This Privacy Notice is also NANO X Studio’s privacy policy and notice at collection. It explains what personal information NANO X collects, where it comes from, why it is used, who receives it, how long it is kept, and the choices available to individuals.
“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual. Similar terms such as “personal data” have the same meaning for this Notice where applicable law uses them.
1. Scope
This NANO X Studio Privacy Notice applies to NANO X Studio websites, applications, workflow canvases, component and prompt libraries, AI-assisted features, exports, administration tools, signup and authentication flows, support, and related communications (collectively, the “Service”). NANO X, a California C corporation (“NANO X,” “we,” “us,” or “our”), provides the Service.
This Notice supplements the NANO X Studio Terms of Use and the privacy information in the NANO X website terms. It does not govern a third party’s independent website, application, platform, model, or service, even when that service connects to or is linked from Studio.
2. Our role and Customer control
2.1 Information NANO X controls
NANO X generally determines why and how Account, signup, billing administration, Service usage, security, legal-acceptance, support, and direct communication information is processed. For that information, NANO X acts as a business or controller under applicable privacy law.
2.2 Customer Content
A company or organization using Studio (the “Customer”) generally determines why and how personal information contained in its workflows, prompts, notes, governance records, files, integrations, and other Customer Content is processed. For that information, NANO X generally acts as the Customer’s service provider or processor and follows the Customer’s documented instructions, the parties’ agreement, and applicable law.
2.3 Customer administrators
Customer owners and administrators may invite and remove Users, assign roles, view and modify Customer Content, inspect audit and governance records, configure AI providers and integrations, export workflows, suspend access, and manage Account settings. Users should direct questions about their organization’s workspace settings or use of Customer Content to that Customer. NANO X will assist Customers with verified privacy requests as required by law and contract.
3. Information we collect
| Category | Examples | Primary purpose |
|---|---|---|
| Identifiers and Account data | Name, work email, User ID, organization, password hash, Account status, session identifiers, and approximate network identifiers. | Create, authenticate, secure, and administer Accounts. |
| Professional and organization data | Company name and website, company size, country or region, job title, department, role, permissions, and membership status. | Provision the company workspace, tailor administration, and enforce tenant access. |
| Customer Content | Workflow names and definitions, prompts, notes, technical contracts, governance records, linked media, selected platforms, custom fields, imported Mermaid content, files, and exports. | Save, display, analyze, govern, simulate, and export workflows at the Customer’s direction. |
| AI interaction data | Selected workflow scope, questions, prompts, model and provider selection, token limits, generated suggestions, provider responses, deterministic fallback results, and review records. | Provide user-requested AI analysis, comparison, recommendations, and governance evidence. |
| Integration and credential data | Provider name, connection mode and status, encrypted customer-supplied API credentials, masked key hints, OAuth or integration permissions, and information transmitted at a User’s direction. | Configure and operate Customer-selected providers and integrations. |
| Internet, device, and usage data | IP-derived approximate location, browser or device type, operating system, referring page, request metadata, timestamps, feature interactions, workflow version activity, diagnostics, and errors. | Deliver, secure, troubleshoot, measure, and improve Service reliability and usability. |
| Commercial and billing data | Plan, seats, billing interval, currency, price, billing contact, trial and renewal dates, subscription status, invoice or payment-processor identifiers, and internal billing administration notes. | Administer plans, subscriptions, invoices, renewals, and support. Payment-card details, if accepted, are handled by the payment processor rather than stored directly in Studio. |
| Support and communication data | Support requests, contact-form submissions, feedback, survey responses, attachments, service notices, and communication preferences. | Respond, provide support, improve the Service, and send requested or necessary communications. |
| Security, audit, and legal data | Login and privileged-administration events, actor, subject, User agent, workflow and governance changes, fraud signals, legal versions accepted, acceptance timestamp, and request-verification records. | Protect Accounts, investigate incidents, demonstrate authorization, enforce agreements, and comply with law. |
| Inferences | Feature relevance, workflow quality signals, likely design gaps, or suggested components derived from Service use and Customer-selected workflow context. | Provide workflow intelligence and improve user-requested recommendations. NANO X does not use these inferences to make employment, credit, housing, insurance, healthcare, or other significant eligibility decisions about Users. |
Customer Content may contain other categories of personal or sensitive information that a Customer or User chooses to enter. NANO X does not require that information and asks Customers not to submit specially regulated or high-risk data unless NANO X has expressly agreed in writing that the Service is configured to support it.
