Privacy Policy
Last updated: 2026-05-15
1. Information We Collect
Account data you provide directly: · Email address (required, used for account identity and receipts) · Username, optional display name · Hashed password (bcrypt; we never store the plaintext) · Payment metadata: transaction ID, last 4 digits of card, billing country (full card numbers are never stored) · Referral / coupon code (if entered) Usage data we collect automatically: · Skill executions, Nex consumption, API request counts · Request IP address, User-Agent, request latency (logged for security & capacity planning) · Login timestamps and session identifiers We do NOT collect data processed by Skills running locally via Nexus Runner. All input files, intermediate results, and outputs stay on your device.
2. How We Use Your Information
We use your information to: · Provide and maintain the Platform and your account · Process payments, issue invoices, manage subscriptions · Send transactional emails (order confirmation, password reset, security alerts) · Investigate and prevent fraud, abuse, or violations of our Terms · Aggregate anonymized statistics for product improvement We do NOT use your data for advertising or sell it to data brokers.
3. Data Storage & Security
· Account data is stored in Aliyun RDS (Shanghai region) with AES-256 encryption at rest and TLS 1.3 in transit. · Skill packages (.ocskill) are encrypted with AES-256-GCM and only decryptable by licensed Nexus Runner instances. · User API keys use sk_live_ prefix plus a random suffix (256-bit entropy); only the SHA-256 hash is persisted, raw key shown once at creation. · Runner activation uses short-lived (60-second) Ed25519-signed tokens embedding the current plan, quota, and allowed Skills. · Access to production databases is restricted to two senior engineers; all access is logged.
4. Data Retention
· Active account data: retained while your account is active. · Transaction records: retained for 7 years (required by Chinese tax law). · Server logs (IP, User-Agent, request metadata): 90 days, then deleted. · Backups: encrypted snapshots retained for 30 days then rotated out. · Deleted accounts: account data is anonymized within 30 days of deletion request; transaction records are retained as above per legal obligation. · Locally-processed data via Nexus Runner is never retained by us; deletion is solely under your control.
5. Data Sharing
We do not sell your personal information. We share necessary data only with: · Payment processors — to settle and reconcile transactions · Cloud LLM providers — to power cloud-Skill inference (only the input you submit to that specific Skill is sent) · Email delivery provider — to send transactional emails · Law enforcement — only when legally compelled A full processor table is provided in section 6.
6. Sub-processors
We rely on the following third-party processors. Each is bound by a data processing agreement (DPA) and is responsible for the security of data processed on our behalf within their scope.
| Processor | Purpose | Data Categories | Data Location |
|---|---|---|---|
| Airwallex | Card / multi-currency acquiring & settlement | Name, email, card BIN, transaction amount | Hong Kong / Global |
| PayPal | PayPal payment processing | PayPal account email, transaction amount | Singapore / USA |
| Alipay | Alipay payment processing (China users) | Alipay open ID, transaction amount | China |
| WeChat Pay | WeChat Pay processing (China users) | WeChat OpenID, transaction amount | China |
| Aliyun (DB) | Database hosting (account & transaction records) | All account and transaction data | Shanghai, China |
| DeepSeek | Cloud-Skill LLM inference | Skill input prompts and parameters submitted by user | China |
| MiniMax | Cloud-Skill LLM inference (reasoning/code) | Skill input prompts and parameters submitted by user | China |
| Qwen (Alibaba) | Cloud-Skill LLM inference (Alibaba models) | Skill input prompts and parameters submitted by user | China |
| Exmail (Tencent) | Transactional email delivery | Email address, recipient name, email content | China |
7. Cookies & Local Storage
We use first-party localStorage for authentication tokens, locale preference, and UI state. We do NOT use third-party tracking cookies, advertising cookies, or behavioural analytics SDKs. Essential cookies are used solely for session management.
8. Your Rights
Regardless of residency, you have the right to: · Access — request a copy of personal data we hold about you · Correct — update inaccurate information · Delete — request account deletion (subject to legal retention requirements above) · Export — receive your data in a portable JSON format · Object / Restrict — limit how we process your data · Withdraw consent — for any processing based on consent · File a complaint — with your local data protection authority (e.g. for EU residents: your national DPA) To exercise these rights, contact us via our WeChat service account (mcp_nexus) with your registered account. We respond within 30 days.
9. International Data Transfers
Our primary servers are in Shanghai, China. When you use our services from outside China, your data is transferred internationally to our infrastructure. International payment processors (Airwallex, PayPal) may further transfer data to their global operating regions. We rely on standard contractual clauses (SCCs) or equivalent legal mechanisms for cross-border transfers.
10. Children's Privacy
MCP Nexus is not intended for users under 16 years of age (under 13 in the United States). We do not knowingly collect personal information from children. If you believe a child has submitted data to us, please contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy. Material changes will be announced at least 30 days in advance via email and an in-product banner. The "Last updated" date at the top reflects the latest revision.
12. Contact Us
For privacy inquiries (including data subject requests), contact us via our WeChat service account (mcp_nexus).