Privacy Notice

This Privacy Notice explains how Nace.AI, Inc. ("Nace", "we", "us", or "our") collects, uses, discloses, and otherwise processes personal information when you use the Nace.AI developer console at console.nace.ai (the "Console"), our APIs, CLI, SDKs, Model Context Protocol server ("MCP Server"), models, and documentation (together, the "Services"), or when you otherwise interact with us. It also explains the choices and rights you have.

Section 10 describes privacy rights that may be available to you depending on where you live. This Privacy Notice also applies when you visit our website at www.nace.ai. This Privacy Notice does not cover our practices relating to job applicants or employees, or information that is de-identified or publicly available.

1. Account Data and Customer Content

Nace processes two broad kinds of personal information in connection with the Services:

• Account and usage data. Information about you as a user of the Services, such as your name, email, billing details, and how you use the Services. Nace decides how this information is used, and this Privacy Notice applies to it in full.

• Customer Content. The documents, files, and other data you submit to the Services through any access method ("Inputs") and the results the Services return ("Outputs"). Inputs may contain personal information about other people, for example names and addresses on invoices or bank statements. When you or your organization submit Customer Content for business purposes, we process the personal information it contains on your organization's behalf as a "service provider," under our Terms of Service and any agreement we have with your organization, and your organization is responsible for its own privacy practices. If you are an individual whose information appears in a document that one of our customers submitted, please contact that customer with any privacy questions or requests.

The exception is any use of Customer Content for model development that you separately authorize, as described in Section 3, which we do under this Privacy Notice.

2. Personal Information We Collect

Information you provide to us

• Account information: name, email address, organization name, role, and team membership. We do not use passwords; you sign in with a one-time code sent to your email or through a supported third-party account.

• Sign-in information from third parties: if you sign in with a supported third-party provider (currently Google and GitHub), we do not receive your password for that service. Instead, we receive a token confirming that you signed in, along with your name, email address, profile picture, and account identifier, as permitted by your settings with that provider.

• Billing information: your payment processor customer identifier, transaction history, and links to receipts and invoices. Billing name and address, tax identifiers, and payment card details are collected and stored by our payment processor, Stripe. We can access these details through Stripe to provide billing and support, and we display limited card details (such as card type, last four digits, and expiration date), but we do not store payment card details in our own systems.

• Customer Content: Inputs and Outputs, including any personal information they contain.

• Communications: information you provide when you contact support, respond to surveys, join our community channels, or otherwise communicate with us.

Information we collect automatically

• API and usage data: API keys used (in partially masked form), endpoints and MCP tools called, request and response metadata (such as timestamps, file type, page count, latency, status and error codes), usage volumes, and credits consumed.

• Client and integration data: the access method used (Console, API, CLI, SDK, or MCP Server), the SDK, CLI, or MCP Server version, and, where it is sent to us, the name and version of the MCP Client or agent making the request (for example, an AI assistant or coding tool).

• Device and log data: IP address, browser type and version, operating system, device identifiers, referring URLs, and pages viewed in the Console.

• Approximate location: derived from your IP address, at the country or city level.

• Fraud-prevention data: a one-way hash of the email address you sign up with and, if you add a payment card, a one-way hash of the card fingerprint provided by Stripe. We use these only to prevent the same person or card from claiming the free sign-up credit more than once; they cannot be turned back into the email address or card number. We also record the IP address (or network) used to sign up, for the same purpose.

• Proof of acceptance: the date and version (identified by its publication date) of the Terms of Service, Privacy Notice and Data Processing Addendum you accepted.

• Cookies and similar technologies: see Section 8.

Our SDKs, CLI, and MCP Server send the data needed to process your requests, along with the client and version information above. They do not collect separate usage telemetry from your machine.

Information from other sources

• Analytics and security providers, which help us understand Console usage and detect fraud or abuse.

• Your organization, if an administrator invites you to a workspace or manages your Account.

• Publicly available or business sources, such as professional profile information, to verify customers or prevent fraud.

