Before the legal language: here's what you need to know.
Now, the formal version:
NEXUS is operated by My Stripes Digital (ABN 81 972 900 602), based in Mont Albert, Melbourne, Victoria, Australia.
In this policy, "we", "us", and "our" refers to My Stripes Digital. "You" and "your" refers to you, the user.
When you create your AI agent, you provide personal information through our onboarding flow. This may include:
All messages between you and your AI agent are stored to maintain context and memory. Conversations may contain highly personal information.
Conversations are encrypted at rest and completely isolated per user.Your AI agent extracts key facts and preferences from your conversations to improve its responses over time. These memories are stored encrypted and are visible only to you.
If you upload documents (spreadsheets, PDFs, text files), we store them in your isolated storage bucket and extract text content for your agent to reference.
If you connect third-party services (e.g., Gmail, Google Calendar), we store OAuth tokens to maintain those connections. These tokens are encrypted and stored in Supabase Vault.
We never store your third-party passwords. OAuth means we receive a limited-access token — we can't see or change your password.We track basic usage metrics (message counts, token usage) for billing and rate limiting. This data is numerical only — it contains no message content.
Payment is processed by Stripe. We do not store your credit card number, CVV, or full card details. Stripe handles all payment data under their own PCI-DSS compliant security.
We store only: Stripe customer ID, subscription status, and billing period dates.
| Purpose | Data Used | Legal Basis |
|---------|-----------|-------------|
| Provide the NEXUS service | All data listed above | Contract (you signed up for the service) |
| Maintain your AI agent's memory and context | Conversations, memories, onboarding data | Contract + Legitimate interest |
| Process payments | Stripe customer ID, subscription data | Contract |
| Send service-critical emails (e.g., magic link, billing) | Email address | Contract |
| Improve the service | Aggregated, anonymised usage statistics only | Legitimate interest |
| Comply with legal obligations | As required | Legal obligation |
We will never use your personal conversations, onboarding data, or agent memories for marketing, advertising, analytics, or AI model training.All sensitive data is encrypted at rest using AES-256 encryption. Sensitive columns (conversations, onboarding data, memories, integration credentials) are additionally encrypted using Supabase Vault with per-user encryption keys.
Each user has a unique encryption key derived using HKDF (HMAC-based Key Derivation Function). This means:
All data transmitted between your browser and our servers is encrypted using TLS 1.3 (HTTPS). We enforce HSTS headers to prevent downgrade attacks.
Every database query is scoped to your authenticated user ID. Row-Level Security (RLS) is enforced at the database level — not just the application level. This means even a bug in our code cannot expose another user's data.
We use magic link authentication (passwordless). There is no password to leak, brute-force, or phish. Sessions use short-lived JWT tokens (15-minute access tokens with 7-day refresh tokens).
| Service | Purpose | Their Privacy Policy |
|---------|---------|---------------------|
| Supabase | Database, authentication, file storage | https://supabase.com/privacy |
| Anthropic | AI conversation processing (Claude API) | https://www.anthropic.com/privacy |
| Stripe | Payment processing | https://stripe.com/au/privacy |
| Vercel | Application hosting | https://vercel.com/legal/privacy-policy |
Your conversations are processed by the Anthropic Claude API to generate AI responses. Under Anthropic's commercial API terms:
| Data Type | Retention Period |
|-----------|-----------------|
| Account & profile | Until you delete your account |
| Conversations & messages | Until you delete your account |
| Agent memories | Until you delete your account |
| Uploaded files | Until you delete your account |
| Integration tokens | Until you disconnect the integration or delete your account |
| Usage/billing records | 7 years after account closure (Australian tax law requirement) |
| Security audit logs | 2 years |
You have the right to:
Request a complete copy of all data we hold about you. We will provide this within 30 days in a machine-readable format (JSON).
Update your onboarding answers, agent settings, or profile information at any time through the NEXUS dashboard.
Request complete deletion of your account and all associated data. We will:
To request deletion, email hello@mystripesconnect.com.au with subject "Data Deletion Request" or use the "Delete Account" option in your NEXUS settings.
Request a full export of your data in a portable format. We'll provide conversations, memories, uploaded files, and agent configuration.
You can disconnect integrations, clear memories, or delete conversations at any time without deleting your entire account.
If you believe we have breached your privacy, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
In the event of a data breach that poses a risk to your rights:
1. We will notify affected users within 72 hours of becoming aware of the breach
2. We will notify the OAIC as required under the Notifiable Data Breaches (NDB) scheme
3. We will provide clear information about what data was affected and what steps we're taking
4. We will offer practical guidance on steps you can take to protect yourself
NEXUS is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors. If we discover that a user is under 18, we will delete their account and all associated data.
NEXUS is an Australian service. Your data is primarily stored in Australia (Sydney region). Some processing may occur internationally through our service providers (Anthropic — USA, Vercel — global edge). All international transfers are protected by encryption in transit and contractual data protection agreements.
We may update this Privacy Policy from time to time. If we make significant changes:
For any privacy-related questions, concerns, or requests:
My Stripes DigitalEmail: hello@mystripesconnect.com.au
Phone: +61 403 700 965
Address: 3-7 Hamilton St, Mont Albert VIC 3127, Australia