Privacy notice

Who we are

NexusDM is run by Nathan Perkins, a sole trader in the United Kingdom, who is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. "We" and "us" in this notice mean Nathan Perkins.

For any question or request about your data, email contact@nexusdm.xyz.

What we collect, why, and for how long

Your account

Your email address, a hash of your password if you set one (never the password itself), and, if you sign in with Google, the identifier Google gives us for your Google account. We also keep your plan, your trial or subscription dates, and whether and how your email address was confirmed. We use this to create and secure your account and to provide the service you signed up for (lawful basis: contract). It is kept until you delete your account.

We keep encrypted backups of the service so that it can be restored after a failure. Data you delete stays in those backups until they are replaced on a rolling basis, and is used only if we need to restore the service.

When you sign up, your address and password hash are held as a pending sign-up for up to seven days while you confirm the address with a six-digit code, which expires after ten minutes. Unconfirmed sign-ups and expired codes are then deleted.

Your campaigns

Everything you put into NexusDM: campaigns, nodes, notes, sessions, templates, images and PDFs you upload (up to 500 MiB on a trial or Basic plan, 2 GiB on Pro). We store it only to provide the service to you (contract). It is kept until you delete it or delete your account, and you can export a campaign at any time, including when your account is read-only. Do not put other people's sensitive personal data in your campaigns.

The free-trial record

Each email address can start only one free trial. To enforce that, when a trial starts, and when an account that started with a trial changes its email address, we keep a one-way keyed fingerprint (an HMAC) of the address, normalised so that variants of it, such as the same address with a "+tag" added, count as the same address. The fingerprint is not linked to your account, cannot be turned back into your address, and is only ever compared with the fingerprint of an address someone tries to sign up with. It is kept for 365 days from when it was made, including after you delete your account, and then deleted automatically. While it is kept, the same address cannot start another trial. We rely on our legitimate interest in preventing repeated free trials (legitimate interests); the record is the least data that achieves this, and you may object to it (see below).

Payments

Paid plans are sold through Stripe, which acts as the merchant of record: Stripe is the seller, takes your payment details, calculates and collects tax, and issues invoices. Stripe handles that data as a separate controller under its own privacy policy, and we never see your card details. When you start a checkout we give Stripe your email address and your NexusDM account identifier, so that the subscription is linked to your account. We keep the identifiers that link your NexusDM account to your Stripe subscription, and the plan and dates of that subscription (contract), until you delete your account. Our log of subscription events holds no names, email addresses or payment details, and each entry is deleted after 90 days. Deleting your account cancels a live subscription first; Stripe keeps its own records as the law requires of a seller.

Emails we send

We send email only for your account: sign-up and email-change confirmation codes, password-recovery codes, and a notice when your password has been reset. We do not send marketing email. The messages are sent through Brevo.

Security and service logs

To keep the service secure and working, our servers and your browser send technical telemetry to our own monitoring system: which pages and API endpoints were used, how long requests took, errors, and the software versions involved. Server records can include your browser's user-agent string. We do not record email addresses, codes, passwords or tokens in them. Your IP address is used briefly, in memory, to limit repeated sign-in and sign-up attempts, and is not stored with your account. Telemetry is kept for 24 months so that we can investigate problems and abuse (legitimate interests).

Cookies and browser storage

The app uses only essential cookies and browser storage, to keep you signed in and to remember preferences. There is no analytics, advertising or third-party tracking. The details are in the app's cookie policy. This website sets no cookies. The Guide remembers in your browser's local storage whether you prefer its examples shown as the builder or as expressions; nothing is sent to us.

Email you send us

If you write to us, we keep the conversation for as long as needed to answer you and deal with any follow-up (legitimate interests).

Who else handles your data

• netcup (Germany) hosts the servers that run NexusDM, store your data and keep the monitoring telemetry.
• Brevo (France) delivers the emails described above.
• Stripe sells and bills subscriptions as merchant of record, as an independent controller.
• Google, only if you choose to sign in with Google, confirms who you are under Google's own privacy policy.

We do not sell your data or share it for advertising. Your data is stored in the European Economic Area, which the UK recognises as giving adequate protection. Stripe and Google may process data in other countries under the safeguards described in their own policies.

Your rights

You can ask for a copy of your personal data, ask us to correct or delete it, ask us to restrict how we use it, ask for it in a portable format, and object to any use we base on legitimate interests. Much of this you can do yourself: change your email address or password, export campaigns, and delete your account from your account page. For anything else, email contact@nexusdm.xyz. We reply within one month.

Because the free-trial record is not linked to your account, to act on it we will ask for the email address it was made from.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Age

NexusDM accounts are for people aged 18 or over.

Changes to this notice

When this notice changes, the date at the top changes. If a change affects how we use data we already hold, we will tell account holders before it applies. See also our terms of service.