This policy explains how Nexpod [legal entity name] ("Nexpod", "we") handles personal data when you visit nexpod.ai, use the console, call the API or nexctl, or talk to our sales and support teams.
We have tried to write it the way we would want it explained to us: short sections, a one-line summary at the top of each, and the detail underneath.
Who we are
In shortNexpod decides how account and billing data is used, so we are its controller.
Nexpod [legal entity name], registered at [registered address] under company number [number], is the controller for the data described here. Questions go to privacy@nexpod.ai (placeholder address).
What this policy covers
In shortOur website, console, API and conversations with us. Not the data you run on your servers.
It covers the data we collect to give you an account, run and bill your resources, and answer your questions. It does not cover the files, models or datasets you place on Nexpod servers and volumes. For that data you are the controller and we act as your processor, under the data processing agreement that forms part of the Terms of Service.
Data we hold
In shortAccount, billing, usage, support and website data. Card numbers never reach us.
- Account
- ExamplesName, work email, company, team roles
- Where it comes fromYou, when you sign up or are invited
- Billing
- ExamplesBilling address, VAT number, payment reference
- Where it comes fromYou and our payment provider
- Usage
- ExamplesResource ids, region, seconds billed, API request logs
- Where it comes fromOur systems, while you use them
- Support
- ExamplesMessages, attachments, call notes
- Where it comes fromYou, when you contact us
- Website
- ExamplesPages viewed, device type, consent choices
- Where it comes fromYour browser, see the Cookie Policy
Card details are entered on the payment provider's page and stay there. We only receive a token and the last four digits.
Why we use it
In shortTo run the service, bill you, keep it secure, and, if you agree, send you product news.
- Running your account and resources, because the contract with you requires it.
- Invoicing and tax records, because the contract and tax law require it.
- Security and abuse prevention, based on our legitimate interest in a safe platform.
- Product email and the newsletter, only with your consent, which you can withdraw at any time.
- Improving Nexpod, using aggregated usage that does not identify you.
Data on your servers
In shortWe do not look inside your servers or volumes.
We do not inspect the contents of memory, disks or volumes attached to your resources. Staff access them only when you ask us to in writing for a support case, or when a court order leaves no choice. Every such access is logged and we tell you about it unless the law forbids it.
Where it is stored
In shortIn the EU. US data only exists if you use the US region.
Account, billing and usage data is stored in our EU regions. If you run resources in US-NYC-1, the usage data for those resources is also processed there. Any transfer out of the EU relies on the European Commission's standard contractual clauses.
How long we keep it
In shortAs long as your account lives, plus what tax law asks for invoices.
- Account data
- Kept forLife of the account, then 30 days
- Invoices and payment records
- Kept for7 years [placeholder, depends on jurisdiction]
- API and access logs
- Kept for90 days
- Support conversations
- Kept for2 years after the case closes
Your rights
In shortSee, correct, export or delete your data, and object to how we use it.
You can ask for a copy of your data, have it corrected or deleted, receive it in a machine-readable format, object to processing based on legitimate interest, and withdraw consent. Email privacy@nexpod.ai and we answer within one month. You can also complain to the data protection authority where you live or work.
Security
In shortEncrypted in transit and at rest, with logged staff access.
Traffic to the console and API uses TLS. Stored data is encrypted at rest. Staff get access on a need-to-know basis, through single sign-on with hardware keys, and every access is recorded.
Changes to this policy
In shortWe email you 30 days before a material change takes effect.
Small fixes, such as a new sub-processor of the same kind or clearer wording, are published here with a new date. For anything that changes what we collect or why, we email account owners at least 30 days ahead.
Contact
In shortOne address for every privacy question.
Write to privacy@nexpod.ai or to [postal address]. For anything else, the contact page lists sales and support.