Privacy Policy

1. Scope and controller

NexLabs Studio LLC, doing business as NexLabs Studio, operates KESPA AI and is the controller of personal information used to operate the current individual/Open Beta service unless a different role is stated in a separate customer agreement.

This policy applies to KESPA websites, accounts, chats, private artifacts, support interactions, telemetry, and related Open Beta services. It does not replace the privacy policies of third-party services such as Google, Discord, Stripe, or an external AI provider you use through KESPA.

2. Notice at collection

Depending on how you use KESPA, we may collect the following categories of personal information:

• Identifiers and account information: email address, display name, KESPA account ID, Google or Discord account identifiers when you use those sign-in methods, profile/avatar information, plan, authentication/security state, email-verification state, and login timestamps.
• User content: prompts, conversations, feedback, files, documents, images, memories, project context, and other information you choose to provide.
• Technical and network information: IP address, browser/device information, timestamps, request logs, security events, and service diagnostics.
• Usage information: feature usage, model/routing events, latency, token counts, resource usage, telemetry, and product interaction records.
• Commercial information: plan, subscription, checkout, contribution, or transaction metadata when paid features are used. Full payment-card details are generally handled by the payment processor rather than KESPA.
• Support information: information you include in support, partnership, investor, or other inquiries.

We use these categories to provide, secure, maintain, troubleshoot, evaluate, and improve KESPA; process transactions; communicate with you; prevent abuse; maintain research integrity; and comply with legal obligations.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, subject to account deletion, legal obligations, security needs, backup cycles, and legitimate recordkeeping requirements.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

3. Personal information we collect

Information you provide

This includes chats, prompts, uploaded files, private artifacts, profile information, feedback, support requests, and information you intentionally store in KESPA memory or project context.

Information from connected services

When you sign in with Google or Discord, KESPA receives the account information authorized by the OAuth/OpenID scopes used for sign-in, such as a provider account identifier, name/profile information, avatar, email address, and email-verification state. If you register with email/password, KESPA stores a one-way password hash rather than your plaintext password. Verification and password-reset codes are stored only in hashed form and expire after a limited period.

When the administrator enables email registration, KESPA can use a Google-authorized Gmail sender account to deliver verification and password-reset codes through the Gmail API. The connected mailbox authorization is used for sending those account-security messages; KESPA does not need the mailbox password. If you use payment or other connected services, we receive the information necessary to complete and reconcile those transactions or integrations.

Information generated through use

KESPA records operational telemetry and logs used for security, debugging, quotas, benchmarking, routing, system health, and product improvement.

4. How we use personal information

• provide and operate KESPA;
• authenticate accounts and protect account security;
• process chats, files, retrieval, memory, and private intelligence features you request;
• maintain service reliability, abuse prevention, troubleshooting, and backups;
• measure performance, quality, energy, routing, and feature usage;
• improve KESPA products, models, prompts, retrieval, and system behavior using data we are permitted to use;
• process payments or support inquiries;
• comply with legal obligations and protect users, NexLabs, and third parties.

Private user content is not automatically published as research. Public research uses a separate sanitization, review, and publication workflow.

5. EEA and UK legal bases

Where the EU GDPR or UK GDPR applies, the legal basis depends on the processing activity. For UK users, our compliance review also considers the Data Protection Act 2018, PECR, and the Data (Use and Access) Act 2025 amendments that are in force. We may process personal data because it is:

• necessary to perform a contract or provide a service you requested;
• necessary for legitimate interests such as security, fraud prevention, service reliability, debugging, and product improvement, where those interests are not overridden by your rights;
• based on consent where consent is required, such as certain optional storage/access technologies or communications;
• necessary to comply with legal obligations or establish, exercise, or defend legal claims.

Where we rely on consent, you may withdraw it at any time without affecting processing that occurred before withdrawal.

6. How we disclose information

We may disclose personal information to service providers and processors that help us operate KESPA, such as Google and Discord for identity or account-security functions, hosting/infrastructure services, payment processors, communication/support services, and optional external AI providers.

