Legal Documentation
Legal · Document 02

Privacy
Policy

Effective: January 1, 2025 Last updated: June 2025 Compliant: IT Act 2000 DPDP Act 2023
✓ Our Commitment

LuxurAI is built on a foundation of user trust. We collect only what we need, protect what we store, and give you control over your data. We do not sell your personal information — ever.

Section 01

Overview

This Privacy Policy describes how Nexinova AI ("LuxurAI", "we", "us") collects, uses, and protects your personal information when you use our platform at www.luxurai.in, our desktop application (LuxurAI Studio), and our mobile application.

This policy is compliant with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

Section 02

Data We Collect

Here is a transparent breakdown of every category of data we collect:

Data Type What We Collect Required?
Account Email address, account creation date, login provider (email/Google) Required
Wallet LC balance, transaction history, payment order IDs Required
Generations Job IDs, generation status, timestamps, LC cost per generation Required
Generated Content Images/videos stored in AWS S3 (linked to your account) Required
Prompts Text prompts you submit for image/video generation Required
Device Info IP address (for rate limiting), user agent, device type Required
Training Data Anonymized code bug→fix pairs (no PII ever) Optional
Referral Referral code used at signup (if any) Optional
Payment Details We do NOT store card numbers or UPI IDs — handled by Cashfree Not Stored
Section 03

How We Use Your Data

We use your data exclusively for the following purposes:

  • Service Delivery — Authenticating you, processing generations, managing your wallet
  • Payment Processing — Verifying transactions via Cashfree Payment Gateway
  • Fraud Prevention — Detecting abuse, bot activity, and unauthorized access
  • Rate Limiting — Preventing API abuse using IP-based limits
  • Platform Improvement — Anonymized usage analytics to improve the service
  • Communication — Sending magic link emails and critical account notifications
  • AI Training — Anonymized code training data (only with explicit consent)
  • Data Sanitization — Every prompt passes through our Safety Guard protocol before being forwarded to any AI model provider. Sensitive patterns (API keys, IP addresses, Aadhaar/PAN, phone numbers, credit cards) are automatically detected and redacted so that sanitized data only ever reaches model servers — never your real credentials
We Never: Sell your data to advertisers, share your email with third-party marketers, use your prompts for targeted advertising, or share personally identifiable information with any AI model provider. All prompts are sanitized by our Safety Guard before transmission to any external server, regardless of its location.
Section 04

Data Storage & Retention

  • Database: SQLite database backed up to a private GitHub repository — accessible only to LuxurAI systems
  • Media Files: Generated images and videos stored on AWS S3 (ap-south-1 region, India)
  • Sessions: JWT tokens stored as HTTP-only cookies, expire after 30 days
  • Account Data: Retained for the duration of your account plus 90 days after deletion
  • Generated Content: Retained until you delete it or your account is closed
  • Payment Records: Retained for 7 years as required by Indian financial regulations
  • Training Data: Anonymized code pairs retained indefinitely for model improvement
Local Processing & Data Sovereignty: Before any prompt is transmitted to our AI model providers — including American models such as Google Gemini or any Chinese AI models accessed via OpenRouter — it passes through our locally-hosted Safety Guard protocol running on LuxurAI's own infrastructure. This system scans for and redacts critical information such as API keys, IP addresses, Indian government IDs (Aadhaar/PAN), phone numbers, credit card numbers, JWT tokens, and passwords. This ensures that sensitive personal data is never transmitted to or stored on foreign servers. Only the sanitized, anonymized version of your prompt ever leaves our Indian infrastructure boundary.

All primary data is stored within India (AWS ap-south-1). We transmit only sanitized prompt content to AI model providers for generation purposes — never your identity, credentials, or sensitive personal information.

Section 05

Third-Party Services

LuxurAI integrates with the following third-party services. Each has their own privacy policy:

Service Purpose Data Shared
Google Gemini Head leader AI — routing, chat, video, documents Sanitized prompts only — Safety Guard redacts all sensitive data before transmission
DeepSeek / OpenRouter Chinese Models Coding, reasoning, low-cost generation tasks Sanitized prompts only — Zero-Leak Pipeline: real IPs, API keys, and credentials are fully redacted before any data leaves Indian infrastructure
LuxurAI Safety Guard Local pre-transmission sanitization Runs in India only — No data leaves this layer. Regex scan + Gemini AI judge. Redacts API keys, IPs, Aadhaar/PAN, phone numbers, credit cards, JWT tokens
Google OAuth Sign-in authentication Email, name (if Google login used)
Cashfree Payment processing Order amount, order ID
AWS S3 Media storage (ap-south-1, India) Generated files only
HeyGen + ElevenLabs Video avatar + voice synthesis Sanitized script / narration text only
Resend Magic link emails Email address
GitHub DB backup & training data Anonymized data only
Section 06

