Privacy Policy

We collect information you provide directly to us, including:

• Account Information: Name, email address, password, and profile information
• User Content: Memories, notes, conversations, and other content you create or store
• Payment Information: Billing address and payment method details (processed by third-party payment processors)
• Communications: Messages you send to us, feedback, and support requests

When you use the Service, we automatically collect certain information:

• Usage Data: Feature usage, interaction patterns, and session information
• Device Information: Device type, operating system, browser type, and IP address
• Log Data: Access times, pages viewed, and actions taken
• Cookies and Similar Technologies: We use cookies to maintain your session and preferences
• Session Recording (public website only): On our public website we record how visitors move through the page — clicks, scrolling, and mouse movement — using PostHog, so we can see where the site is confusing. Anything you type into a form is masked in your browser before it is sent, so we never receive it. Recording stops at sign-in: nothing inside your account is ever recorded, including your memories — the recorder is not loaded on the application at all. Recordings are stored in the European Union (Frankfurt), kept for 30 days, and are never sold or shared. Recording starts only if you accept cookies, and does not start at all if your browser sends a Do Not Track or Global Privacy Control signal.
• Error Diagnostics: When something breaks in the application, we send a diagnostic report to our error-monitoring provider (Sentry) so we can fix it. These reports contain the error and the code path that produced it. They deliberately exclude your memory content, request and response bodies, cookies, and URL query strings, and identify you only by your account ID — never your name, email, or IP address.
• Recall Audit Log: Every time the Service retrieves memories for you, we write one record describing what was returned, so that a report of the wrong memory being shown can actually be investigated rather than guessed at. Each record contains a request ID, a timestamp, your account and workspace IDs, an identifier for the access key used, the IDs of the memories returned, and — for each one — the rule that permitted it, plus result counts and timing. It deliberately excludes the text of your query, which is kept only as an irreversible keyed hash so that repeated queries can be recognized without retaining the words; the content or summaries of your memories; and your name, email address, or the contents of your saved facts. Each recall response includes its request ID, so you can quote one to us and we can look up exactly that request. We keep these records for 13 months and use them only to investigate access-correctness and security concerns.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your transactions and manage your account
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues and security threats
• Personalize your experience and provide relevant content
• Develop new features and services
• Comply with legal obligations

• Members of Your Team Workspace: If you belong to a team workspace, memories you mark team-visible are readable by the other members of that workspace. Memories marked private are not. See section 7
• Service Providers: We share information with third-party vendors who perform services on our behalf (e.g., hosting, analytics, payment processing)
• Legal Requirements: We may disclose information if required by law or in response to legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred
• With Your Consent: We may share information with your explicit consent
• Aggregated Data: We may share anonymized, aggregated data that does not identify you

• Encryption for data in transit (TLS) and at rest
• Access controls and authentication mechanisms
• Hosting on secure cloud infrastructure (AWS) with physical and network security
• Per-account data isolation across every storage system, enforced on the server. Memories are readable only by you, and — where you have marked them team-visible — by the members of your team workspace

However, no system is 100% secure. We cannot guarantee the absolute security of your information.

Nexus-Catalyst supports team workspaces. Who controls a given memory — and therefore who can decide to delete it — depends on how that memory was stored. There are two regimes, and they are stated separately here because the difference matters:

• Personal memories. Memories marked private, and every memory stored on an individual (Free or Pro) account, are yours. Nexus-Catalyst is the data controller for them. You can delete them at any time, and an erasure request removes them everywhere we hold them.
• Team-visible memories. If you belong to a team workspace and your seat is paid for by that organization, memories you mark team-visible become records of that organization. The organization is the data controller for them and Nexus-Catalyst acts as its processor, under a data processing agreement. Those memories stay with the workspace if you leave it or delete your Nexus-Catalyst account.

Which regime applies is fixed at the moment a memory is stored — by its visibility and the workspace you stored it under — and is never reassigned afterwards. Memories you created before joining a workspace remain personal.

If you ask us to erase your data and you are a member of a team workspace, we delete your account, your profile, and your personal memories, and we forward the request for your team-visible memories to that workspace's administrator, who decides. We will tell you that we have done so. You may also exercise your rights directly with the organization, which is the controller for those records; we assist them in responding.

Leaving a workspace, or being removed from one, ends your access to that workspace's memories. It does not delete them.

Depending on your location, you may have the following rights:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your information. For memories held by a team workspace, the request goes to that organization — see section 7
• Portability: Request a copy of your information in a portable format
• Opt-Out: Opt out of marketing communications
• Restriction: Request restriction of processing of your information
• Objection: Object to certain processing activities

To exercise these rights, please contact us at privacy@nexus-catalyst.com. We will respond to your request within 30 days.

• Right to know what personal information we collect and how we use it
• Right to delete your personal information
• Right to opt out of the sale of personal information (we do not sell your information)
• Right to non-discrimination for exercising your privacy rights

• Contract: To provide the Service you requested
• Legitimate Interests: To improve and secure our Service
• Consent: When you provide explicit consent
• Legal Obligation: To comply with applicable laws

Controller and processor. Nexus-Catalyst is the controller for your account information and your personal memories. For memories stored as team-visible under a team workspace, the organization that pays for your seat is the controller and Nexus-Catalyst is its processor, acting on that organization's documented instructions under a data processing agreement. Section 7 sets out what that means in practice.

You have the right to lodge a complaint with your local data protection authority.