Privacy Policy
Effective Date: January 1, 2026 • Last Revised: October 28, 2026
1. Overview and Scope
Nexus-Flow (“we,” “our,” or “the Protocol”) operates an autonomous, multi-agent electronic commerce engine designed to decompose complex natural language requirements into technical bills of materials, query catalog distributors, and route commercial settlements via PayPal. This Privacy Policy sets forth our policies regarding the collection, use, and protection of personal and transactional information under applicable data protection frameworks, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
2. Data We Process
To provide multi-agent sourcing and secure payments, we collect and process the following categories of information:
- Procurement Prompts: Technical specifications, part numbers, quantity requests, and contextual parameters entered into the procurement bar.
- Authentication Information: Hashed credentials (salted PBKDF2-SHA256), email addresses, and merchant organizational identifiers. We do not store plaintext passwords.
- Payment & Escrow Tokens: PayPal Order identifiers, capture tokens, and payee merchant accounts. We do not store primary credit card account numbers (PAN) or CVV codes; all payment processing is performed securely via the PayPal Commerce Platform.
- Supply Chain Telemetry: Anonymized logistics pings, carrier tracking codes, hub routing timestamps, and package sensory data.
3. Multi-Agent Reasoning and External Providers
When fulfilling procurement queries, technical prompts are transmitted to our catalog providers (Channel3) and web crawlers (Kernel) strictly to verify component pricing, inventory levels, and manufacturer specifications. Prompt data shared with catalog partners contains no personally identifiable buyer details and is limited to technical item parameters.
4. Data Security and Cryptographic Hardening
Nexus-Flow implements enterprise security controls, including TLS 1.3 encryption in transit, strict Content Security Policies (CSP), HTTP Strict Transport Security (HSTS), stateless HMAC-SHA256 authenticated sessions, and granular IP-based rate limiting to protect against automated denial-of-service and injection attacks.
5. User Rights and Data Inquiries
Under applicable regulations, buyers and merchants retain the right to access, rectify, export, or delete their account records and associated procurement histories. To exercise these rights, contact the Nexus Data Protection Officer: