Privacy

Effective date: October 25, 2026. Version: 1.0.

This policy explains how Nexus402 (Nexus402, we, us) collects, uses and shares personal data when you use the Nexus402 website, console, API gateway and related services (the Services). It applies to developers, creators and visitors.

1. Who is responsible

Nexus402, Kathmandu, Nepal, is the controller of the personal data described in sections 2 to 4 and 6 to 9. For the content of tool calls that pass through our gateway we act as a processor for the developer who sends it, as explained in section 5. Contact: privacy@nexus402.dev. Nexus402 is operated from Nepal and has not appointed an EU representative. Write to privacy@nexus402.dev. Nexus402 is operated from Nepal and has not appointed a UK representative. Write to privacy@nexus402.dev.

2. What we collect

Account data. When you sign in with Google, GitHub or Apple we receive your email address, whether the provider has verified it, and a provider-issued account identifier. We also read a display name or username from some providers during sign-in, but we do not store it. We store your role (developer, creator or both), account status and timestamps. If you claim a creator handle we store the handle.

Billing and payout data. When you buy Credits, Stripe collects your card details and billing information. We never receive or store your full card number. We receive from Stripe the payment amount, currency, status, payment method type, a charge identifier and the wallet identifier we attached to the session. When you set up payouts, Stripe collects your identity, bank and tax information. We send Stripe the country you tell us, your creator identifier and, where used, your email. We store the Stripe connected account identifier and status flags (for example whether payouts are enabled). We store the two-letter country of your payout account. We store withdrawal requests (handle, amount, status and identifiers) and the ledger entries that record Credits and earnings. Ledger entries identify wallets and creators by internal identifiers, not by name or email.

Service and security data. For each paid call we record the API key identifier, wallet identifier, tool name and version, price, status, timestamps, a correlation identifier and a one-way hash of the request for integrity and de-duplication. We keep operational logs and traces with the same kinds of fields. We use IP addresses and request counts to enforce rate limits and detect abuse. We email one-time codes (for confirming a payout destination or closing your account) and store only a hash of each code, which expires after a short time.

Communications. If you write to us we keep the correspondence.

Cookies and similar technologies. See the Cookie Notice.

What we do not collect. We do not collect card numbers. We do not store your sign-in display name. We do not use advertising or analytics trackers.

3. Content of tool calls

When a developer calls a tool, the request passes through our gateway in memory so that we can authenticate it, apply the price and caps, and forward it. The gateway reads the protocol envelope (the method and tool name), computes a one-way hash of the request, and forwards the full request, including arguments and the headers the developer chooses to send, to the endpoint operated by the tool's creator. The creator's response streams back to the developer. Our systems are designed not to log or store request or response bodies. Billing event records contain metadata only. This demo site does not attest that those controls are in force.

Creators are not our processors. A creator receives the content because the developer chose that tool. Creators are bound by the Creator Data Terms in the Creator Agreement but are responsible for their own handling. Do not send personal data or secrets to a tool unless you trust it and have a lawful basis. We do not send your email address or account identifiers to creators.

4. Why we use data and our legal bases

Where Nepal's Individual Privacy Act 2018 applies, we rely on your consent, which you give when you accept these terms and this policy, including for transfers outside Nepal.

We make some automated decisions to protect the Services, such as refusing a call that exceeds a cap, blocking activity from sanctioned places or declining payments flagged by our payment processor. Contact us to ask for review.

5. Our roles

For account, billing and security data we are the controller. For the content of tool calls that a developer sends, the developer decides why and how it is processed and we transmit it on the developer's instructions, so we act as the developer's processor under the Data Processing Addendum.

6. Who we share data with

Service providers (processors), listed at https://www.nexus402.dev/subprocessors, including Stripe (payments and payouts), Google, GitHub and Apple (sign-in), our email delivery provider, and our cloud hosting, queue, storage, database and monitoring providers. Creators, as described in section 3. Professional advisers, auditors and insurers under confidentiality. Authorities, courts and counterparties where the law requires or to protect rights, safety and the Services. A buyer or successor if our business is sold or reorganised. We do not sell personal data and we do not share it for cross-context behavioural advertising.