4. Sources of information
NANO X obtains personal information from:
- you directly, when you register, create or edit a workflow, configure a provider, request support, complete a form, or communicate with NANO X;
- your Customer organization, when an owner or administrator provisions or manages your Account, role, department, permissions, billing profile, or Customer Content;
- your browser, device, and network, when the Service generates session, request, diagnostic, security, and usage information;
- Third-Party Services at your direction, when you connect an AI provider, SaaS platform, payment service, email delivery service, or integration; and
- service providers, when they return delivery, hosting, security, billing, or support information needed to operate the Service.
No one is legally required to provide personal information to NANO X, but NANO X may be unable to create an Account, provide a requested feature, connect an integration, or respond to a request if necessary information is withheld.
5. How we use information
NANO X uses personal information for the following purposes:
- create, authenticate, and administer Accounts, Customers, Users, roles, and company workspaces;
- save, display, organize, autosave, version, simulate, analyze, govern, export, archive, restore, and delete workflows;
- provide AI-assisted features, deterministic fallbacks, prompt and component libraries, preflight findings, and provider comparisons selected by Users;
- configure and operate Customer-selected providers and integrations using the permissions Customer supplies;
- administer subscriptions, trials, seats, invoices, renewals, account communications, and support;
- monitor availability, diagnose errors, prevent fraud and abuse, investigate security events, and protect NANO X, Customers, Users, and the Service;
- maintain governance and audit evidence, enforce agreements, establish or defend legal claims, and comply with legal obligations;
- understand feature performance, conduct product research, and improve accessibility, reliability, and usability; and
- send transactional, security, legal, support, and—where permitted—marketing communications. Marketing messages include an opt-out method; opting out does not stop necessary Service communications.
NANO X does not use Customer Content to train a general-purpose AI model unless the Customer separately and expressly opts in through a written agreement or a clear Service control. NANO X may use aggregated or de-identified information for analytics, security, research, and Service improvement when it cannot reasonably identify an individual or Customer, and will not attempt to re-identify it.
6. Legal bases for processing
Where law requires a legal basis, NANO X relies on one or more of the following:
- Contract: processing needed to provide the Service, create and secure Accounts, save workflows, deliver requested AI or integration features, administer subscriptions, and provide support.
- Legitimate interests: operating and improving a secure business Service, understanding product performance, preventing abuse, communicating with business users, and establishing or defending legal claims, balanced against individual rights.
- Consent: optional marketing, a Customer-directed connection or AI request where consent is required, or another purpose presented at collection. Consent may be withdrawn prospectively.
- Legal obligation: tax, accounting, consumer, privacy, security, sanctions, lawful process, and other compliance duties.
- Vital interests or public interest: only in the unusual situation where processing is necessary to protect a person from serious harm or meet an applicable public-law duty.
7. AI features and integrations
7.1 Information sent
When a User invokes an AI-assisted feature, Studio may send the User’s question, selected workflow nodes and connectors, relevant workflow context, NANO X technical instructions, and response-format requirements to the provider selected by the Customer or User, such as OpenAI or Anthropic. Studio records provider, model, mode, workflow scope, and review metadata for governance and troubleshooting.
