Privacy Policy

1. Information We Collect

We collect information that you provide directly to us and information that is automatically collected when you use our Service. The types of information we collect include:

1.1 Information You Provide

We collect information that you voluntarily provide when you:

• Register for an account or create a profile
• Subscribe to our Service or make a purchase
• Contact us for support or submit inquiries
• Participate in surveys, contests, or promotions
• Upload content or data to the Service
• Communicate with us via email, chat, or phone

1.2 Automatically Collected Information

When you use our Service, we automatically collect certain information, including:

• Log Data: IP address, browser type, device information, pages visited, time and date of visits
• Cookies and Tracking Technologies: See our Cookie Policy for details
• Usage Analytics: How you interact with the Service, features used, and performance metrics

1.3 Information from Third Parties

We may receive information about you from third-party services, such as payment processors (Stripe), analytics providers (Google Analytics), and business partners, in accordance with their privacy policies.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Provision: To provide, maintain, and improve our Service, process transactions, and fulfill your requests
• Account Management: To create and manage your account, authenticate users, and provide customer support
• Communication: To send you service-related notices, updates, and promotional communications (with your consent where required)
• Analytics and Improvement: To analyze usage patterns, improve our Service, and develop new features
• Security and Compliance: To detect, prevent, and address fraud, security issues, and legal compliance requirements
• Business Operations: To manage our business, conduct research, and make data-driven decisions

We do not sell your personal information to third parties. We may share aggregated, anonymized data that cannot identify you for business and research purposes.

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Contract Performance: To fulfill our contractual obligations to provide the Service
• Legitimate Interests: To improve our Service, ensure security, and conduct business operations
• Consent: When you have provided explicit consent for specific processing activities
• Legal Obligations: To comply with applicable laws and regulations

You have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.

4. Data Sharing and Disclosure

We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment processing (Stripe)
• Cloud hosting and infrastructure
• Analytics and monitoring services
• Customer support tools
• Email and communication services

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.2 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership or control.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or to:

• Comply with legal obligations
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Respond to government requests

4.4 With Your Consent

We may share your information with third parties when you have provided explicit consent for such sharing.

5. Data Retention

We retain your personal information for as long as necessary to:

• Provide the Service and fulfill our contractual obligations
• Comply with legal, tax, and regulatory requirements
• Resolve disputes and enforce our agreements
• Maintain business records for legitimate business purposes

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal or legitimate business purposes.

Aggregated and anonymized data that cannot identify you may be retained indefinitely for analytics and business purposes.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

6.1 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@nexelya.com. We will respond to your request within 30 days (or as required by applicable law).

We may need to verify your identity before processing your request. In some cases, we may charge a reasonable fee if your request is excessive or unfounded.

6.2 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

7. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access controls and authentication requirements
• Security Monitoring: Continuous monitoring for security threats and vulnerabilities
• Regular Audits: Security assessments and compliance audits (SOC 2 Type II certification in progress)
• Backup and Recovery: Regular backups and disaster recovery procedures

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

If we become aware of a security breach that may affect your personal information, we will notify you and relevant authorities as required by law.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country.

When we transfer personal data from the EEA to other countries, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission
• Other legally recognized transfer mechanisms

By using our Service, you consent to the transfer of your information to countries outside your jurisdiction, subject to appropriate safeguards.

9. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will take steps to delete that information. If you believe we have collected information from a child, please contact us immediately.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of categories and specific pieces of personal information collected, used, and shared
• Right to Delete: Request deletion of personal information we have collected (subject to exceptions)
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell personal information)
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your California privacy rights, contact us at privacy@nexelya.com.

11. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

To exercise these rights, contact us at privacy@nexelya.com. You also have the right to file a complaint with your local data protection authority.

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your use of our Service. For detailed information about our use of cookies, please see our Cookie Policy.

You can control cookies through your browser settings, but disabling certain cookies may affect your ability to use some features of our Service.

13. Third-Party Links and Services

Our Service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

Third-party services we use include payment processors (Stripe), analytics providers (Google Analytics), and cloud infrastructure providers. These services have their own privacy policies governing the use of your information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification (for material changes)
• Displaying a notice in the Service

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

15. Data Protection Officer

For users in the EEA, we have designated a Data Protection Officer (DPO) to oversee our data protection practices. You can contact our DPO at:

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to your inquiry within 30 days or as required by applicable law.