3. How We Use Personal Information

We use personal information to:

• Provide the Services, including creating and managing your Account, authenticating you, issuing API keys, processing Inputs and returning Outputs through the Console, API, CLI, SDKs, and MCP Server, and providing support.

• Bill you and manage your Account, including tracking usage, applying Free Tier limits and credits, processing payments, and preventing fraud.

• Secure the Services and prevent abuse, including monitoring for misuse (such as automated screening of Decision model requests from Standard accounts, described in Section 6), enforcing rate limits and our Terms of Service, investigating security incidents, and protecting our rights and the rights of others.

• Improve and develop the Services. We use operational metrics, such as request volumes, latency, and error rates, to understand performance and improve the Services. These metrics do not include the contents of your Inputs or Outputs. Use of Customer Content for model development or evaluation is governed by the separate authorization requirements below.

• Communicate with you, including service and security notices, changes to our terms, billing messages, and responses to your requests.

• Market our Services, such as product updates, newsletters, and event invitations. You can unsubscribe at any time using the link in our emails.

• Comply with legal obligations, such as tax, accounting, export control, and sanctions requirements, and to respond to lawful requests from authorities.

• Carry out corporate transactions, such as a merger, financing, or sale of assets.

Customer Content and model training

We do not use Customer Content to train, fine-tune, evaluate, or improve general-purpose or shared Models, or to create training or evaluation datasets, unless you separately and expressly authorize that use in writing (including through an opt-in control in the Console). This applies to free accounts, paid accounts, and playground use. We do not permit service providers processing Customer Content on our behalf to use it for their own model training or independent purposes. We may review specific Customer Content as necessary to troubleshoot requests you report to us or to provide support you request.

Any separately authorized use will specify the content covered, purposes, retention period, and withdrawal process. Customer-specific model development requested under a signed agreement with us is governed by that agreement.

We do not use Customer Content for advertising, and we do not sell Customer Content.

Sensitive information

Please do not submit sensitive personal information to the Services that is not needed for your purpose. Our Terms of Service prohibit submitting certain categories of data, such as health information subject to HIPAA, full payment card data, passwords and other credentials (other than storage-connection credentials and document passwords provided through the inputs we designate for them), biometric data, and personal information of children under 13, unless a separate agreement with us permits it. We ask that you redact information such as Social Security numbers, government ID numbers, and full bank account numbers when they are not needed. If we become aware that prohibited data has been submitted, we may delete it.

Automated decision-making

We do not use the Services to make decisions about you that produce legal or similarly significant effects based solely on automated processing. Our Decision models (such as Drex) produce recommendations for our customers; our customers are responsible for how they use them.

4. How We Disclose Personal Information

We disclose personal information only as described below:

• Service providers who process information on our behalf to host and operate the Services, including cloud hosting, storage, AI model processing (including backup processing if a primary model is unavailable), security, monitoring, internal operational alerts (Slack, which receives only internal identifiers and error codes, never Customer Content), customer support, email, analytics, and payment processing. They are contractually required to protect the information and use it only to provide services to us. A current list of our service providers that process Customer Content is available at trust.nace.ai/subprocessors.

• Your organization, if your Account belongs to an organization workspace. Administrators can see your Account details, usage, and Customer Content in that workspace.

• Third parties you direct us to share with, for example the MCP Client, AI agent, or other tool you connect to the Services.

• Professional advisors, such as lawyers, auditors, and accountants, where needed to protect our rights and comply with our obligations.

• Corporate transactions, such as a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to standard confidentiality protections.

• Legal and safety reasons, where we believe in good faith that disclosure is required by law or legal process, or necessary to protect the rights, property, or safety of Nace, our users, or others.

• Affiliates within our corporate group, for the purposes described in this Privacy Notice.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under California law.

5. Where We Process Information

Nace is based in the United States, and we and our service providers process and store personal information in the United States and other countries where our service providers operate. If you use the Services from outside the United States, your information will be transferred to, and processed in, the United States, where data protection laws may differ from, and be less protective than, those in your country. By using the Services, you acknowledge this transfer and processing.