7.2 Customer-managed and NANO X-managed providers
If a Customer uses its own provider credential, the provider processes the request under the Customer’s provider account, configuration, and agreement. If NANO X provides a managed connection, NANO X’s agreement with that provider applies to the provider relationship. In either case, provider availability, retention, and data-use terms can vary. Customers should avoid including information that is unnecessary for the requested analysis.
7.3 Human review and automated decisions
Studio’s AI features are user-invoked design and decision-support tools. NANO X does not use Studio AI output to make employment, housing, lending, insurance, healthcare, education, or other significant eligibility decisions about Users. Customers control how they use workflow designs and AI output and are responsible for notices, consent, human review, impact assessments, opt-outs, and other obligations that apply to their own automated decision systems.
7.4 Third-party integrations
When a User configures a link, API credential, media embed, or platform integration, NANO X may exchange information with that Third-Party Service using the scopes and instructions selected by Customer. Disconnecting a provider stops new Studio requests through that connection but does not automatically delete information the third party previously received.
8. How information is disclosed
NANO X may disclose personal information to the following categories of recipients for the described business purposes:
- Hosting and infrastructure providers supporting application hosting, PostgreSQL databases, Redis caching, networking, backup, monitoring, and security. Studio currently deploys through Railway infrastructure.
- Communication providers delivering Account and Service messages. Studio may use Microsoft 365 through Microsoft Graph or Resend for transactional email when configured; email delivery is not currently required to create an Account.
- AI providers such as OpenAI and Anthropic when a User requests an AI feature and the relevant provider is configured.
- Customer-selected Third-Party Services when a User requests an integration, import, export, link, embed, or connected action.
- Payment and billing providers if online payments are enabled, to process payment, subscription, fraud, and invoice information.
- Customer owners, administrators, and authorized Users according to workspace permissions, sharing choices, and organizational control.
- Professional advisers and business counterparties such as lawyers, auditors, insurers, financing sources, and potential transaction parties under appropriate confidentiality protections.
- Government authorities or other persons when disclosure is required by law or reasonably necessary to protect rights, safety, security, prevent fraud, investigate misuse, or enforce agreements.
- A successor organization in a merger, financing, acquisition, reorganization, bankruptcy, or transfer of all or part of NANO X’s business, subject to applicable law and confidentiality protections.
Service providers and contractors receive only the information reasonably needed for their services and are subject to contractual or legal restrictions appropriate to their role. A current subprocessor list or data processing addendum may be requested through the NANO X contact method in Section 20.
9. Sale, sharing, advertising, and browser signals
9.1 No sale or cross-context behavioral advertising
NANO X does not sell personal information for money or other valuable consideration and does not share personal information for cross-context behavioral advertising as those terms are defined by California law. Studio does not use Customer Content to serve behavioral advertisements. NANO X has not sold or shared personal information for cross-context behavioral advertising during the preceding 12 months.
9.2 Sensitive personal information
NANO X uses sensitive personal information—such as Account authentication data, encrypted customer-supplied provider credentials, or the contents of private communications—only to provide, secure, and administer the Service or for another legally permitted purpose. NANO X does not use sensitive personal information to infer characteristics about individuals and does not sell or share it.
9.3 Do Not Track and Global Privacy Control
Some browsers offer a “Do Not Track” setting, but there is no uniform industry standard for interpreting it. Studio does not track Users across unaffiliated websites for targeted advertising, so enabling Do Not Track does not change essential Service processing. Where legally required, NANO X treats a recognized Global Privacy Control signal as a request to opt out of sale or sharing. Because Studio does not sell or share personal information for cross-context behavioral advertising, no separate opt-out is presently necessary.
9.4 Third-party collection
Third-Party Services connected or opened by a User may independently collect information under their own notices. NANO X does not control their cross-site practices.
