Privacy Policy

What we collect.

An account record (email, name, hashed credentials), billing identifiers from Stripe (customer ID, subscription ID, invoice history), crypto payment records (deposit addresses, transaction signatures and amounts), and operational metadata about your deployed agents (provider region, status, uptime). Chat messages and replies in the Nub web and desktop apps are stored in our application database so your conversation history can sync across devices. The files, memory and skills your agent creates live on the dedicated VM we provision for you (see § III).

Third-party processors.

We rely on a small set of vendors to deliver the platform. Each receives only the data necessary to perform its function:

• Stripe: billing and card payments.
• IONOS: compute for your agent's VM.
• Cloudflare: tunnels that reach your agent's gateway, R2 storage for published sites, and the Workers that serve them.
• Railway: hosts our application database (Postgres) and background worker.
• Vercel: hosts the web application.
• Upstash: Redis, used for rate limits, caches and short-lived platform state.
• Resend: delivers and receives mail for agent email addresses (<name>@agents.nub.lol).
• PostHog: product analytics. Events are sent from our servers.
• Telegram: delivers messages for the Nub bot and for the Telegram bot you create for your agent.
• DeepSeek and Surplus Intelligence: the model providers that process prompts your agent sends. Surplus Intelligence routes requests to upstream model providers.
• A Solana RPC provider: reads the blockchain to confirm crypto payments. It receives deposit addresses and transaction signatures.

Where data lives.

Account, billing and chat records sit in our application database. Agent runtime data (files, memory, skills, configuration and conversation logs kept by the agent) lives on the VM we provision for you, not in our central systems. Published sites are stored in Cloudflare R2 and served from Cloudflare's edge. Agent email is handled by Resend. When a subscription ends, the VM is destroyed and its data with it.

Retention.

Account records persist for as long as the account is open. Stripe retains billing records under its own retention policy. Agent runtime data persists for the life of the subscription. Cancellation triggers VM teardown at the end of the current billing period; teardown is irreversible and removes the agent's memory and skills with it. Published sites stay live until you delete them or we remove them under our Terms.

Your rights.

To request an export of your account data or the deletion of your account, email support at the address on our contact page. We respond within 30 days. You can also revoke third-party integrations at any time. Deletion removes the account record and triggers cancellation of all active agents. Some records (Stripe invoices, audit logs) may be retained where required by law.

Cookies & analytics.

We use first-party session cookies to keep you signed in. We do not run third-party advertising trackers. We use PostHog for product analytics; events are sent from our servers. Operational telemetry (request logs, error reporting) is retained for a limited window and used only for debugging and abuse prevention.

Contact.

Questions about this policy or a request regarding your data should go to the support address on the contact page. The data controller is TBD — owner to fill, TBD — owner to fill.