Last updated · October 15, 2026
English
Private research pilot
When the live pilot is enabled, research inputs, short source excerpts and optional feedback are stored against your verified account for seven days. You can export or delete completed research from My research. Deletion removes these contents from active storage; minimal run references, credit entries and provider cost receipts remain for reconciliation. Recovery snapshots may retain deleted contents until their retention window ends; deletion records must be reapplied after recovery. Public product URLs and questions are sent to the configured search provider (Firecrawl or Brave); page URLs are sent to Firecrawl for extraction when that source is selected. Do not submit private or sensitive information. Search snippets, collection times and unknowns are shown separately. The fixed sample demo remains separate from live research.
Accounts and verification
When account registration opens, we store your name, email, verification status, password hash, server sessions and API key hashes in Cloudflare D1. Passwords and API keys are not stored in plaintext. Sessions last up to seven days; API keys expire after 90 days and can be revoked. Authentication may store IP addresses and browser details for session security and abuse prevention. A transactional email provider receives your email address to deliver verification and password recovery messages.
1. What we may receive
- Contact and checkout data: email address, order references, plan, amount, currency, and entitlement events needed to provide paid access.
- Product inputs: prompts, selected topics, language preferences, and research briefs when you use a hosted workflow.
- Operational data: request IDs, timestamps, status, latency, error details, and security records needed to operate and protect the service.
- Support messages: the information you choose to include when contacting support.
- Anonymous funnel events: a random browser session identifier, event name, campaign tags, and selected offer used to understand checkout conversion. We do not attach this identifier to an email, IP address, prompt, card, or payment credential.
Beta feedback and invitations
When you submit a rating, we receive the rating, optional note, run reference and campaign tags. When you request an invitation, we save your email and explicit contact consent. These submissions are separate from anonymous analytics. We review beta submissions for deletion within 90 days unless you continue an active support conversation. Contact support to withdraw consent or request deletion.
2. What stays on your device
Review selections, notes, and local prototype state may stay in browser storage until you clear it or export it. This local state is not a production account, authoritative payment ledger, or multi-tenant database.
3. Payments and third parties
Waffo hosts checkout and handles card collection under its own policies. NexusKey receives the signed payment and entitlement information needed to fulfill a plan, not the full card number. When external research providers are enabled, relevant request data may be sent to the selected provider under its terms. The public sample demo is labeled as simulated. Live research remains paused until the selected provider and pilot access are enabled.
4. How we use information
We use information to provide research results, activate and limit paid access, respond to support requests, prevent abuse, diagnose failures, reconcile payments, and improve the service. We do not sell personal information.
5. Retention and deletion
We keep billing, entitlement, security, and support records only as long as needed for the service, legal obligations, dispute handling, and auditability. You can request access, correction, or deletion by emailing vokie123@gmail.com. Some records may need to be retained when law or payment reconciliation requires it.
6. Your choices
You may clear local browser state, avoid submitting optional personal details, and request a copy or deletion of information associated with your support or paid transaction. We may need to verify ownership of a request before acting on it.
7. Children and changes
NexusKey is not directed to children under 13. We may update this policy as the product, providers, or legal requirements change. The date above identifies the current version.
中文
私有研究试点
真实试点开放后，研究输入、来源短片段和可选反馈关联到已验证账户，保存七天。已完成的研究可在 My research 中导出或删除。删除会清除活动存储中的这些内容；最小运行引用、额度流水和供应成本回执仍用于对账。恢复快照中的内容可能保留到快照期限结束，恢复后必须重新应用删除记录。选择搜索时，产品公开网址和问题会发送给当前配置的搜索供应商（Firecrawl 或 Brave）；选择网页提取时，网址会发送给 Firecrawl。请勿输入私密或敏感信息。页面会区分搜索片段、采集时间和未知项。固定样本 Demo 始终与真实研究分离。
账户与邮箱验证
注册开放后，我们在 Cloudflare D1 中保存姓名、邮箱、验证状态、密码哈希、服务端会话及 API Key 哈希，不保存明文密码或明文 API Key。会话最长有效七天；API Key 在 90 天后到期，也可以主动撤销。身份验证可能记录 IP 地址和浏览器信息，用于会话安全与防滥用。事务邮件服务商会接收邮箱地址，用于发送验证与密码恢复邮件。
1. 我们可能接收的信息
- 联系与结账信息：邮箱、订单引用、套餐、金额、币种以及提供付费权益所需的履约事件。
- 产品输入：使用托管工作流时提交的提示词、主题、语言偏好和研究简报。
- 运行信息：请求 ID、时间、状态、延迟、错误详情和用于安全保护的记录。
- 客服信息：用户主动写入客服邮件的内容。
- 匿名漏斗事件：随机浏览器会话标识、事件名称、活动标签和所选套餐，用于了解结账转化；该标识不会关联邮箱、IP、提示词、银行卡或支付凭据。
Beta 反馈与邀请
主动提交评价时，我们接收评分、可选备注、运行引用和活动标签。申请邀请时，我们保存邮箱与明确的联系同意，且不将其与匿名统计标识关联。Beta 提交会在 90 天内接受清理审查；持续进行的客服沟通除外。可以联系客服撤回同意或申请删除。
2. 保存在设备上的信息
Review 选择、笔记和本地原型状态可能保存在浏览器存储中，直到用户清除或导出。它不是生产账户、权威支付账本或多租户数据库。
3. 支付与第三方
Waffo 按自身政策托管结账并处理银行卡收集。NexusKey 只接收履约所需的签名支付和权益信息，不接收完整卡号。启用外部研究供应商后，相关请求数据可能会按照对应供应商条款发送给该供应商。公开样本 Demo 明确标注为模拟数据。真实研究会在所选供应商和试点权限就绪后开放。
4. 信息用途
我们使用信息来提供研究结果、激活和限制付费权益、回复客服、预防滥用、诊断故障、对账支付并改进服务。我们不会出售个人信息。
5. 保存与删除
账单、权益、安全和客服记录只会在服务、法律义务、争议处理和审计所需期限内保存。用户可以发送邮件至 vokie123@gmail.com，请求访问、更正或删除信息。法律或支付对账要求保留的记录可能无法立即删除。
6. 用户选择
用户可以清除浏览器本地状态、不提交非必要个人信息，并请求导出或删除与客服或付费交易相关的信息。执行请求前，我们可能需要验证请求人的控制权。
7. 儿童与变更
NexusKey 不面向 13 岁以下儿童。产品、供应商或法律要求变化时，我们可能更新本政策；页面顶部日期表示当前版本。