11. Retention and deletion
NANO X retains each category of personal information only for as long as reasonably necessary for the disclosed purpose, the Customer’s instructions, an active Account or Subscription Term, security and continuity needs, or legal, accounting, audit, dispute, and enforcement requirements. Criteria include the information’s amount, nature, and sensitivity; the risk from unauthorized use; the purpose and whether it can be achieved another way; contractual commitments; and applicable limitation periods.
| Information | Typical retention approach |
|---|---|
| Signup and anti-abuse data | Signup rate-limit records and any legacy pending-verification records are removed through automated operational cleanup, generally within the following cleanup cycle after their operational window expires. |
| Session information | The authentication cookie renews during active use and ordinarily expires after approximately 30 minutes without activity; related security events may be retained longer for investigation and audit. |
| Account, membership, and Customer Content | Retained during the active Customer relationship and then deleted or de-identified through operational and backup cycles, subject to contract, Customer instructions, security, and law. |
| Workflow Trash | Workflow items moved to Trash are scheduled for permanent deletion after 14 days. Associated governance records cascade with the deleted workflow. |
| Provider credentials | Encrypted credentials are retained until replaced, disconnected, or the organization record is deleted, subject to limited backup and security retention. |
| Billing, legal acceptance, audit, and security records | Retained as needed for accounting, authorization evidence, fraud prevention, security, legal compliance, disputes, and enforcement, then deleted or de-identified. |
| Support and communications | Retained for the request lifecycle and a reasonable period afterward for continuity, quality, security, and legal needs. |
Deletion from active systems may not immediately remove information from limited backups or records NANO X must retain by law. Any retained copy remains protected and isolated from ordinary use until deleted or overwritten. Aggregated or de-identified information may be retained where it can no longer reasonably identify a person or Customer.
12. Security
NANO X uses administrative, technical, and organizational safeguards designed to protect personal information. Current controls include company-tenant scoping, role-based access, fixed platform-administrator allowlisting, password hashing, encrypted transport, protected and time-limited session cookies, encryption for stored customer-supplied provider credentials, least-privilege design, audit records, input validation, rate limits, and environment-separated secrets.
No method of transmission or storage is completely secure. Customers are responsible for selecting trusted administrators, removing access promptly, using strong unique passwords, protecting API credentials, reviewing integration scopes, and limiting Customer Content to information appropriate for the Service. If NANO X identifies a security incident affecting personal information, it will investigate, contain, remediate, and provide notices where required by law or contract.
13. International processing and transfers
NANO X is based in California, and the Service and its providers may process information in the United States and other countries where they operate. Those countries may have privacy laws different from the individual’s home jurisdiction.
Where applicable law requires a transfer safeguard, NANO X uses an appropriate contractual or legal mechanism, which may include the European Commission’s Standard Contractual Clauses, the United Kingdom International Data Transfer Addendum, an adequacy decision, or another recognized mechanism. NANO X does not claim participation in a certification framework unless that certification is expressly listed in a current NANO X notice. Customers with data-residency or transfer requirements should contact NANO X before submitting regulated data.
14. United States and California privacy disclosures
14.1 Categories collected and disclosed
During the preceding 12 months, NANO X has collected the categories described in Section 3: identifiers; professional and employment-related information; commercial information; Internet or other electronic activity; approximate geolocation; Customer Content; Account access information and other sensitive personal information used for Service security; and inferences related to workflow and feature recommendations. The sources, purposes, and retention criteria appear in Sections 4, 5, and 11.
For business purposes, NANO X has disclosed applicable categories to the recipient categories described in Section 8, including infrastructure, communication, Customer-selected AI and integration, payment, Customer administration, professional-adviser, legal, and transaction recipients. NANO X has not sold personal information or shared it for cross-context behavioral advertising during the preceding 12 months.
14.2 Rights
Depending on the state and subject to legal exceptions, residents may have the right to:
- know whether NANO X processes personal information and access the categories, sources, purposes, recipient categories, and specific pieces involved;
- correct inaccurate personal information;
- delete personal information;
- receive a portable copy of personal information;
- opt out of sale, targeted advertising, or certain profiling and limit certain uses of sensitive personal information;
- use an authorized agent where permitted;
- appeal a denied request in states that provide an appeal right; and
- receive equal service and not be discriminated or retaliated against for exercising privacy rights.
