Privacy Policy

Last updated: 2026-05-24

Short version

  • We collect only what's needed for the service to work (email, conversations, preferences).
  • Servers in the EU. GDPR-compliant.
  • We don't sell your data. We don't train AI models on your private chats.
  • You can export everything or delete your account anytime from the Memory dashboard.

1. Data Controller

Operator of Nyxiss (Karel) is the data controller. For GDPR matters, contact via the contact form.

2. What we collect

  • Account data: email, password hash (never plain text), account creation date
  • Conversations: messages you send and Nyxiss's replies, with timestamps
  • Memory: structured facts extracted from your conversations (preferences, goals, projects)
  • Uploads: images and files you share with Nyxiss
  • Technical data: browser type, IP address (anonymized after 30 days), session info
  • Billing: if you subscribe — handled by Stripe; we never see your card data

3. How we use it

  • Provide the service: chat, memory, reminders, voice, vision
  • Bill you (paid plans only) — via Stripe
  • Send transactional emails (password reset, account changes, reminders if you opt-in)
  • Improve the service via aggregated, anonymized usage statistics

4. Third-party processors

To deliver Nyxiss we use:

  • OpenAI — AI model provider (chat, voice, image generation). Your messages are sent to OpenAI per their API terms. They do not train on API data.
  • Replicate — occasional image generation (avatar frames)
  • Stripe — payment processing for paid plans
  • Railway / Postmark — hosting and email delivery

5. Data retention

  • Conversations and memories: kept while your account is active
  • Account: kept until you delete it
  • Billing records: 10 years (Czech law)
  • After deletion: hard wipe within 30 days, except billing records

6. Your rights (GDPR)

Under EU GDPR, you have the right to:

  • Access — see what we store about you (Memory dashboard)
  • Export — download everything as JSON
  • Correct — fix inaccurate data
  • Delete — wipe your account and all data
  • Object — ask us to stop certain processing
  • Lodge a complaint with the Czech Data Protection Authority (ÚOOÚ)

7. Cookies

We use only essential cookies: session (login) and CSRF (security). No tracking cookies, no analytics that profile you, no advertising cookies.

8. AI training

We do not use your private conversations to train AI models. Nyxiss's personality is hand-crafted; she gets smarter through better prompts, not by learning from your chats.

9. Children

Nyxiss is not intended for users under 16. If you believe we have collected data from a child under 16, contact us immediately for removal.

10. Changes

We'll notify you in-app or via email about material changes to this policy at least 14 days before they take effect.

11. Contact

Privacy questions? Reach out via the contact form. We respond within 30 days.