7. International transfers

We are based in Nepal and our providers may process data in the United States and other countries. Where we transfer personal data from the European Economic Area, United Kingdom or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) and supplementary measures. We do not rely only on the EU-US Data Privacy Framework. Our infrastructure is located in Amazon Web Services in the United States (us-east-1). You may request a copy of the safeguards at privacy@nexus402.dev.

8. Retention

Because financial records must be kept, we cannot always delete everything on request. We minimise the identifiers they hold.

9. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, and complain to a regulator. To exercise a right email privacy@nexus402.dev from the address on your account. We may ask for verification. We respond within one month (45 days for California, extendable as the law allows). We do not charge unless requests are manifestly excessive. If you are in the EU or UK you may complain to your supervisory authority. You will not be treated differently for exercising a right.

10. California and other US states

In the last 12 months we collected identifiers (email, account and key identifiers, IP address), commercial information (purchases, balances, earnings), internet activity (call metadata, logs), and, for creators, payout status through Stripe. We collect it from you, your sign-in provider and Stripe, for the purposes in section 4, and disclose it to the recipients in section 6. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use or disclose sensitive personal information beyond what is needed to provide the Services. We do not knowingly collect data of anyone under 16. You may use an authorised agent to submit requests. We do not respond to Do Not Track signals because we do not track you across sites.

11. Security

We use measures appropriate to the risk, including hashing of API keys with argon2id and a secret pepper, key-management-protected request signing, rate limiting, spend caps, access controls and an append-only financial ledger. No system is perfectly secure. Report vulnerabilities as described in the Security page.

12. Children

The Services are for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has used the Services, contact us and we will delete the data.

13. Changes and contact

We will post changes here and, for material changes, notify you by email at least 30 days before they take effect. Questions and requests: privacy@nexus402.dev, phone +977 9765009885 / +977 9806763754, Nexus402, Kathmandu, Nepal.

Effective date: October 25, 2026. Version: 1.0.

We use only the cookies and local storage needed to run the Services. We do not use advertising cookies, cross-site tracking or analytics trackers.

Strictly necessary cookies do not need consent under EU and UK rules. Because we set no other cookies we do not show a consent banner. If we add any non-essential cookie we will first ask for consent and update this notice. You can block cookies in your browser, but you will not be able to sign in. Sign-in providers (Google, GitHub, Apple) and Stripe set their own cookies on their own pages under their own policies.

Contact privacy@nexus402.dev with questions.

Effective date: October 25, 2026. Version: 1.0.

This addendum forms part of the Terms of Service between Nexus402 (Nexus402, the Processor) and the developer (the Customer). It applies where Nexus402 processes personal data on the Customer's behalf subject to the GDPR, the UK GDPR, the Swiss FADP or another data protection law that requires a processing contract. It takes effect when the Customer accepts the Terms of Service.

1. Definitions

Customer Data means personal data contained in requests and responses that the Customer sends through the gateway to a tool. Applicable Law means data protection law that applies to the processing. Tool Provider means a creator whose tool the Customer chooses to call. Controller, Processor, personal data, personal data breach, processing and supervisory authority have the meanings in the GDPR.

2. Scope and roles

The Customer is the controller (or processor for its own customer) of Customer Data. Nexus402 is a processor. Nexus402 is an independent controller of account, billing, security and usage data, which the Privacy Policy covers and this addendum does not. Tool Providers are not Nexus402's subprocessors. The Customer selects each tool and instructs Nexus402 to transmit Customer Data to it. The Tool Provider is responsible for its own processing, either as an independent controller or as the Customer's processor, and the Customer is responsible for having a suitable agreement with it. Nexus402 requires Tool Providers to follow the Creator Data Terms but does not control them.

