Privacy & Data Handling

1. Execution Data & Privacy

NexArt stores execution integrity metadata rather than raw application data.

A Certified Execution Record (CER) typically contains:

• Certificate hash
• Execution identifier
• Input and output hashes
• Protocol version and runtime metadata
• Node attestation data
• Timestamps

NexArt stores cryptographic hashes of inputs and outputs, not the underlying payloads themselves. Hashes are one-way derivations used to bind execution results to a certification record without requiring the platform to store, process, or have access to the underlying data.

Raw AI prompts, model outputs, rendered artifacts, and user-supplied payloads are not stored by NexArt unless explicitly included in a CER bundle by the integrating application.

2. Public Verification Records

NexArt provides a public verification endpoint that allows anyone to independently verify the integrity of a Certified Execution Record using a certificate hash or execution ID.

Public verification records are redacted. Sensitive execution payloads, such as inputs, outputs, prompts, and application-specific data, are not included in the public response.

The verifier exposes only the information required to independently confirm record integrity:

• Certificate hash
• Execution ID
• Protocol version
• Node attestation
• Runtime hash
• Metadata fields provided by the application (e.g., bundle type, project name)

This design ensures that verification can occur without exposing the execution content that produced the record.

3. Responsibility of Integrating Applications

Applications integrating NexArt are responsible for the data they submit to the certification API.

Developers should avoid including personal identifiers in fields such as:

• executionId
• metadata
• projectId
• appId

These fields may appear in certification records and, where applicable, in public verification responses. Using internal or opaque identifiers is strongly recommended.

If personal data is included in submitted fields, the integrating application, not NexArt, is the data controller for that information under applicable privacy regulations.

4. NexArt's Role

NexArt operates as an execution integrity infrastructure provider. Its role is limited to:

• Generating Certified Execution Records
• Cryptographically binding execution metadata to certification artifacts
• Providing node attestations for sealed records
• Enabling independent verification of records

NexArt does not process or store the underlying user data that produced an execution unless that data is explicitly included in a CER bundle by the integrating application.

Where NexArt acts solely as a processor of cryptographic metadata on behalf of an integrating application, the integrating application remains the data controller for any personal data submitted to the API.

5. Operational Logs

NexArt may retain limited operational logs for service reliability, security monitoring, and abuse prevention.

These logs may include request metadata such as IP addresses, timestamps, and API key identifiers. Logs are retained for a limited period and do not include raw execution payloads, AI prompts, or model outputs.