Privacy Policy

Account info: your name, email, and password (stored only as a salted hash).

Scan data: when you scan a site we look at publicly available information only: DNS records, domain registration (RDAP/WHOIS), certificate transparency logs, and your site's public pages. We never try to log in, open private or admin areas, or intentionally change anything during a scan.

Credentials you choose to give us: logins you paste into the secure intake (hosting, registrar, and similar) are encrypted immediately with envelope encryption (AES-256-GCM). We store encrypted ciphertext, the encryption metadata needed to unlock it, and the label or optional username hint you enter. We do not store the secret itself in plain text. The NexusBuild service can decrypt a saved migration credential only to perform an approved connection, migration, or support action. Migration use and any staff plaintext access require active ownership and signed authorization and are written to the account audit log. Customer account roles cannot reveal a saved secret in plain text.

Connections you approve: instead of a password, you can connect your site by approving us on your own provider. When you connect WordPress, your site issues us a revocable “application password” (you approve it in your own wp-admin, and can revoke it anytime from your WordPress profile); we store it encrypted like any other credential and use it only to migrate or edit your site. When you point your domain to us with one click, that approval happens at the company that manages your web address: we never receive that account's login. During a migration, our optional WordPress plugin packages your files and database for the one-time transfer, then can be removed.

Your website content: if we migrate and host your site, we store its files and database, plus backups and version snapshots so you can roll back changes.

Billing: payments run through Stripe. We never see or store your card number; we keep only your plan, Stripe customer id, and subscription status.

To run the service you asked for: producing your reports, answering your questions in the chat, migrating and hosting your site, preparing the AI change drafts you request, sending you transactional email (welcome, password reset, migration updates), and billing. We don't sell your data, run ads, or use your website content to train AI models.

We use a small set of processors to run NexusBuild:

Amazon Web Services (servers, database, encrypted storage, email delivery), Stripe (payments), and Anthropic (the AI that writes your reports, answers chat, and plans your edits; it sees your site's public info and the page content needed for an edit, never your stored passwords).

We share data with no one else, unless the law requires it.

Account and site data: as long as your account is open. Nightly site backups: 30 days. Version snapshots: the most recent 25 per site. Audit logs: kept while your account exists, because they're your record of every credential access. Close your account and we delete stored credentials and site data within 30 days (backups age out on their own schedule).

Passwords are hashed (scrypt). Credentials use envelope encryption with per-secret data keys. Access to customer credentials is consent-gated and audited. Hosted sites get automatic HTTPS. Our infrastructure runs in a private network with least-privilege access between systems.

You can request a free website export (files and database) anytime. You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Email privacy@nexusbuild.ai and we'll handle it within 30 days.

If this policy changes in a way that matters, we'll email you before it takes effect. Questions? privacy@nexusbuild.ai.