Privacy policy

This page explains which personal data Nixorium processes, why, and for how long. Nixorium is an open-source project. Its online services are operated by HardyPress SRL (VAT number IT06749370489), the data controller for the processing described in sections 1–4. Contact: hello@nixorium.org. Full company details are in the terms of sale.

Nixorium itself runs on your school’s computers. The software you install does not send us anything unless you enable one of the optional services below.

1. Website

• Hosting. The site is served by Cloudflare. Cloudflare processes connection data, including IP addresses, to deliver pages and protect the service.
• Statistics. We use Cloudflare Web Analytics, which does not use cookies and does not track you across sites. We see aggregate page views only.
• Installer counter. Requests to nixorium.org/install.sh are counted per day. We store only the date and the count, never your IP address.
• E-mail. If you write to hello@nixorium.org (for example to ask to try Nixorium on two PCs), we use your message and e-mail address to reply and to take the steps you ask for before any contract. We keep them only as long as needed to handle the request and the related correspondence, and then delete them, unless they are needed for a contract.

2. Controller reports (optional)

Reports are off by default. If an administrator enables them on the controller, it sends one report a day, tied to a pseudonym that changes every month. The report contains the Nixorium version, the deployment mode, the size of the laboratory as a band (for example 6–15 computers) and whether at least one computer was ever verified to boot. It contains no names, computer names, files, logs or configuration contents. Cloudflare receives the connection’s IP address while serving the request; we do not store it in the reports or in application logs. These are pseudonymous statistics, not guaranteed to be anonymous: an unusual combination of version and size may be recognisable. Individual reports are kept for about 90 days; aggregate monthly counts, which contain no identifiers, are kept for 24 months. Reporting can be disabled at any time in the administrator interface: no new reports are sent and the local identifier is removed, while reports already received follow the retention periods above.

3. Nixorium Assistant (optional, subscription)

Assistant is an optional service that helps a laboratory administrator change and troubleshoot the laboratory configuration. It only works after the administrator activates it with a code and accepts a consent screen. Versions that support diagnostic logs, configuration history, system files and downloads require renewed acceptance of the updated screen before using these features.

Before activation. When Assistant is opened, the controller asks the service for the public price and trial terms. This request carries only the Nixorium version, plus the IP address of the connection, as any web request does; it carries no message, file or account data. Once Assistant is activated, the controller also checks the account (for example the remaining requests) with the laboratory’s access token, without sending a draft or any file.

What is sent when the administrator uses Assistant

• the messages written in the Assistant chat;
• the contents of the laboratory configuration files that Assistant reads while preparing a proposal, and the results of its checks (for example evaluation errors);
• technical context: Nixorium version and the list of configuration files;
• when Assistant checks the laboratory state, the same information shown in the administrator overview: computer names and laboratory addresses, whether each computer is reachable, the installed and expected configuration revision, pending updates and the result of the last update;
• on versions that support diagnostics, fixed read-only observations from declared laboratory computers: the current configuration revision, service state, free space, reset and update indicators, and bounded excerpts from current-boot logs for a predefined list of Nixorium and system services; on versions that support it, also the hardware a computer sees: USB devices with their manufacturer and product names, PCI devices by identifier and driver only (names are not looked up), display connectors, audio cards, printer queues with their address (any user name and password removed) and bounded kernel messages about these devices. Serial numbers are not read (values labelled as serial numbers are dropped from labels, messages and printer addresses), Bluetooth messages are dropped and network card hardware addresses are hidden;
• on versions that support it, system files of the controller or of a laboratory computer, read one at a time when the administrator’s request needs them: only allowlisted files, namely configuration under /etc, boot loader configuration, selected hardware and network facts from /proc and /sys, and Nixorium’s own state under /var/lib/nixorium and /run/nixorium, up to 256 KiB of text each. Home folders, /root, password and shadow files, private keys, Wi-Fi connection files, the machine identifier, reset snapshots and device serial numbers are refused, as are files whose names indicate secrets. Lines that set passwords, passphrases, pre-shared keys, tokens or keys are cut to their first word, and credentials in addresses are withheld;
• on versions that support configuration history, bounded saved Git commit metadata and visible configuration file changes within the ancestry of the saved configuration used for the conversation.

Before configuration contents, system files and tool results leave the controller, filters withhold or redact the passwords, keys and Wi-Fi credentials they recognize, such as password hashes, private keys, known token formats and Wi-Fi passphrases, and credential fields. Diagnostic excerpts also filter common private identifiers. Recognition is pattern-based and best effort: a secret in a format that is not recognized can still be sent, and personal or sensitive text may remain in configuration contents, system files, commit messages or log excerpts. The administrator should therefore not paste secrets in the chat or keep them in the tracked configuration files. Diagnostic tools do not read student home files.