6. Data Retention

We keep personal information only as long as necessary for the purposes described in this Privacy Notice:

• Account information: for as long as your Account is active. When you delete your Account, we remove direct identifiers, such as your name and email address, from most records at that time; remaining account records are kept for up to 24 months afterwards to handle questions, disputes, and legal obligations.

• Customer Content: in Standard mode, uploaded files, requests, results, workspace content and derived artifacts, saved schemas, drafts and runs are kept until you delete them or close the relevant Account or workspace, subject to any applicable signed agreement with us or legal deletion requirement. Content does not expire automatically because of its age, your plan or inactivity, and the expiry of a credit balance or download link does not delete it. Section 5.7 of our Terms of Service and our Data Processing Addendum explain deletion.

• Misuse-screening archive: for accounts in Standard mode, the text of Decision model requests (not images) is kept for 30 days in a separate archive, used only to screen for misuse of the Services with our own models. Some or all archived requests are screened, and text being screened may be held in our database for up to 1 hour. Archived requests are deleted after 30 days, or within 72 hours if you request deletion or close your Account, and are never used for training. Requests from zero-retention accounts are never archived or screened; requests archived before an account switched to zero retention are no longer screened and are deleted when their 30 days end.

• Zero retention: available for supported processing in workspaces connected to your Amazon S3 or Azure Blob Storage, where that option is available. For Decision model requests it applies without a workspace: we do not store the request content or results, and keep only usage metadata (model, token counts, timings and charges) as billing records. It limits the content Nace keeps: our temporary copies, including caches, are removed within 1 hour after results are delivered, as described in Section 5.7(g) of our Terms of Service, except that content entered in the Console's document workbench may remain in our encrypted database backups until they expire, within 35 days. It does not delete source files, results or processing objects in your own storage, whose lifecycle, access, versions and backups you control, and enabling it does not erase existing workspace files. Saved schemas and classification domains remain until deleted. Content-free records needed for billing, authorization and security remain as described below. If your organization's agreement with us requires zero retention, we enable it for your Account and it cannot be switched off in the Console.

• Inactivity: inactivity alone does not cause us to delete your Account or Customer Content.

• Deletion records: after you delete a file, we keep a deletion record (a protected one-way fingerprint of the file name, the file size and the page count, without any document content) for at least 7 years for billing, security, and dispute resolution. The fingerprint is pseudonymous: the file name cannot be read back from it, but it could be matched against a known file name by someone with access to our key.

• Fraud-prevention records: one-way hashes of the email address and the payment card used at sign-up (the card hash is based on a card fingerprint provided by Stripe), kept to prevent the same person or card from claiming the free sign-up credit more than once. These hashes cannot be turned back into the email address or card number and are kept for as long as needed for this purpose. The IP address (or network) used at sign-up is kept for 30 days for the same purpose.

• Proof of acceptance: a record that you accepted our Terms of Service, this Privacy Notice and our Data Processing Addendum (each document's version, identified by its publication date, and the date you accepted, together with how you were notified where we record it), kept as evidence of your consent for as long as needed for that purpose.

• API logs and usage metadata: kept with your user and API-key identifiers for up to 13 months for security, debugging, and billing. After that we remove those identifiers, but the records may stay linked to your Account or organization and to billing records where needed. This period does not limit how long Customer Content is stored: requests, results and error messages that contain content remain Customer Content until deleted.

• Billing records: for at least as long as tax and accounting laws require (typically 7 years after the Account is closed). After that, we keep them only in de-identified form (amounts and dates, with no information that identifies you).

• Separately authorized training or evaluation data: retained only for the period specified in the separate authorization. De-identifying Customer Content does not by itself authorize its retention for model development.

When retention periods end, we delete Customer Content. For account information and API logs and usage metadata, we delete the records or remove direct identifiers from them, such as names, email addresses, user and API-key identifiers, IP addresses and free text. The remaining content-free records (for example status and error codes, timestamps, page and token counts, amounts, and opaque account, organization and service identifiers) may stay linked to your Account or organization for billing, audit and security, so they are pseudonymous rather than anonymous. They never contain Customer Content. Deleted data may persist in backups we control for up to 35 days before being permanently removed; backups of your own customer-managed storage are under your control.

7. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls, logging, and regular security reviews. More information is available at trust.nace.ai. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password and API keys confidential, do not store them in shared code or agent configuration files, and rotate them if you suspect they have been compromised.

8. Cookies and Similar Technologies

We use cookies and similar technologies in the Console to:

• Keep you signed in and secure (strictly necessary cookies);

• Remember your preferences and settings, such as the layout of the Console (functional cookies and browser local storage);

• Attribute sign-ups, so we can credit referral rewards and understand which links or campaigns brought you to us (referral and sign-up attribution cookies, each kept for 30 days); and

• Understand how the Console is used so we can improve it (analytics cookies), using providers such as PostHog, Vercel Web Analytics, and Vercel Speed Insights. We also use Sentry to detect and diagnose errors.

You can block or delete cookies in your browser, but some parts of the Console may not work properly. We honor Global Privacy Control (GPC) signals: when your browser sends one, we switch off analytics cookies and session recording. Like many websites, the Console does not respond to "Do Not Track" browser signals.

9. Children's Privacy

The Services are designed for developers and businesses and are available only to people aged 18 or older. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has created an Account or provided us personal information, we will delete that information and close the Account. If you believe a person under 18 has provided us personal information, please contact us at support@nace.ai.

10. Your Privacy Rights

Depending on where you live, including if you reside in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or another U.S. state with a comprehensive privacy law, you may have the right to:

• Know and access the categories and specific pieces of personal information we collect, the sources, purposes, and the categories of third parties to whom we disclose it;

• Correct inaccurate personal information;

• Delete personal information;

• Obtain a copy of your personal information in a portable format;

• Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we do not sell or share personal information, or engage in such profiling);

• Limit the use of sensitive personal information (we use sensitive information, such as account login credentials, only for permitted purposes); and

• Not be discriminated against for exercising these rights.

Categories of personal information collected in the past 12 months (California): identifiers (such as name, email, IP address); customer records and commercial information (such as billing details and purchase history); internet or network activity (such as usage, API, and log data); approximate geolocation; professional information (such as organization and role); account login credentials (sensitive personal information); and any personal information included in Customer Content. We collect these from the sources and for the purposes described in Sections 2 and 3, retain them as described in Section 6, and disclose them for business purposes to the categories of recipients described in Section 4.

Authorized agents and appeals. You may use an authorized agent to submit a request on your behalf; we may ask for proof of authorization and verify your identity. If we deny your request, you may appeal by replying to our decision or emailing support@nace.ai with the subject line "Privacy Appeal."

Shine the Light. California residents may ask whether we disclose personal information to third parties for their direct marketing purposes. We do not.

11. How to Exercise Your Rights and Choices

• In the Console: you can update your account name, revoke API keys, and delete your Account, which deletes your Customer Content as described in Section 5.7 of our Terms of Service. Uploaded files can also be deleted through the API. Disconnecting customer-managed storage or revoking access does not itself delete content. To delete specific runs or results, change your email address, or obtain a copy of your personal information, email support@nace.ai.

• By email: send your request to support@nace.ai. We will verify your identity, usually by confirming control of the email address associated with your Account, and respond within the time required by applicable law (generally 45 days).

• Marketing emails: use the unsubscribe link in any marketing email. We will still send service-related messages.

If your Account belongs to an organization, or your information appears in Customer Content submitted by one of our customers, we may refer your request to that organization, as it controls that information.

12. Third-Party Services

The Services may link to or integrate with third-party services, such as Google or GitHub sign-in, package registries (such as npm or PyPI) from which you download our SDKs, Discord, and MCP Clients, AI agents, or other tools you connect. Their privacy practices are governed by their own policies, and we are not responsible for them.

13. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. We will update the "Last Updated" date above, which shows when the current version was published, and, if we make material changes, we will notify you in advance by email or through the Console, and obtain your consent where required by law.

14. Contact Us

If you have questions about this Privacy Notice or our privacy practices, contact us at:

Nace.AI, Inc.

366 Cambridge Ave, Palo Alto, CA 94306, USA

Email: support@nace.ai