Because NANO X does not sell or share personal information for cross-context behavioral advertising and does not use sensitive information to infer characteristics, Studio does not currently display “Do Not Sell or Share” or “Limit the Use of My Sensitive Personal Information” links. If these practices change, NANO X will update this Notice and provide required controls before the change.
14.3 California notice at collection
Section 3 identifies the personal and sensitive information categories collected at or before collection and the purposes for which each is used. Section 11 states the retention period or criteria. NANO X will not collect an additional category or use information for a materially incompatible purpose without providing a new notice where required.
14.4 Shine the Light
NANO X does not disclose personal information to third parties for their own direct-marketing purposes in the manner covered by California’s “Shine the Light” law.
15. EEA, UK, Swiss, and other privacy rights
Where NANO X acts as controller and applicable law provides, individuals may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent, and complain to a supervisory authority. Withdrawing consent does not affect processing that was lawful before withdrawal.
Individuals may object to processing based on legitimate interests. NANO X will stop unless it demonstrates compelling legitimate grounds that override the individual’s rights or processing is needed for legal claims. Individuals may object to direct marketing at any time. Where NANO X acts for a Customer, the Customer is responsible for responding and NANO X will provide appropriate assistance.
16. How to exercise privacy rights
16.1 Submit a request
Submit a privacy request through the NANO X contact page with “Privacy Request” in the subject or call 1-888-886-3429. Identify the right you want to exercise and provide enough information to locate the relevant Account. A User whose data is controlled by a Customer organization should first contact that Customer.
16.2 Verification
NANO X will use information reasonably related to the Account or request to verify identity and authority. The method depends on the information’s sensitivity and the risk of unauthorized disclosure or deletion. NANO X may ask an authorized agent for signed permission and may ask the individual to verify directly. Verification information is used only to process and document the request and is not kept longer than reasonably necessary for that purpose.
16.3 Response and exceptions
NANO X will acknowledge and respond within the time required by applicable law. California verifiable requests are generally answered within 45 days, subject to a permitted extension with notice. NANO X may deny or limit a request where identity cannot be verified, an exception applies, the request is manifestly unfounded or excessive, disclosure would create a security risk or violate another person’s rights, or NANO X is processing solely for a Customer. NANO X will explain a denial and available appeal or complaint options where required.
16.4 Appeals and complaints
To appeal a decision, respond through the same contact method with “Privacy Appeal” and explain the reason. Individuals may also complain to their state attorney general, the California Privacy Protection Agency, or their local data-protection or supervisory authority.
17. Children
The Service is designed for business users and is not directed to children. Users must be at least 18 years old or the age of legal majority required to enter a business agreement in their location. NANO X does not knowingly collect personal information from children through Studio. If you believe a child submitted information, contact NANO X so it can investigate and delete the information where required.
18. Third-party sites and services
Studio may contain links, videos, platform logos, exports, or integrations involving Third-Party Services that NANO X does not own or control. This Notice does not govern a third party’s independent processing. Review that provider’s privacy notice, permissions, retention settings, and terms before connecting it or sending information.
19. Changes to this Notice
NANO X may update this Notice to reflect changes in the Service, law, providers, or data practices. The effective date and legal-version identifier will be updated. Material changes will be communicated through the Service, email, or another appropriate method before they take effect where required. NANO X reviews the California disclosures at least annually.
20. Contact NANO X
NANO X is a California C corporation located in Brentwood, California 94513. For privacy questions, rights requests, or complaints, use the NANO X contact page with “Privacy Request” in the subject or call 1-888-886-3429.
If NANO X cannot resolve a California privacy concern, individuals may submit a complaint to the California Privacy Protection Agency or the California Attorney General. Individuals elsewhere may contact the privacy or data-protection authority in their jurisdiction.