Please do not write personal data about students or staff in the chat. The laboratory configuration normally contains no personal data about students.

Downloads made by the controller

When the administrator asks Assistant to prepare a public file, a VS Code extension or an npm package, the controller itself downloads it from its publisher (for example a program’s download address, the Visual Studio Code Marketplace or the npm registry), over the controller’s own Internet connection. Those sites see the controller’s IP address, as in any download. The downloaded files stay on the controller and are not sent to the Nixorium service; only the outcome (such as the file name, size and hash, or the extension version) is returned to Assistant.

Who processes it

• Our service (on Cloudflare) forwards each request to the AI model and returns the answer. Configuration files and tool results are not kept as separate records except in the saved conversations described below. It keeps the administrator’s latest message and the final answer of each request for 30 days to detect abuse, then deletes them. This log does not include tool results or file contents, but a message or an answer may itself quote configuration, history or diagnostic observations. The service also stores technical metadata about each request: time, number of steps, token counts, cost and outcome. We keep this metadata for 24 months, then delete it.
• The AI model is accessed through OpenRouter and run by the model provider (currently OpenAI, model GPT-6.1 Sol; OpenRouter, Inc. is based in the United States). We configure OpenRouter to route requests only to providers that do not use the data for training. The model provider (currently OpenAI) may keep requests for up to 30 days to detect abuse, then deletes them. These providers may process data outside the European Union, on the basis of the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.

Saved conversations

By default, Assistant saves its conversations on the Nixorium Assistant service for 90 days, to find and fix mistakes in Assistant. The administrator can switch this off at any time in the Assistant settings (“Save conversations on the service”). The administrator can also report an answer: after an answer, mark it as helpful or wrong and send that conversation, after a confirmation screen, each time.

What is saved is the conversation: the questions, the answers and the tool results Assistant used, including the configuration contents Assistant read, its check results and any configuration history or diagnostic observations it received. The controller’s best-effort redaction described above is applied first: recognized passwords, keys and Wi-Fi credentials are withheld or redacted before sending, but recognition is pattern-based, so the administrator should not paste secrets, and personal or sensitive text may remain. We use these conversations only to find and fix mistakes in Assistant and to improve it. They are stored privately, accessible only to the operator, and deleted after 90 days. Switching the setting off stops new conversations from being saved; conversations already saved can be deleted on request. The separate abuse log described above (the latest message and the final answer of each request, 30 days) is not affected by this setting.

Account data

To create a trial or a subscription we collect the school name, an email address and, if set, the laboratory name. We store a hash of the activation code and of the laboratory’s access token, not the token itself. Until it is used or expires, the activation code is also kept in encrypted form so that it can be sent again. We use the email address only to send the activation code and service messages about your subscription.

The registration form uses Cloudflare Turnstile to block automated abuse. Turnstile checks the browser without tracking cookies; Cloudflare processes the connection data needed for the check.

Free trial. We keep the email address of a trial for as long as the account exists, to tell laboratories apart and to limit how many codes an address can receive.

4. Payments and invoices

• Stripe processes payments and calculates taxes. We do not see or store card numbers.
• Fatture in Cloud (TeamSystem) prepares electronic invoices and sends them to the Italian Exchange System (SDI).
• Postmark sends our transactional emails.

Billing and invoice data are kept for the period required by Italian tax law (currently ten years).

5. Legal bases

• Website and installer counter: our legitimate interest in running and protecting the site (Art. 6(1)(f) GDPR).
• Controller reports and Assistant answer reports: your consent, given by enabling or sending them (Art. 6(1)(a) GDPR), withdrawable at any time.
• Saving Assistant conversations for 90 days: our legitimate interest in finding and fixing mistakes in Assistant and improving its quality (Art. 6(1)(f) GDPR), which we have weighed against the rights of the people concerned: recognized data is filtered, storage is limited to 90 days and only the operator has access. You can object at any time (Art. 21 GDPR) by switching off “Save conversations on the service” in the Assistant settings: later conversations are no longer saved.
• Assistant, account and payments: performance of the contract you request (Art. 6(1)(b) GDPR).
• Keeping the administrator’s latest message and the final answer of each Assistant request for 30 days to detect abuse: our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
• E-mail correspondence: steps taken at your request before a contract (Art. 6(1)(b) GDPR) and, for other enquiries, our legitimate interest in answering them (Art. 6(1)(f) GDPR).
• Invoices: compliance with legal obligations (Art. 6(1)(c) GDPR).

When a school uses Assistant, the school is the data controller for any personal data contained in what its administrator sends; we act as its data processor under a separate data processing agreement, available on request.

6. Your rights

You can ask for access, correction, deletion, restriction or portability of your data, and object to processing, by writing to hello@nixorium.org. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it). On request we delete an account’s personal data; invoices are kept for the period required by tax law.

7. Changes

We will publish changes on this page and update the date above.