When KESPA uses information received from Google APIs, that use and any transfer of that information will follow the Google API Services / Workspace User Data Policy, including its Limited Use requirements. For the Open Beta Gmail sender, KESPA requests only the authorization needed to send account-security email; it does not request permission to read your Gmail inbox.

We may also disclose information when required by law, to protect rights or safety, in connection with a corporate transaction, or when you direct us to do so.

We do not sell personal information and do not share it for cross-context behavioral advertising.

7. AI processing and external providers

KESPA can use local models and, when enabled for a feature or plan, external AI providers. If a request is routed to an external provider, the information necessary to perform that request may be transmitted to that provider.

External AI providers are intended to remain replaceable processors rather than the durable store of KESPA intelligence. Provider-specific retention and model-training terms may vary, so we evaluate provider settings and agreements before enabling them for private workloads.

8. Retention and deletion

Retention varies by data type and purpose. Account and user content may be retained while your account remains active or until you delete it, subject to technical backup cycles, security records, legal obligations, dispute prevention, and other lawful retention needs.

Where practical, deletion requests propagate through active application storage. Backup copies may remain until they are overwritten through the normal backup lifecycle.

Research artifacts intended for public release are separately reviewed and should not contain private user content.

9. Security

We use administrative, technical, and organizational safeguards appropriate to the service, including access controls, password hashing, short-lived hashed verification codes, encrypted private artifact storage where implemented, encrypted OAuth/provider credentials, optional TOTP two-factor authentication, audit/telemetry controls, and restricted infrastructure access.

No security measure can guarantee absolute security. If a qualifying personal-data breach occurs, we will handle notification obligations under applicable law.

10. International data transfers

NexLabs Studio LLC is based in the United States, and service providers may process information in the United States or other countries. Where EU or UK law requires a transfer mechanism or other safeguard for international transfers, we will use an appropriate lawful mechanism before making the transfer.

11. Your privacy rights

Depending on where you live, you may have rights to:

• access personal information we hold about you;
• correct inaccurate information;
• delete information;
• restrict or object to certain processing;
• receive portable copies of certain data;
• withdraw consent where processing is based on consent;
• challenge or request human review of certain solely automated decisions where applicable;
• complain to your local data-protection authority.

To submit a privacy request, email [email protected]. We may need to verify your identity before fulfilling a request. Where GDPR/UK GDPR applies, valid requests are generally answered without undue delay and ordinarily within one month, subject to lawful extensions and exceptions.

12. California privacy rights

Where the California Consumer Privacy Act, as amended by the CPRA, applies, California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information where applicable, and exercise those rights without unlawful discrimination.

KESPA does not sell personal information and does not share personal information for cross-context behavioral advertising. Because of that current practice, there is no sale/share activity to opt out of. If that changes, we will provide the required controls and honor applicable opt-out preference signals, including Global Privacy Control where required.

California requests may be submitted to [email protected].

13. Children

KESPA is not directed to children under 13, and we do not knowingly seek to collect personal information from children under 13. If you believe a child has provided personal information in violation of this policy, contact us so we can review and take appropriate action.

Additional age or consent requirements may apply depending on jurisdiction and the nature of the service.

14. Cookies and similar technologies

KESPA currently uses cookies and similar storage primarily for strictly necessary functions such as session management, sign-in, CSRF/security controls, and service operation. We do not intentionally deploy advertising cookies or browser-based behavioral advertising trackers on the KESPA service.

See our Cookie Policy for details. If we later introduce non-essential analytics, personalization, or advertising storage technologies, we will update the policy and implement any consent or opt-out controls required by applicable law before enabling them.

15. Changes to this policy

We may update this policy as KESPA, our providers, or legal requirements change. We will update the effective date and version and provide additional notice where required.

16. Contact

NexLabs Studio LLC
Brand: NexLabs Studio
Privacy/contact email: [email protected]