Effective date: August 3, 2026 Provider: Oliver Song, a sole proprietor doing business as Nexus ("Nexus," "we," "us") Contact: [email protected]
Nexus handles two kinds of personal information, and our responsibility differs:
A. Information about our customers (business owners and their staff). Name, email, password hash, business details, billing information. Here we are the controller — we decide how it's used, and this policy governs it.
B. Information about our customers' callers (their patients and clients). Caller phone number, name, appointment details, call recordings and transcripts. Here we are a processor acting on the business's instructions. The business decides what is collected and why; we handle it on their behalf. If you called a business that uses Nexus and want your information removed, contact that business directly — they control it, not us.
Every call is recorded and transcribed, and every caller is told so at the start of the call, along with the fact that they are speaking to an automated assistant. We store the exact disclosure wording used on each call as evidence it was given.
We do this on every call regardless of location, because several US states require all parties to consent to recording — including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington — and a business cannot know which state a caller is dialling from.
Illinois' Biometric Information Privacy Act may treat voice data as biometric information. We do not create voiceprints, perform voice identification, or use call audio to identify or authenticate any speaker.
Providing Nexus requires sending data to these companies. Each is bound by its own agreement with us.
| Sub-processor | What it receives | Why |
|---|---|---|
| OpenAI | Call and message content: caller audio and/or text, transcripts, and the business information the assistant answers from | Powers the assistant's understanding and speech |
| Twilio | Phone numbers, call metadata, call audio, SMS content | Carries the calls and text messages |
| Railway | All application data (hosts our servers and database) | Hosting and database |
| Stripe | Business owner name, email, billing details | Subscription payments |
We update this table when it changes. If you are a business owner, you should be aware that your callers' conversations are processed by OpenAI and carried by Twilio, and you may need to disclose that in your own privacy notice.
What we do not do: - We do not sell personal information. - We do not share one business's data with another. Every record is scoped to the business that owns it, enforced server-side on every request. - We do not use your callers' conversations to market to them. - We do not share a caller's or texter's mobile phone number with any third party for that third party's own marketing or promotional purposes. It is used only to carry and reply to that conversation, as described in Section 4. - We do not permit our AI sub-processor to train its models on your data. OpenAI's API platform does not use inputs or outputs sent through it to train or improve its models — this is their default for API and business customers, and is not something we had to opt into.
For transparency about what that does not mean: OpenAI retains API logs for up to 30 days for abuse monitoring, unless a longer period is legally required. So "not used for training" is not the same as "not stored at all." A stricter zero-retention arrangement exists but is approval-gated and we do not currently hold one.
If you text a business that uses Nexus: message frequency varies based on your conversation with that business — typically one reply per message you send. Message and data rates may apply. See Section 6 of the Terms of Service for the full SMS program details, including how to opt out.
| Data | Retention |
|---|---|
| Account and business profile | While the account is active |
| Call transcripts and call records | Kept for the life of the account — see below |
| Appointments and customer records | While the account is active, then per Section 7 |
| Billing records | As required by tax and accounting law (typically 7 years) |
| Technical logs | Up to 30 days |
| Data held by OpenAI (sub-processor) | Up to 30 days, for abuse monitoring |
We state this plainly rather than quoting a shorter number we do not enforce. Nexus does not currently delete call transcripts automatically — they remain available to the business for as long as their account is open, because owners rely on them for coaching and for records of what was agreed on a call. A business can request deletion of specific records, or all of their data, at any time (Section 7).
If we introduce automatic deletion, this section will be updated before the behaviour changes, not after.
Business owners can delete their own account from Settings. That removes the login. To delete the business and all of its records, contact us.
On request we will delete or anonymise your business data within 30 days, except where we must keep records to comply with law, resolve a dispute, or enforce our agreements. This is a manual process today — email us and a person will action it.
No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you as required by applicable law.
Depending on where you live you may have the right to access, correct, delete, or export your personal information, to object to or restrict processing, and to withdraw consent.
California residents (CCPA/CPRA): you may request disclosure of the categories of personal information collected, request deletion, and request correction. We do not sell or share personal information for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.
To exercise any right, contact [email protected]. If your information was collected because you called a business using Nexus, contact that business — they control that data.
Nexus does not currently offer a Business Associate Agreement and is not positioned as a HIPAA-compliant service. Businesses subject to HIPAA should not configure Nexus to collect clinical information, and should seek their own compliance advice. See Section 6 of the Terms of Service.
Nexus is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 13. A caller's age is not something we can verify; if you believe a child's information has been collected, contact the business you called, and us.
Nexus operates in the United States and data is processed there. We do not currently offer service outside the US.
We will post updates here and change the effective date. For material changes we will notify business owners by email or in the dashboard.
Oliver Song, doing business as Nexus (sole proprietor) [email protected]