Privacy Policy

01Who this policy covers

OneNexus is a product of Nexus Frontier Tech Limited (company number 11249274), registered at Level39, 39th Floor, One Canada Square, London, England, E14 5AB, which is the data controller for information collected through the OneNexus platform, the onenexus.ai website, and any product operating on a subdomain of onenexus.ai, such as lab.onenexus.ai. This policy sits alongside Nexus Frontier Tech Limited's general corporate privacy policy, which covers the parent marketing site; where the two overlap, this policy governs anything related to the OneNexus platform specifically.

This policy applies to OneNexus customers, the individuals at customer organizations who use OneNexus (analysts, reviewers, approvers and administrators), and visitors to onenexus.ai.

02Information we collect

Account and contact information

Name, work email, employer, role and authorization information (for example, the professional designation a signer uses to sign work, such as "ACA" or "Chair, Credit Committee"), collected when your organization sets up OneNexus or when you're added as a user.

Content processed through the platform

This is the core of what OneNexus handles, and the part a general corporate privacy policy doesn't cover:

• Source documents and data your organization submits for processing, such as financial statements, reconciliation data, and client money and asset records.
• Agent outputs: the draft work product an OneNexus agent produces from that source data.
• Corrections and prompts: the edits, comments and instructions analysts and reviewers give as a Sign moves through review.
• Signatures and authorization: who signed a given Sign, at what authorization level, and the warrant they signed against.

Enquiries you send us

If you use the form at onenexus.ai/contact, we collect the name, work email, institution and role you enter, and what you tell us you would like to see. We use it to answer your enquiry and to prepare for the conversation that follows, and for nothing else. We don't add you to a marketing list on the strength of an enquiry. The form is handled on our own infrastructure rather than by a third-party form provider, so the details you enter are not passed to a separate vendor in order to reach us.

Usage and technical data

Log-in activity, device and browser information, and product usage such as which features are used and session length. This is standard operational telemetry, used to run and improve the service.

03How we use information

• To produce, route, correct and sign Signs, and to operate SignChain as the record of that process.
• To authenticate users and enforce the authorization-level permissions your organization configures.
• To provide support, and to communicate service updates, security notices and (where you've agreed to receive them) product updates.
• To maintain security, detect misuse, and meet our own audit and compliance obligations.
• To improve OneNexus. See AI processing and model training below for what this does and doesn't include.

04Legal basis for processing

Where UK/EU GDPR applies, we process account and content data under contractual necessity (it's how the service you've contracted for works) and, for security and product-improvement uses that fall outside that contract, under legitimate interest, balanced against your rights. Where we rely on consent (for example, optional marketing communications), you can withdraw it at any time.

05AI processing and model training

OneNexus agents process the documents and data your organization submits in order to produce draft Signs. Customer content, including submitted documents, prompts, corrections and agent outputs, is never used to train, fine-tune or evaluate any shared or general-purpose model. This holds across every OneNexus deployment model: cloud, on-prem and hybrid.

A Sign's provenance, meaning which agent produced it, what corrections were made, and who signed it, is retained as part of SignChain regardless of the underlying model, so a change in model provider does not create a gap in the audit trail.

06Sub-processors and third parties

We use a limited set of sub-processors to run OneNexus: a cloud infrastructure and hosting provider, one or more AI model providers, and other operational vendors under contract, such as customer support tooling. We do not sell personal information, and we do not share customer content with third parties except sub-processors under contract, or where required by law. We'll notify customers before adding a new sub-processor category that materially changes how customer content is handled.

On the website specifically, onenexus.ai is served by our cloud infrastructure provider, whose edge network also screens the enquiry form for automated abuse. That screening runs at the network layer, not as code in your browser: the website loads no third-party code on any page. Enquiries submitted through the form are delivered to us by email through a transactional email provider under contract. Fonts, images and scripts are served from onenexus.ai itself, so browsing the site does not report your visit to anyone else.

07SignChain and record retention

SignChain is append-only. Once a Sign is produced, corrected or signed, that entry cannot be edited or deleted, only superseded by a new entry, and that has a direct effect on retention. Sign records are retained for a minimum of 7 years from creation, consistent with standard financial-services recordkeeping practice, and in any case for as long as we're required to keep them to meet a legal or regulatory obligation. Because entries are append-only, once retention is no longer required we anonymize the personal identifiers in older entries rather than deleting the entry outright, which preserves the audit trail's structure without holding personal data longer than necessary. Account data not tied to a specific Sign is retained for as long as your organization has an active account, plus 90 days after termination.

08International transfers

Where information is transferred outside the UK/EEA, for example because a sub-processor's infrastructure is located elsewhere, we rely on Standard Contractual Clauses or an equivalent safeguard to ensure it receives an equivalent level of protection.

09Security

OneNexus is ISO/IEC 27001:2022 certified (certificate IC-IS-2412247), verifiable at intercert.com/resources/certification-verification. Access to customer content is restricted on a need-to-know basis, and SignChain's append-only design means even an administrator cannot quietly rewrite the record of what happened.

10Your rights

Depending on where you're located, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. To exercise any of these rights, contact us using the details below. Note that SignChain's append-only design means a correction or deletion request affecting a signed Sign will itself be recorded as a new entry, consistent with how the platform is designed to work for every other correction.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), our lead data protection supervisory authority. If you're a California resident, you have rights under the CCPA, including the right to know what categories of personal information we collect and to request deletion.

11Cookies

onenexus.ai sets no cookies of its own, and runs no analytics. Nothing on this site profiles you, scores you, or follows you between visits, and there is no cookie banner because there is nothing to ask you about.

The bot screening on our enquiry form runs at the network layer and writes nothing to your browser, so no cookie is set there either. If a strictly necessary infrastructure cookie is ever needed to keep the site available, UK PECR and the ePrivacy Directive exempt that narrow purpose from the consent requirement, which is why you would not be asked to accept it. Such a cookie would carry no advertising or profiling function.

We use no third-party advertising cookies, and we do not sell information collected through cookies. If we ever introduce analytics, we will ask for your consent before anything is set, and this page will describe what it does before it starts doing it.

Signed-in use of the platform at lab.onenexus.ai is separate: a session there requires a session cookie, which is strictly necessary in the same sense.

12Children's privacy

OneNexus is a business product intended for use by professionals acting on behalf of their employer. It is not directed at, and we do not knowingly collect information from, individuals under 16.

13Changes to this policy

We'll update the "Last updated" date above when we make changes, and where a change is material, we'll notify account administrators directly rather than relying on you to check this page.

14Contact us

Questions about this policy, or requests relating to your information, can be sent to dpo@nexusfrontier.tech. For anything relating to Nexus Frontier Tech's other products or the corporate website, see the Nexus Frontier Tech Privacy Policy.