AI Website Chat — Privacy Policy
This policy covers NexusCaller's AI Website Chat (chat.nexuscaller.com; customers sign in at app.nexuscaller.com). It applies to two groups: our customers — businesses that use the chat on their websites — and visitors who chat on those websites. For visitors, the business that runs the website decides how their information is used (it is the "controller" or "business"); NexusCaller processes it on that business's behalf (as its "processor" or "service provider") under our Data Processing Agreement.
1. What we collect
| About | Data | Why |
|---|---|---|
| Customers | Name, email, business name, billing email; password stored only as a secure hash; sign-in and admin activity log; acceptance of these terms (time, version and IP address, kept as proof of the agreement) | To run and secure the account and send service emails |
| Customers | Subscription and plan. Payments are handled by Stripe — we never see or store card numbers. | Billing |
| Customers | The public pages of the website they submit, and the knowledge, instructions and settings they add | To build their assistant |
| Visitors | Chat messages, the page they chatted from, the time, and how and when they agreed to the chat notice | To answer them and let the business follow up |
| Visitors | Anything they choose to type, such as name, email or phone | Passed to the business as a lead |
| Visitors | A summary our AI makes of the chat: topic, intent, sentiment, whether a follow-up is needed, unanswered questions, a spam flag | To help the business prioritize and improve answers |
| Visitors | IP address, used briefly in memory to limit abuse; not stored with the conversation | Rate limiting and security |
The chat widget sets no cookies and does not track visitors across pages or websites. We do not sell or share personal data for advertising, and we do not use conversations to train AI models; our AI providers' paid API terms exclude training on this data.
We do not respond to browser Do Not Track signals, and we do not allow third parties to track you across websites through our service.
2. AI transparency
Before visitors write, every chat shows a fixed notice that businesses cannot remove: "You're chatting with an AI assistant. Chats are recorded and processed by NexusCaller and its AI providers for [Business]. By continuing, you agree to the Privacy Policy." [Business] is the name of the business running the website, and "Privacy Policy" links to that business's privacy policy or, if it has not provided one, to a chat privacy notice we host for it. This is how we meet AI transparency requirements, including the EU AI Act's obligation to inform people that they are interacting with an AI system, and how visitors are told that chats are recorded.
3. Service providers (sub-processors)
| Provider | What it does | Location |
|---|---|---|
| Railway | Hosts the application and database | United States |
| Google (Gemini API) | Generates chat replies (primary AI) | United States |
| Anthropic (Claude API) | Generates chat replies (backup AI) | United States |
| OpenAI | Generates chat replies (backup AI) | United States |
| Stripe | Customer payments | United States |
| Resend | Service, invitation and alert emails | United States |
Each processes data only to provide its part of the Service, under contract. We give customers at least 30 days' notice before adding a new sub-processor.
4. How long we keep data
| Data | How long we keep it |
|---|---|
| Chats (conversations), leads and AI summaries of chats | 12 months after the chat, then deleted automatically — or earlier if the business deletes them |
| Visitors' IP addresses | Not stored; held briefly in memory for rate limiting |
| Customer account data: account details, assistants, knowledge, instructions and settings | While the account is open, and for 30 days after it closes |
| Sign-in and audit logs; records of acceptance of our terms | 6 years after the account closes, as proof of the agreement and for security |
| Billing records | As tax law requires — typically 7 years — at Stripe and with us |
When a customer closes their account, we delete their assistants, knowledge and conversations within 30 days. Our providers may keep limited logs (e.g. abuse monitoring, email delivery) for up to 30 days under their own terms.
5. Security
Encrypted connections (HTTPS); hashed passwords; two-step sign-in for administrator access; each customer can see only its own data; an audit log of administrative actions; AI provider keys stored encrypted; and protections against misuse of the website reader.
6. Your rights
Visitors: to see, correct or delete what you shared in a chat, contact the business whose website you chatted on. You can also email info@nexuscaller.com; we will pass your request to that business and help it respond. Businesses can find and delete everything about a person in one step.
Customers: you can export or delete your data from your account at app.nexuscaller.com, or email us.
7. European Union and EEA (GDPR)
For visitors, the business running the website is the controller and determines the legal basis (typically its legitimate interest in answering enquiries, or steps taken at your request before a contract). For customers' account data, NexusCaller is the controller and relies on the performance of our contract and on our legitimate interest in securing the Service.
You have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. Data is processed in the United States; transfers rely on the European Commission's Standard Contractual Clauses (and, where our providers are certified, the EU–US Data Privacy Framework). You have the right to complain to a data protection supervisory authority, in particular in the EU or EEA country where you live, work or where you believe the infringement took place.
EU representative (GDPR Art. 27): [to be added — name, address, email]
8. California (CCPA/CPRA)
For visitors, NexusCaller acts as a service provider to the business: we process personal information only to provide the Service, and do not sell or share it or use it for our own purposes. For customers' account data, NexusCaller is the business responsible for it.
California residents have the right to know what personal information is collected about them and how it is used and disclosed, to access it, to correct it if it is inaccurate and to have it deleted, and to use an authorized agent to make a request for them. We verify requests by matching the email address or phone number used with the Service; we may ask an authorized agent for proof of your permission. We have not sold or shared personal information (as the CCPA defines those terms) in the past 12 months. We use sign-in credentials only to provide the Service. We will not discriminate against anyone for exercising these rights. Visitors can send requests to the business whose website they chatted on, or to info@nexuscaller.com; customers can email us there.
9. Children
The Service is for businesses and is not directed at children. Please do not share personal information in a chat if you are under 16.
10. Changes and contact
We will post changes here and notify customers at least 30 days before material changes. Questions: NexusCaller LLC · info@nexuscaller.com.