Privacy Policy

Last updated October 9, 2026

This Privacy Notice explains how Nace.AI, Inc. ("Nace", "we", "us", or "our") collects, uses, discloses, and otherwise processes personal information when you use the Nace.AI developer console at console.nace.ai (the "Console"), our APIs, CLI, SDKs, Model Context Protocol server ("MCP Server"), models, and documentation (together, the "Services"), or when you otherwise interact with us. It also explains the choices and rights you have.

Section 10 describes privacy rights that may be available to you depending on where you live. Our main company website, nace.ai, is covered by a separate privacy policy at nace.ai/policies/privacy-policy. This Privacy Notice does not cover our practices relating to job applicants or employees, or information that is de-identified or publicly available.

1. Account Data and Customer Content

Nace processes two broad kinds of personal information in connection with the Services:

Account and usage data. Information about you as a user of the Services, such as your name, email, billing details, and how you use the Services. Nace decides how this information is used, and this Privacy Notice applies to it in full.
Customer Content. The documents, files, and other data you submit to the Services through any access method ("Inputs") and the results the Services return ("Outputs"). Inputs may contain personal information about other people, for example names and addresses on invoices or bank statements. When you or your organization submit Customer Content for business purposes, we process the personal information it contains on your organization's behalf as a "service provider," under our Terms of Service and any agreement we have with your organization, and your organization is responsible for its own privacy practices. If you are an individual whose information appears in a document that one of our customers submitted, please contact that customer with any privacy questions or requests.

The exception is our use of Customer Content to improve our Models, described in Section 3, which we do under this Privacy Notice.

2. Personal Information We Collect

Information you provide to us

Account information: name, email address, password (stored in hashed form), organization name, role, and team membership.
Sign-in information from third parties: if you sign in with Google or GitHub, we do not receive your password for that service. Instead, we receive a token confirming that you signed in, along with your name, email address, profile picture, and account identifier, as permitted by your settings with that provider.
Billing information: billing name and address, tax identifiers, and transaction history. Payment card details are collected and stored directly by our payment processor, Stripe; we receive only limited details, such as card type, last four digits, and expiration date.
Customer Content: Inputs and Outputs, including any personal information they contain.
Communications: information you provide when you contact support, respond to surveys, join our community channels, or otherwise communicate with us.

Information we collect automatically

API and usage data: API keys used (in partially masked form), endpoints and MCP tools called, request and response metadata (such as timestamps, file type, page count, latency, status and error codes), usage volumes, and credits consumed.
Client and integration data: the access method used (Console, API, CLI, SDK, or MCP Server), the SDK, CLI, or MCP Server version, and, where it is sent to us, the name and version of the MCP Client or agent making the request (for example, an AI assistant or coding tool).
Device and log data: IP address, browser type and version, operating system, device identifiers, referring URLs, and pages viewed in the Console.
Approximate location: derived from your IP address, at the country or city level.
Cookies and similar technologies: see Section 8.

Our SDKs, CLI, and MCP Server send the data needed to process your requests, along with the client and version information above. They do not collect separate usage telemetry from your machine.

Information from other sources

Analytics and security providers, which help us understand Console usage and detect fraud or abuse.
Your organization, if an administrator invites you to a workspace or manages your Account.
Publicly available or business sources, such as professional profile information, to verify customers or prevent fraud.

3. How We Use Personal Information

We use personal information to:

Provide the Services, including creating and managing your Account, authenticating you, issuing API keys, processing Inputs and returning Outputs through the Console, API, CLI, SDKs, and MCP Server, and providing support.
Bill you and manage your Account, including tracking usage, applying Free Tier limits and credits, processing payments, and preventing fraud.
Secure the Services and prevent abuse, including monitoring for misuse, enforcing rate limits and our Terms of Service, investigating security incidents, and protecting our rights and the rights of others.
Improve and develop the Services and Models. We analyze usage data to understand how the Services perform and are used, including which access methods and integrations are used. We may also use Customer Content to train, evaluate, and improve our Models unless you opt out (see below).
Communicate with you, including service and security notices, changes to our terms, billing messages, and responses to your requests.
Market our Services, such as product updates, newsletters, and event invitations. You can unsubscribe at any time using the link in our emails.
Comply with legal obligations, such as tax, accounting, export control, and sanctions requirements, and to respond to lawful requests from authorities.
Carry out corporate transactions, such as a merger, financing, or sale of assets.