Training Data & AI Improvement

LuxurAI may collect anonymized bug→fix pairs from coding assistant sessions to improve our AI models. This is entirely opt-in:

  • You are shown a clear toggle at signup — default is ON
  • You can turn this off at any time in Settings → Privacy
  • Data collected includes: code patterns, bug types, fix approaches
  • Data excluded: your name, email, IP, device info, account ID
  • Stored in: private GitHub repository and/or Hugging Face dataset
Zero PII in Training Data: Our training pipeline is designed so that no personally identifiable information can enter the training dataset. User IDs are replaced with random tokens before storage, and all metadata is stripped.
Section 07

Cookies & Session Storage

LuxurAI uses minimal, necessary cookies:

  • luxurai_session — HTTP-only, Secure session cookie containing your JWT. Required for authentication. Expires in 30 days. Cannot be accessed by JavaScript.
  • No tracking cookies — We do not use Google Analytics, Facebook Pixel, or any advertising trackers.
  • No third-party cookies — No advertising networks have any presence on our platform.

The desktop and mobile apps use secure local storage (electron-store / flutter_secure_storage) instead of cookies to store your session token.

Section 08

Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

  • Right to Access — Request a copy of all personal data we hold about you
  • Right to Correction — Request correction of inaccurate personal data
  • Right to Erasure — Request deletion of your account and personal data
  • Right to Grievance Redressal — File a grievance with our data protection officer
  • Right to Withdraw Consent — Withdraw consent for optional data processing (e.g., training data)
  • Right to Nominate — Nominate another individual to exercise rights on your behalf

To exercise any of these rights, email [email protected]. We will respond within 30 days as required by the DPDP Act.

Section 09

Children's Privacy

LuxurAI is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from minors.

If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected] and we will delete such data promptly.

Section 10

Security

We implement industry-standard security measures to protect your data:

  • All data transmission encrypted via HTTPS/TLS
  • Session tokens stored as HTTP-only, Secure, SameSite cookies
  • Passwords are never stored (magic link authentication only)
  • Database backed up to private, access-controlled GitHub repository
  • AWS S3 buckets configured with private access policies
  • API keys stored as encrypted environment variables (Railway)
  • Regular security audits of our codebase
  • Safety Guard pre-transmission scan on every user message before it reaches any AI model
The LuxurAI Safety Guard — Dual-Layer Protection: Every message you send on LuxurAI passes through our proprietary Safety Guard before being forwarded to any AI model provider. This system operates entirely within our Indian infrastructure and works in two stages:

Layer 1 — Regex Fast-Pass (instant, ~0ms): Instantly detects and masks patterns matching known sensitive data formats — including credit card numbers, Indian phone numbers, API keys (OpenAI, Anthropic, Google, OpenRouter formats), IP addresses (IPv4/IPv6), Aadhaar numbers, PAN cards, JWT tokens, private keys, and hardcoded passwords. Example: 9876543210 becomes 987****210.

Layer 2 — AI Security Judge (~300ms, only if Layer 1 triggered): If the regex scan flags suspicious content, a high-security Gemini model analyzes the message to determine whether the flagged data is a real credential or simply example/placeholder code (e.g., your_api_key_here). This prevents false positives while ensuring genuine secrets are always redacted.

Redaction: If real sensitive data is confirmed, the middle digits are masked before the prompt is transmitted. The user receives a real-time warning: "⚠ You sent critical data. Our server has masked some digits for your safety."
Cross-Border Protection — Zero-Leak Pipeline: LuxurAI is engineered to be model-agnostic and location-agnostic. Regardless of whether a model's server is physically located in the United States, China, Europe, or elsewhere, our Zero-Leak Pipeline ensures that your real IP address, unmasked API keys, government IDs, and sensitive credentials never reach any model provider's server. Your prompt arrives at the model server already sanitized and anonymized. This guarantee applies equally to American providers (Google Gemini) and Chinese providers (DeepSeek, Qwen, GLM via OpenRouter). The Safety Guard does not discriminate by model origin — it protects your data universally.
Data Breach Response: In the event of a data breach affecting your personal information, we will notify you via email within 72 hours and report to the Data Protection Board of India as required by the DPDP Act, 2023.
Section 11

Contact & Data Protection Officer

For privacy-related queries, data requests, or to file a grievance:

We are committed to resolving all privacy grievances within 30 days. If you are unsatisfied with our response, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act, 2023.

Policy Updates: We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email before they take effect. The "Last Updated" date at the top reflects when changes were made.