take reasonable steps to delete the information from our records.

Where the Children’s Online Privacy Protection Act (COPPA) applies, we do not condition a child’s participation in any activity on the disclosure of more personal information than is reasonably necessary, because we do not knowingly offer any activity to children[citation:3].

10 Security Measures

We implement reasonable technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit using HTTPS/TLS for all website and API communications.
• Access controls limiting employee and contractor access to generation records to those who need it for support or security purposes.
• Rate limiting and abuse detection to prevent automated extraction of data.
• Periodic review of retention schedules to ensure data is deleted when no longer necessary.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we continuously review and improve our safeguards. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals without undue delay.

11 Cookies and Local Storage

We do not use advertising cookies or cross-site tracking cookies. We use browser localStorage to remember your language preference (key: nexus-ai-lang). This data remains on your device and is not transmitted to our servers. You can clear it at any time through your browser settings.

If you use the optional Google Translate integration to view the site in another language, Google may set its own cookies and process data according to Google’s privacy policy. We do not control Google’s independent processing. The integration is loaded only after you actively select a non-English language.

12 Automated Decision-Making and AI Outputs

The generation service uses automated systems to produce images or videos from your prompt. These outputs are not used to make decisions that produce legal or similarly significant effects concerning you (such as credit, employment, or housing decisions). The generated content is delivered to you as a creative output and does not constitute a profile or assessment of you as an individual.

You should be aware that AI-generated outputs may be inaccurate, incomplete, or unexpectedly similar to existing works. You are responsible for reviewing outputs before use and for ensuring that your prompts and use of outputs comply with applicable law and third-party rights.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice (for example, a prominent notice on the website). Your continued use of the service after the effective date of a revised policy constitutes acceptance of the changes, to the extent permitted by law.

14 Contact and Complaints

If you have questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, please contact us first at [email protected]. We will do our best to resolve your concern promptly.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority. If you are a California resident, you may contact the California Privacy Protection Agency or the California Attorney General’s office regarding your CCPA/CPRA rights.