Use of Customer Content for model training, and how to opt out

By default, we may use Customer Content to train and improve our Models. Before using Customer Content for training, we apply automated and manual measures designed to remove or de-identify personal information and confidential identifiers (such as names, account numbers, and tax identifiers). Training data is access-controlled and is not shared with other customers.

You can opt out at any time in the Console under Account → Settings, or by emailing support@nace.ai. Once you opt out, Customer Content you submit afterwards will not be used for training. Opting out does not remove information from Models that have already been trained. Customer Content submitted under a signed enterprise agreement or data processing agreement is excluded from training unless that agreement says otherwise.

We do not use Customer Content for advertising, and we do not sell Customer Content.

Sensitive information

Please do not submit sensitive personal information to the Services that is not needed for your purpose. Our Terms of Service prohibit submitting certain categories of data, such as health information subject to HIPAA, full payment card data, passwords and other credentials, biometric data, and personal information of children under 13, unless a separate agreement with us permits it. We ask that you redact information such as Social Security numbers, government ID numbers, and full bank account numbers when they are not needed. If we become aware that prohibited data has been submitted, we may delete it.

Automated decision-making

We do not use the Services to make decisions about you that produce legal or similarly significant effects based solely on automated processing. Our Decision models (such as Drex) produce recommendations for our customers; our customers are responsible for how they use them.

4. How We Disclose Personal Information

We disclose personal information only as described below:

Service providers who process information on our behalf to host and operate the Services, including cloud hosting, storage, security, monitoring, customer support, email, analytics, and payment processing. They are contractually required to protect the information and use it only to provide services to us. A current list of our service providers that process Customer Content is available at trust.nace.ai/subprocessors.
Your organization, if your Account belongs to an organization workspace. Administrators can see your Account details, usage, and Customer Content in that workspace.
Third parties you direct us to share with, for example the MCP Client, AI agent, or other tool you connect to the Services.
Professional advisors, such as lawyers, auditors, and accountants, where needed to protect our rights and comply with our obligations.
Corporate transactions, such as a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to standard confidentiality protections.
Legal and safety reasons, where we believe in good faith that disclosure is required by law or legal process, or necessary to protect the rights, property, or safety of Nace, our users, or others.
Affiliates within our corporate group, for the purposes described in this Privacy Notice.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under California law.

5. Where We Process Information

Nace is based in the United States, and we and our service providers process and store personal information in the United States and other countries where our service providers operate. If you use the Services from outside the United States, your information will be transferred to, and processed in, the United States, where data protection laws may differ from, and be less protective than, those in your country. By using the Services, you acknowledge this transfer and processing.

6. Data Retention

We keep personal information only as long as necessary for the purposes described in this Privacy Notice:

Account information: for as long as your Account is active, and for up to 24 months afterwards to handle questions, disputes, and legal obligations.
Inputs (uploaded files): up to 30 days after processing, unless you store them in the Console or delete them earlier, or a different period is set in your Console settings or in a signed agreement.
Outputs: for as long as you keep them in the Console, or up to 30 days if not stored.
API logs and usage metadata: up to 13 months for security, debugging, and billing.
Billing records: as required by tax and accounting laws (typically up to 7 years).
De-identified training data: may be retained for as long as needed to develop and maintain our Models.

When retention periods end, we delete or de-identify the information. Deleted data may persist in backups for a limited period before being overwritten.

7. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls, logging, and regular security reviews. More information is available at trust.nace.ai. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password and API keys confidential, do not store them in shared code or agent configuration files, and rotate them if you suspect they have been compromised.

8. Cookies and Similar Technologies

We use cookies and similar technologies in the Console to:

Keep you signed in and secure (strictly necessary cookies);
Remember your preferences, such as theme or selected workspace (functional cookies); and
Understand how the Console is used so we can improve it (analytics cookies), using providers such as Google Analytics / PostHog.

You can block or delete cookies in your browser, but some parts of the Console may not work properly. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. We honor Global Privacy Control (GPC) signals as a request to opt out of any analytics or advertising cookies that may be considered a "sale" or "sharing" under applicable U.S. state law. Like many websites, the Console does not respond to "Do Not Track" browser signals.

9. Children's Privacy

The Services are designed for developers and businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. Users between 13 and 18 may use the Services only with the permission of a parent or legal guardian, as described in our Terms of Service. If you are a parent or guardian and believe your child has provided us personal information, please contact us at support@nace.ai.

California minors. If you are a California resident under 18 and have a registered Account, you may ask us to remove content or information you have posted on the Services that is visible to others by contacting support@nace.ai and describing where it appears. We will make reasonable good-faith efforts to remove it from view, but removal may not be complete or comprehensive, for example where others have copied it.

10. Your Privacy Rights

Depending on where you live, including if you reside in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or another U.S. state with a comprehensive privacy law, you may have the right to:

Know and access the categories and specific pieces of personal information we collect, the sources, purposes, and the categories of third parties to whom we disclose it;
Correct inaccurate personal information;
Delete personal information;
Obtain a copy of your personal information in a portable format;
Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we do not sell or share personal information, or engage in such profiling);
Limit the use of sensitive personal information (we use sensitive information, such as account login credentials, only for permitted purposes); and
Not be discriminated against for exercising these rights.

Categories of personal information collected in the past 12 months (California): identifiers (such as name, email, IP address); customer records and commercial information (such as billing details and purchase history); internet or network activity (such as usage, API, and log data); approximate geolocation; professional information (such as organization and role); account login credentials (sensitive personal information); and any personal information included in Customer Content. We collect these from the sources and for the purposes described in Sections 2 and 3, retain them as described in Section 6, and disclose them for business purposes to the categories of recipients described in Section 4.

Authorized agents and appeals. You may use an authorized agent to submit a request on your behalf; we may ask for proof of authorization and verify your identity. If we deny your request, you may appeal by replying to our decision or emailing support@nace.ai with the subject line "Privacy Appeal."

Shine the Light. California residents may ask whether we disclose personal information to third parties for their direct marketing purposes. We do not.

11. How to Exercise Your Rights and Choices

In the Console: you can view and update your Account information, delete files and Outputs, revoke API keys, change your model-training setting under Account → Settings, and delete your Account.
By email: send your request to support@nace.ai. We will verify your identity, usually by confirming control of the email address associated with your Account, and respond within the time required by applicable law (generally 45 days).
Marketing emails: use the unsubscribe link in any marketing email. We will still send service-related messages.

If your Account belongs to an organization, or your information appears in Customer Content submitted by one of our customers, we may refer your request to that organization, as it controls that information.

12. Third-Party Services

The Services may link to or integrate with third-party services, such as Google or GitHub sign-in, package registries (such as npm or PyPI) from which you download our SDKs, Discord, and MCP Clients, AI agents, or other tools you connect. Their privacy practices are governed by their own policies, and we are not responsible for them.

13. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. We will update the "Last Updated" date above and, if we make material changes, we will notify you in advance by email or through the Console, and obtain your consent where required by law.

14. Contact Us

If you have questions about this Privacy Notice or our privacy practices, contact us at:

Nace.AI, Inc.

366 Cambridge Ave, Palo Alto, CA 94301, USA

Email: support@nace.ai