Skip to content
NixoNixo

Last updated: February 25, 2026

Privacy Policy

Controller

The controller responsible for processing your personal data is:

vaibe.code UG (haftungsbeschränkt)

Huntestraße 21

27793 Wildeshausen

Germany

Managing Director: Justin Hansemann

Email: moin@vaibe-code.de

If you have questions about data processing or want to exercise your rights, please contact us through the dashboard or directly by email.

1. What information do we collect?

In short: We collect only the minimum information required — primarily account identifiers and usage metadata.

Information you provide

When you register an account, we collect the following information:

  • A username or label for your account chosen by you
  • An API key generated by us to authenticate your requests
  • Dashboard login details (session-based authentication)

Automatically collected information

When you interact with the service, we automatically collect:

  • Request metadata: the AI model used, token counts (input tokens, output tokens, cache read tokens, and cache write tokens), timestamps, and HTTP status codes
  • IP addresses — used exclusively for rate limiting and abuse prevention; not stored in long-term databases
  • Aggregated daily usage statistics per account
  • Browser and device information when accessing the dashboard (through standard HTTP headers)

Information we do NOT collect

  • We do not log, store, read, or review the contents of your API requests or responses (your prompts, messages, responses, or conversation contents)
  • We do not collect personal information beyond what is described above
  • We do not use tracking cookies, advertising pixels, or analytics services that profile individual users. Session cookies are used exclusively for dashboard authentication
  • We do not sell, rent, or trade your personal data to third parties

2. How do we process your information?

In short: We process your data to provide and maintain the service, secure your account, and comply with legal requirements.

We use the information we collect for the following purposes:

  • Authenticating and authorizing your API requests through your API key
  • Displaying usage analytics and statistics in your dashboard
  • Detecting and preventing abuse, fraud, and unauthorized access
  • Monitoring service health, performance, and availability
  • Communicating with you about your account or service-related matters
  • Complying with applicable legal obligations

3. When and with whom do we share your information?

In short: We share data only with infrastructure providers necessary to provide the service.

Your data may be processed by the following third parties:

Anthropic

Your API requests are forwarded directly to Anthropic's API. The content of your requests is transmitted to Anthropic and is subject to Anthropic's privacy policy. We act as a pass-through service and do not review request content. See: https://www.anthropic.com/legal/privacy

Cloudflare

Our infrastructure runs on Cloudflare Workers, D1 (database), and KV (key-value storage). Cloudflare processes HTTP requests as part of providing the service, including IP addresses and HTTP headers. See: https://www.cloudflare.com/privacypolicy/

We do not share your data with advertising networks, data brokers, or other parties not listed above. We may disclose information when required by law, in legal proceedings, or to protect the rights, property, or safety of nixo, its users, or the public.

4. Data retention and security

In short: We use industry-standard measures to protect your data — however, no system is perfectly secure.

We implement the following technical and organizational safeguards:

  • All data in transit is encrypted through TLS/HTTPS
  • Dashboard sessions use HMAC-signed, HttpOnly, Secure, SameSite=Strict cookies with a 24-hour expiration
  • API keys are stored securely and transmitted only through encrypted connections
  • Access to production infrastructure is restricted to authorized personnel
  • Data is stored on Cloudflare's globally distributed infrastructure with built-in redundancy

Despite these safeguards, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security against unauthorized access, alteration, or disclosure. You transmit data at your own risk.

5. Legal bases for processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases under the General Data Protection Regulation:

Contract performance (Article 6(1)(b) GDPR): Processing to provide the service, manage your account, authenticate requests, and track usage.

Legitimate interests (Article 6(1)(f) GDPR): Processing for fraud prevention, security monitoring, infrastructure optimization, and service improvement — provided that these interests do not override your fundamental rights.

Legal obligation (Article 6(1)(c) GDPR): Processing to comply with applicable tax, accounting, or regulatory requirements.

Consent (Article 6(1)(a) GDPR): Where applicable, processing based on your explicit consent. You may withdraw your consent at any time by contacting us.

6. Your rights (GDPR)

If you are located in the EEA or the United Kingdom, you have the following rights regarding your personal data:

  • Right of access: Request a copy of the personal data we hold about you (Article 15 GDPR)
  • Right to rectification: Request correction of inaccurate or incomplete data (Article 16 GDPR)
  • Right to erasure: Request deletion of your personal data under certain circumstances (Article 17 GDPR)
  • Right to restriction of processing: Request that we restrict processing of your data in certain situations (Article 18 GDPR)
  • Right to data portability: Receive your data in a structured, machine-readable format (Article 20 GDPR)
  • Right to object: Object to processing based on legitimate interests or for direct marketing (Article 21 GDPR)
  • Right to withdraw consent: Withdraw consent at any time without affecting prior processing

To exercise these rights, contact us through the dashboard or directly. We will respond within one month.

Right to lodge a complaint: If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with your local data protection supervisory authority. The competent authority for Lower Saxony is the State Commissioner for Data Protection of Lower Saxony: Postfach 221, 30002 Hannover, Germany, Tel. +49 511 120-4500, www.lfd.niedersachsen.de

7. International data transfers

We operate our primary infrastructure on Cloudflare's global network. Depending on your location, your data may be processed in regions outside your country of residence, including the United States and Europe. When transferring data outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

8. Privacy rights for California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

  • Right to Know: You may request disclosure of the categories and specific pieces of personal data we collect.
  • Right to Delete: You may request deletion of personal data we collect, subject to certain exceptions.
  • Right to Opt-Out of Sale: We do not sell your personal data. No opt-out is required.
  • Right to Non-Discrimination: We do not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us through the dashboard or directly.

9. Children's privacy

The service is not intended for anyone under 18 years of age. We do not knowingly collect personal data from minors. If we learn that a user under 18 has provided us with personal data, we will promptly delete that data. If you believe that a minor has provided us with personal data, please contact us immediately.

10. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated version will be identified by a revised “Last updated” date at the top of this page. For material changes, we may notify you through a prominent notice or other appropriate channels. We recommend that you review this policy regularly.

11. Contact and management of your data

If you have questions, concerns, or requests about this privacy policy or how we handle your personal data, please contact us through the dashboard or directly by email.

You can view your usage data at any time through the dashboard. To request a complete export or deletion of your data, contact us directly. We will process your request in accordance with applicable law and respond within the legally required time limits.