Platform privacy policy
Effective date: 5 November 2026
1. Who is responsible
The controller of the data described in this policy is RAGnexus S.L. You can contact us at javier@ragnexus.com.
2. What this policy covers
RAGnexus is an AI platform for businesses, built on the open-source software Onyx. Each customer has its own isolated workspace. The platform offers chat with AI models, search across company documents, web search, agents, and connections to other apps (connectors).
This policy applies to anyone who signs up for and uses the platform at app.ragnexus.com, including the free trial. The ragnexus.com website has its own privacy policy.
3. What data we process
Account data
- Email, display name, and password. The password is stored as a hash, so we never know it.
- If you sign in with Google: your Google account ID, email, and name. We only request the basic sign-in permissions (openid, email, and profile). We do not access your Gmail, Drive, or any other Google account data this way.
Content
- Chat messages and responses.
- Documents and files you upload.
- Content synced from connectors your organization enables.
- Agents you create and workspace settings.
Usage data
- AI model usage per workspace (cost and number of tokens).
- Number of indexed documents.
- Date of last activity.
- Platform usage events (for example, that a message was sent, a connector was created, or a user signed up), linked to internal user and workspace IDs. These events don't include the content of your messages or documents.
Technical data
- Server logs (requests and errors), which may include your IP address.
- Cookies needed for the platform to work (see section 11).
Bot protection
- We use Google reCAPTCHA on sign-up, sign-in, and Google sign-in. It analyzes browser and device data to tell people from bots.
Communications
- Verification emails, workspace invitations, and inactivity notices.
4. Why we use it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account and provide the service (chat, search, agents, connectors) | Account, content, usage | Performance of a contract (Art. 6(1)(b) GDPR) |
| Send verification emails and invitations | Account | Performance of a contract (Art. 6(1)(b)) |
| Protect the platform and prevent abuse and bots | Technical, reCAPTCHA, account | Legitimate interest in keeping the service secure (Art. 6(1)(f)) |
| Cap free usage (USD 2 per workspace per week on AI models) | Usage | Performance of a contract (free-trial terms) |
| Notify you of inactivity and delete inactive workspaces | Account, usage | Performance of a contract and legitimate interest in not keeping unnecessary data (Art. 6(1)(b) and (f)) |
| Handle support requests | Account and what you tell us | Performance of a contract (Art. 6(1)(b)) |
| Internal reports and usage statistics to run and improve the platform | Usage, account | Legitimate interest in managing, planning, and improving the service (Art. 6(1)(f)) |
Where we rely on legitimate interest, you can object by writing to us (see section 10).
RAGnexus does not use your content to train AI models. The providers of the free models have their own terms; see section 6.
5. Customer content: RAGnexus as processor
The content an organization uploads or connects to its workspace (company documents, emails, customer or employee data, etc.) is that organization's responsibility. For that content, the customer organization is the controller and RAGnexus acts as processor: it processes the content only to provide the service and on the customer's instructions.
If your organization processes third parties' personal data in RAGnexus, it needs a data processing agreement with us. You can request one at javier@ragnexus.com.
If your company invited you, please contact your company first with questions about that content.
6. Who we share data with
We only share data with the providers we need to run the service:
- Hostman Ltd: hosting for the servers, database, and files, in data centers in Frankfurt (Germany).
- Hetzner Online GmbH: hosts, in Germany, the dedicated server RAGnexus uses to send its own emails (verification, invitations, and notices).
- OpenRouter (United States): routes chat messages to the free-trial AI models: GLM (Z.ai), Qwen (Alibaba), and DeepSeek. We don't restrict the region, so these models may run in the United States, China, or other countries outside the European Economic Area. They receive the text of your messages and the context needed to answer (for example, excerpts from your documents). Some of these providers may keep messages or use them to improve their models under their own terms. We recommend not entering sensitive personal data or confidential information while using the free models.
- Google: Google Sign-In and reCAPTCHA Enterprise.
- Web search: we use SearXNG, hosted by RAGnexus, which sends the text of your searches to public search engines (for example, Google). Those queries don't include your identity, but they do include what you search for.
- Telemetry: the platform sends the usage events described in section 3 to a RAGnexus server (telemetry.ragnexus.com).
Providers connected by the customer. If your organization connects its own providers (other AI models, search services, or connectors), that processing is governed by the agreements between your organization and those providers.
We do not sell your data or share it with third parties for advertising. We only disclose it to authorities when the law requires us to.
7. Transfers outside the European Economic Area
Your data is hosted in Germany. Some providers process it outside the EEA:
- OpenRouter and the free-model providers, which may be in the United States, China, or other countries. Some of these countries, such as China, have no European Commission adequacy decision.
- Google (United States): Google LLC is certified under the EU-U.S. Data Privacy Framework and also uses standard contractual clauses.
You can ask us about these transfers at javier@ragnexus.com.
8. How long we keep data
- Active workspace: while you use it, until you delete the content or close the account.
- Inactive workspace: we email you after 30 days without use, send a final notice at 53 days, and delete the workspace entirely at 60 days (data, documents, files, and search index).
- Backups: we take daily database backups and keep them for 2 months. Deleted data disappears from backups when they expire.
- Server logs: 2 months.
9. Security
Each workspace is isolated from the others, and passwords are stored as hashes.
10. Your rights
You can exercise your rights at any time to:
- access your data;
- rectify inaccurate data;
- erase your data;
- object to processing based on legitimate interest;
- restrict processing;
- data portability, to receive your data in a structured format;
- withdraw consent where processing is based on it.
Email javier@ragnexus.com stating which right you want to exercise. We will reply within one month at most. For content in a company workspace, we will pass the request to that company, which is the controller.
If you think we have mishandled your data, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the authority in your country.
12. Your Google account data
If you sign in with Google, we only receive your account ID, email, and name. We use them solely to create your account and identify you at sign-in. We don't sell them, use them for advertising, or share them with third parties other than the hosting providers listed in section 6.
Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
13. Children
RAGnexus is intended for businesses and may only be used by people aged 18 or over. If we learn that a minor has given us data, we will delete it.
14. Changes to this policy
If we make significant changes to this policy, we will notify you by email or in the platform before the change takes effect.