Enterprise Privacy Policy

1. Core Commitment: Zero Training on Customer Data

At Nuvi-X AI ("Nuvi-X", "we", "our", or "us"), we operate under a strict and non-negotiable architectural guarantee: We never use customer prompts, agent execution instructions, voice audio samples, or uploaded financial documents to train, fine-tune, or improve our foundation AI models.

All inference computations conducted via our API or web interface are handled in ephemeral AWS Graviton3 and Bedrock memory enclaves. Data is flushed immediately upon the completion of your HTTP or WebSocket connection.

2. Information We Collect

We only collect information essential to provisioning, maintaining, and securing your enterprise account:

• Account Information: Name, business email, and organization credentials provided during registration.
• API Telemetry: Aggregated token counts, request timestamps, response latency, and HTTP status codes for billing and rate-limiting.
• Billing Information: Payment tokens processed securely via PCI-DSS compliant third-party payment gateways. We do not store full credit card numbers.

3. Infrastructure & Encryption Standards

Nuvi-X is engineered natively within Amazon Web Services (AWS) data centers:

• In Transit: All data transmitted to or from Nuvi-X APIs is encrypted using TLS 1.3 with modern cipher suites.
• At Rest: Any persistent metadata (such as account profiles and audit logs) is encrypted using AES-256 via AWS Key Management Service (AWS KMS).
• VPC Isolation: Enterprise customers may opt for dedicated AWS VPC Peering and AWS PrivateLink to ensure traffic never traverses the public internet.

4. GDPR and International Data Rights

If you are an individual located within the European Economic Area (EEA), the United Kingdom, or Switzerland, you have defined rights regarding your personal data:

• The right to access, rectify, or erase your account data.
• The right to restrict or object to the processing of your data.
• The right to export your telemetry and billing logs in a structured JSON format.

5. Data Retention Period

We retain account profile metadata only as long as your workspace remains active. Diagnostic server logs are automatically purged after 30 days. You may request immediate deletion of your account and all associated keys at any time by contacting our privacy desk.

6. Privacy Inquiries & Data Protection Officer

For questions, data access requests, or regulatory inquiries, contact our Data Protection Officer directly: