Privacy Policy

This policy explains how Nexward LLC ("Nexward", "we") handles information when you visit nexward.ai, use the Nexward dashboard at app.nexward.ai, or send requests to the Nexward API at api.nexward.ai (together, the "Service").

1. Our two roles

• Account and billing information (your sign-in email, organization membership, how you use the dashboard, and, for paid plans, your subscription and billing details): we decide how it is used, as described below.
• Customer data (the AI agent actions your systems send to Nexward for a decision, and what the Service stores about them): we process it on behalf of the customer organization that sent it, to provide the Service. If you are an end user of one of our customers, please contact that customer about their data.

2. What we collect

Account information

• Your email address and password. Passwords are handled by our authentication provider and stored only in hashed form.
• Organizations you create or belong to, your role, and the applications, agents, tools, and policies you configure.
• An audit record of security-relevant and administrative actions (for example, publishing a policy, creating or revoking an API key, or approving an action), including which account performed them.

Billing information

If your organization subscribes to a paid plan, we store its plan, subscription status, billing period, the identifiers our payment providers assign to it, any monthly spending limit an owner sets, and counts of protected actions per month, application, and agent (and per hour, for usage beyond the allowance). Payment card and bank details are entered on pages hosted by Stripe and never reach Nexward. Stripe receives your organization's name, the subscribing owner's email address, the billing details you enter there (such as billing address and tax ID), and your payment method. Our usage-billing provider, Metronome, receives your organization's identifier and name, its Stripe customer identifier, and hourly counts of protected actions beyond your allowance. Neither receives agent, tool, or argument data.

Customer data sent through the API

When your systems ask Nexward whether an AI agent action may run, the request contains the agent, the tool, the tool's arguments, and optional context. We designed the Service to store as little of this as possible:

• We store the agent and tool names, the structure of the arguments (field names and types), a keyed fingerprint of the request, and the decision with its reasons.
• We store argument values only for fields your own policy rules refer to. Before storage, recognizable secrets (such as API keys, tokens, private keys, and card numbers) are replaced with a redaction marker, email addresses and phone numbers are partially masked, and long values are truncated.
• When an action requires human approval, the values of the fields your approval rule names (for example, an email recipient and subject) are stored with the approval request so your approvers can see what the action will do. Secrets are still redacted.
• From optional context we keep only a channel name and an end-user reference you choose; we ask customers to send opaque references, not names or email addresses.
• The API has no field for prompts or model conversations, and we do not ask for them.

Technical and usage information

• IP addresses of API callers are used to protect against brute-force attempts. They are held in a rate-limiting store for a few minutes and then expire. Our hosting providers also record request logs for operations and security.
• Product usage events from the dashboard (for example, "signed in" or "policy published", and which dashboard page was opened) are recorded with random account and organization identifiers. They never include your email, names, page contents, or agent data, and we discard IP addresses for these events. We do not use advertising or third-party tracking scripts.
• Error reports contain technical details of a failure (error type, a message with secrets removed, code locations, and the affected route). They never include request contents, headers, cookies, or IP addresses.

Website

nexward.ai does not use cookies, analytics, or tracking scripts. If you email us, we receive your email address and message.

Cookies in the dashboard

The dashboard uses only strictly necessary cookies: a sign-in session cookie and a cookie that remembers which of your organizations you selected. We do not use advertising or analytics cookies.

3. How we use information

• To provide the Service: evaluate actions, enforce your policies, route approvals, create incidents, and send the notification emails you rely on (for example, approval requests and new incidents).
• To bill for paid plans: calculate usage, charge subscription and usage fees, send usage and billing emails, and keep accounting records.
• To secure the Service: authenticate requests, limit abuse, keep audit records, and investigate incidents.
• To operate and improve the Service: fix errors and understand which features are used, using the minimized usage and error data described above.
• To communicate with you about your account and the Service.

We do not sell personal information, we do not use it for advertising, and we do not use customer data to train AI models.

4. Nexward Advisory (AI incident analysis)

AI incident analysis is off by default and is enabled per organization by an owner or admin. When it is enabled, details of new high-severity incidents (the agent and tool names, reason codes, and the already minimized evidence described in section 2, with secrets redacted) are sent to our AI provider, Anthropic, to produce an advisory analysis. The analysis is informational: it never approves an action or changes a decision. Under Anthropic's commercial terms, inputs and outputs are not used to train its models.

5. Service providers

We use the following providers to run the Service. Each processes information only to provide its service to us.

Stripe also processes payment information under its own privacy policy, for example to prevent fraud and meet its legal obligations.

We may also disclose information if required by law, to protect the rights and safety of our users or the Service, or as part of a merger, acquisition, or sale of assets, in which case this policy would continue to apply.

6. How long we keep information

Data is deleted automatically on this schedule. Audit records are kept for at least one year. Information in backups is removed when those backups expire.

7. Security

We encrypt information in transit, keep each customer organization's data separated with database-level access controls, store API keys only as keyed hashes, limit internal access, and record administrative and security actions in audit logs. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you as required by law.

8. Your choices and rights

You can update your organization's configuration in the dashboard at any time. To access, correct, export, or delete your account information, or to delete an organization and its data, email us at privacy@nexward.ai. We will respond within 30 days. Depending on where you live, you may have additional rights under local law (for example, to object to or restrict certain processing); we will honor them as required. If you delete your organization, we keep its billing records for the period in section 6 where the law requires it.

9. Where information is processed

The Service and our providers process information in the United States. If you use the Service from elsewhere, your information will be transferred to the United States.

10. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

11. Changes

We will post any changes on this page and update the effective date. If a change materially affects how we use your information, we will notify account owners by email before it takes effect.

12. Contact

Nexward LLC, 149 Nims Spring Drive, Fort Mill, SC 29715, United States. Email: privacy@nexward.ai.