Privacy Policy

Allnexio helps you understand spending and usage across the AI services you use. This policy explains what we collect, why, and the choices you have. We do not sell personal data, and we do not use advertising or third-party analytics trackers.

Information we collect

• Account information — your name, email address and sign-in details, managed by our authentication provider (Clerk). If you sign in with Google we receive your name, email address and profile image from Google.
• Provider credentials — API or admin keys you choose to connect. They are encrypted with AES-256-GCM before storage, never displayed again, and deleted when you disconnect the provider.
• Usage and cost data — normalized usage, cost, invoice and account metadata that we read from connected providers using read-only endpoints. We do not store raw provider responses.
• Discovery suggestions — only if you opt in. Our local tools run on your device and send nothing automatically; if you choose to import a report, it contains only a provider name, source type and date. Gmail discovery reads sender and date metadata of receipt-like messages on your device and never reads message bodies or attachments. We never read cookies, saved passwords or arbitrary files.
• Operational records — sync history, security audit events and redacted application logs needed to run and protect the service.

How we use information

We use this information only to provide Allnexio: to authenticate you, sync and display your AI usage and spend, send service emails you need (such as sign-in codes), keep the service secure, and troubleshoot problems. We do not use your data to train AI models.

Google user data

Allnexio’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google sign-in data is used only to create and secure your account. Gmail discovery runs locally on your device; its access token is never sent to or stored by Allnexio, and you can revoke it at any time in your Google Account connections.

Service providers

We rely on a small number of providers to run Allnexio:

• Amazon Web Services — hosting, database and transactional email
• Cloudflare — DNS and email routing
• Clerk — authentication and account management
• Google — optional sign-in with Google

They process data on our behalf only to provide their services to us.

Retention

• Provider credentials: until you disconnect the provider.
• Usage and cost history: up to 730 days, including after a disconnect.
• Discovery evidence and source consent: 90 days; suggestions 180 days without renewal.
• Sync history: 90 days; security audit events: 365 days.
• Database backups: up to 14 days, after which deleted data is gone from backups.

Your choices and rights

You can export your workspace data or permanently delete your workspace at any time from Settings. You can disconnect any provider or revoke any discovery source instantly. To access, correct or delete personal data, or for any privacy question, email privacy@allnexio.com.

Security

Credentials are encrypted at rest, every query is scoped to your workspace, provider access is read-only, and traffic is encrypted in transit with TLS. No system is perfectly secure; if you believe you have found a vulnerability, contact security@allnexio.com.

Children

Allnexio is not directed to children under 16 and we do not knowingly collect their data.

Changes

We will update this page when our practices change and, for material changes, notify account holders by email.