Privacy Policy

1. Information We Process

The application processes the following category parameters to deliver unified multi-agent chat and RAG services:

• Account profiles (emails, names, hashed passwords, session logs).
• Workspace assets (uploaded PDF/DOCX/TXT/MD files, custom YouTube video transcripts).
• Chat data (message sequences, generated model responses, RAG similarity metrics).
• Usage metrics (prompt logs, waiting counters).

2. Purpose of Data Processing

Your information is processed solely to operate the console features:

• Generating vector representations of documents and indexing them via secure vector databases.
• Routing web search queries and extracting webpages via enterprise search providers.
• Transcribing video content via industry-leading transcription APIs.
• Generating contextual responses via state-of-the-art LLM intelligence.

3. Row Level Security & Security Logging

All databases enforce PostgreSQL Row Level Security (RLS). A user account cannot read, write, update, or delete records belonging to another authenticated account. Session tokens are verified on the server side on every query.

In order to protect the platform against abuse (such as SSRF, IDOR attacks, or authentication brute-forcing), Nemetron temporarily logs high-severity security events.

• Strike System Monitoring: The system automatically assigns risk scores and strikes based on malicious activities. Actions like attempting to access private networks (SSRF) or manipulating resource IDs (IDOR) will be logged to trigger defensive lockouts (ranging from 1 hour to 7 days).
• Anonymized Identifiers: To preserve privacy, Source IP addresses and User-Agent strings associated with security alerts are securely hashed using SHA-256 before being stored in the database. Raw IPs are never retained in the security event log.
• Decay Policy: Strikes naturally decay to zero after 30 days of inactivity, provided no further critical security violations occur.

4. Third-Party Service Providers

Certain features require sending query inputs to external partners. These operations are managed securely:

• AI Inference Partners: Process prompts and RAG contexts to compile final text.
• Web Search Providers: Safely execute search query strings and extract webpage contents.
• Video Processing APIs: Locate video results and request transcript indexes.
• Email Gateways: Send signup OTP numbers and recovery links to your inbox.

These providers do not receive your password hashes or access keys.

5. Security Boundaries

While the architecture utilizes RLS checks, private buckets, and server-side keys, no digital system is completely immune to security limitations. Users should avoid submitting production server keys, personal credentials, or highly sensitive corporate financial assets to the workspace.

6. User Data Controls

The account settings panel includes options to purge all user metadata. Selecting "Purge My Data" deletes all active conversation records, storage documents, video transcripts, and prompt counters immediately and permanently.

7. Updates & Contacts

This policy can be modified to reflect library upgrades. For general support queries, please contact your local developer administrator.