3. Details of processing

Subject matter and duration: transmission of Customer Data through the gateway for as long as the Customer uses the Services. Nature and purpose: receiving requests in memory, authenticating, metering and forwarding them to the tool endpoint, and streaming back responses; computing a one-way hash for integrity. Types of data and data subjects: whatever the Customer chooses to send, which may include personal data of the Customer's users and others. Customer must not send special-category data or criminal-offence data unless the tool is designed for it and the Customer has a lawful basis. Nexus402 does not store request or response bodies as part of normal operation.

4. Nexus402 obligations

Nexus402 will: process Customer Data only on the Customer's documented instructions, which are these Terms and the Customer's use of the Services, unless law requires otherwise (in which case it will inform the Customer unless forbidden); ensure persons authorised to process are bound by confidentiality; implement the measures in Annex A; assist the Customer, taking into account the nature of processing, with data subject requests, security, breach notification, impact assessments and prior consultation, at the Customer's cost where the assistance is more than reasonable; notify the Customer without undue delay and within 72 hours after becoming aware of a personal data breach affecting Customer Data; delete Customer Data in its possession on termination (it is not retained after a call completes except in transient infrastructure queues and logs for the short periods in the Privacy Policy), except where law requires retention; make available information needed to show compliance and allow audits as in section 7; and tell the Customer if it believes an instruction infringes Applicable Law.

5. Customer obligations

The Customer is responsible for the lawfulness of the processing instructions, for having a lawful basis and giving notices, for choosing tools it trusts, for not sending secrets or unnecessary personal data, and for complying with its own obligations.

6. Subprocessors

The Customer gives general authorisation for Nexus402 to use the subprocessors listed at https://www.nexus402.dev/subprocessors. Nexus402 will bind each by a written contract with equivalent data protection obligations and remains liable for them. Nexus402 will give at least 30 days' notice of new or replacement subprocessors by email or on that page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may stop using the Services affected and close its account.

7. Audit

On request no more than once a year, and after reasonable notice, Nexus402 will provide documentation reasonably needed to demonstrate compliance, such as summaries of security controls and independent reports if any. If that is insufficient or a regulator requires it, the Customer may conduct an audit during business hours, under confidentiality, at its cost, with minimal disruption.

8. International transfers

Where Customer Data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated by reference with: clause 7 docking clause included; clause 9(a) option 2 (general authorisation, 30 days); clause 11 optional language omitted; clause 17 option 1 governed by the law of Ireland; clause 18 the courts of Ireland; Annex I as in section 3 of this addendum and the Processor's contact in the Privacy Policy; Annex II as Annex A below. For UK transfers the UK International Data Transfer Addendum applies in the same terms, and for Swiss transfers the clauses apply with references to the GDPR read as references to the FADP. If a transfer mechanism is invalidated, the parties will cooperate on a replacement. Nexus402 does not rely only on the EU-US Data Privacy Framework.

9. Liability and precedence

Liability under this addendum is subject to the limitations in the Terms of Service. If this addendum conflicts with the Standard Contractual Clauses, the clauses prevail.

Annex A: Technical and organisational measures

1. Access control: API keys are stored only as argon2id hashes with a secret pepper; sessions require federated sign-in; administrative console is reachable only from the loopback interface of the operations host and requires a long random token; sensitive account actions require an emailed one-time code.
2. Transport security: TLS for all external connections (terminated at the hosting provider's load balancer; TLS 1.2 or later).
3. Request integrity: each forwarded request is signed with an Ed25519 key whose private half is protected by a key management service.
4. Abuse and fraud controls: per-key rate limits, rolling spend caps enforced in the same atomic operation as billing, and authentication-attempt rate limiting.
5. Data minimisation: request and response bodies are not stored; logs use a field allow-list that redacts everything else; billing events carry metadata only.
6. Financial integrity: append-only double-entry ledger enforced by database triggers and restricted database privileges (not applied on this demo).
7. Segregation and least privilege: runtime database role without update or delete rights on the ledger.
8. Resilience: queue-based settlement with idempotent processing; backups (encrypted daily database backups, kept for 35 days).
9. Incident response: documented process, 72-hour customer notice for personal data breaches affecting Customer Data.
10. Personnel: confidentiality obligations; access limited to those who need it.