Legal
Privacy Policy
This Privacy Policy explains how Prometix Solutions Ltd (“Prometix”, “we”, “us”, “our”) collects, uses, and protects personal data when you visit our website (prometix.io) or use our products, including Nexus.
Prometix Solutions Ltd is the data controller for the personal data described in this policy — namely, account, billing, and usage data relating to you as a Prometix user. Where we process personal data contained within the repositories, issues, or other content a business customer connects to Nexus (for example, names or email addresses of that customer’s own contributors appearing in commit or issue metadata), we do so as a data processor acting on that customer’s instructions, under the terms of our Data Processing Agreement, not under this policy.
1. Data we collect
Account data
When you sign up via GitHub or Azure DevOps OAuth we receive your username, display name, primary email address, and avatar URL from whichever provider you use. We store this information to create and manage your account.
Usage data
When you use Nexus we record:
- The GitHub or Azure DevOps repositories and issues or work items you connect to Nexus
- Agent run logs: timestamps, model provider used, tool calls made, and agent-generated outputs
- Settings you configure: agent roles, system prompts, and model preferences
We do not persist your source code on our servers. Each agent run clones your repository into an isolated, single-use container created for that run; the clone is never written to shared storage and is destroyed when the run completes. Access is scoped through the GitHub API or Azure DevOps API, as applicable to your connected provider, using the permissions you grant.
Billing data
If you subscribe to a paid plan, we collect your billing contact name and email address. Payment card data is collected and stored directly by Stripe; we receive only a payment status confirmation and a Stripe customer reference. We do not store card numbers or CVV codes.
Server access logs
Our infrastructure automatically records IP addresses, request paths, and timestamps for security and operational purposes. These logs are retained for 30 days.
2. Legal basis for processing
| Purpose | Legal basis |
|---|---|
| Providing and operating the Nexus service | Performance of a contract — Art. 6(1)(b) UK/EU GDPR |
| Processing payments | Performance of a contract — Art. 6(1)(b) |
| Security monitoring and fraud prevention | Legitimate interests — Art. 6(1)(f) |
| Complying with legal or regulatory obligations | Legal obligation — Art. 6(1)(c) |
| Improving our products (aggregated, non-identifiable analysis) | Legitimate interests — Art. 6(1)(f) |
3. How we use your data
We use your personal data to:
- Create and manage your Prometix account
- Operate Nexus, including routing agent requests to your chosen AI model provider
- Process payments and send receipts
- Send transactional communications (e.g. account confirmation, password reset)
- Detect and prevent abuse, fraud, and security incidents
- Comply with legal obligations
We do not sell your personal data. We do not use your data for advertising or behavioural tracking.
4. Sub-processors and data sharing
We share data with the following sub-processors to deliver our service:
| Sub-processor | Purpose | Location | Privacy policy |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, data storage, message queuing (Service Bus) | UK South / West Europe | Microsoft Privacy Statement |
| GitHub (Microsoft) | OAuth authentication, repository and issue API access | United States | GitHub Privacy Statement |
| Microsoft (Azure DevOps) | OAuth authentication, repository and work item API access | Varies by your Azure DevOps organisation’s configured region | Microsoft Privacy Statement |
| Stripe | Payment processing and billing | United States (EU data stored in EU) | Stripe Privacy Policy |
| Anthropic | AI inference when Claude is selected as your model provider | United States | Anthropic Privacy Policy |
| OpenAI | AI inference when a GPT model is selected as your model provider | United States | OpenAI Privacy Policy |
| Microsoft (GitHub Copilot) | AI inference when a Copilot model is selected as your model provider | United States | Microsoft Privacy Statement |
| AI inference when a Gemini model is selected as your model provider | United States | Google Privacy Policy |
AI inference sub-processors receive only the data you explicitly pass to an agent run — for example, the text of a GitHub issue or file contents retrieved via the GitHub API. We do not send your source code to model providers except as instructed by your agent configuration. Your choice of model provider determines which inference sub-processor receives this data. The providers listed above are currently the only AI model providers supported by Nexus; if we add further options, we will add them to this table before they become available to select.
We will provide at least 30 days’ notice (via email or an in-app notice) before engaging a new sub-processor to process personal data described in this policy. If you object to a new sub-processor, you may terminate your account before the change takes effect.
We do not share your data with any other third party except where required by law, or where we exercise the discretionary law enforcement disclosure right described in Section 3 of our Terms of Service, which applies only to account, billing, and usage data we hold as controller and does not extend to data we process on your behalf as processor (see our Data Processing Agreement).
5. International data transfers
Some sub-processors are based outside the United Kingdom and the European Economic Area. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs), as applicable.
6. Data retention
| Data category | Retention period |
|---|---|
| Account data | Until account deletion, plus 30 days |
| Agent run logs | 90 days rolling |
| Billing records | 7 years (legal and tax obligation) |
| Server access logs | 30 days |
You can request deletion of your account at any time by emailing privacy@prometix.io. Billing records are retained for the legally required period even after account deletion. Notwithstanding the 90-day rolling retention that applies to agent run logs on active accounts, on account deletion your associated agent run logs are deleted or anonymised within 30 days.
7. Your rights
Under UK GDPR, and EU GDPR where applicable, you have the following rights in relation to your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — ask us to delete your personal data (“right to be forgotten”)
- Portability — receive your data in a structured, machine-readable format
- Restriction — ask us to pause processing while a dispute is resolved
- Objection — object to processing carried out on the basis of legitimate interests
To exercise any of these rights, email privacy@prometix.io. We will respond within 30 days. There is no charge for making a request.
If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your local supervisory authority if you are resident in the EU.
8. Security
We apply appropriate technical and organisational measures to protect your personal data, including:
- Encryption in transit (TLS 1.2 or higher) and at rest
- Access controls limiting data access to authorised personnel only
- Regular security reviews of our codebase and infrastructure
No method of transmission over the internet is completely secure. If you discover a security vulnerability, please report it responsibly to security@prometix.io.
9. Cookies
This website does not use tracking cookies or analytics scripts. We do not collect browsing data for advertising purposes.
The Nexus application sets a session cookie strictly necessary to maintain your authenticated session. This cookie does not track you across other websites and is deleted when you sign out.
10. Changes to this policy
We may update this policy from time to time. We will notify users of material changes by email or by displaying a prominent notice in the Nexus application before the changes take effect. The version number and “last updated” date at the top of this page indicate when the policy was last revised.
11. Contact
For any questions, requests, or concerns about this policy or the way we handle personal data, please contact us:
Prometix Solutions Ltd
Email: privacy@prometix.io