Drex Privacy Notice

This notice explains how Nace AI, Inc. handles personal information when you use Drex by Nace.AI at console.nace.ai and the Drex API. It supplements the Nace AI Privacy Policy. Where the two differ for Drex, this notice applies.

1. What we collect

• Account details: your email address, and your name if you sign in with Google.

• Billing details: the amount and time of each purchase and your Stripe customer reference. Stripe processes your card; we never see or store card numbers.

• Usage records: for each successful request, the time, input and output token counts, cost, response time, request ID and which API key was used.

• Operational logs: for each request, its outcome, timings, the client's user agent and its request content. Our hosting provider also processes IP addresses to deliver traffic and block attacks.

• Request content: the state and questions you send and the answers Drex returns. We write them to our operational logs and use them only to run, debug and secure Drex and to answer support requests. Very large requests are logged in part. Drex does not use request content to train or improve models.

• Product analytics: which pages of console.nace.ai you visit, your browser and device type, where you came from, and actions such as signing in, creating an API key, running the playground and starting a top-up. Once you sign in, these are linked to your account ID and email. Page text, form inputs, API keys and playground content are masked in the browser and never sent.

2. How we use it

To run your account and the API, bill you and show your usage, keep the service secure and prevent abuse (including sign-in bot checks and rate limits), answer support requests, send service emails such as sign-in codes, and understand how people use Drex so we can improve it. We do not sell personal information and do not use it for advertising.

3. Service providers

These providers process data on our behalf to run Drex. Data is processed in the United States.

4. How long we keep it

• Account details and usage records: while your account is open.

• Purchase records: as long as tax and accounting law requires, even after an account is closed.

• Operational logs, including request content: no more than 30 days.

• Rate-limit counters: a few minutes.

• Product analytics: while your account is open, and deleted with it on request.

5. Cookies

We use cookies to keep you signed in, and one first-party PostHog analytics cookie on console.nace.ai that recognizes your browser across visits. Cloudflare Turnstile may use its own cookies for the bot check on the sign-in form. We do not use advertising cookies. Blocking the analytics cookie does not affect Drex.

6. Your choices and rights

You can ask to access, correct, export or delete your personal information by emailing support@nace.ai from your account email. We respond within 30 days. Depending on where you live, laws such as the GDPR or CCPA may give you further rights, which you can exercise the same way.

7. Security

API keys are stored only as hashes, traffic is encrypted in transit, and access to production systems is limited to the people who run them. No system is perfectly secure, so please tell us at support@nace.ai if you find a problem.

8. Children

Drex is not intended for anyone under 18, and we do not knowingly collect their information.

9. Changes and contact

We will update the date above when this notice changes and tell account holders by email about material changes. Questions: support@nace.ai. See also the Drex Service Terms.