Privacy policy

When you use Nexus

• Account data: your name, email address, password (stored only as a scrypt hash), language and security settings such as two-factor authentication.
• Profile content: what you choose to publish, such as your photo, job title, company, bio, phone numbers, email addresses, links and files.
• Cards: the cards linked to your account, their material and status.
• Billing: your plan, billing period, company details and, when card payments are enabled, payment information handled by our payment provider. We never see or store full card numbers.
• Support and sales: what you tell us when you request a plan, order cards or contact support.

When someone views or taps a profile

• Anonymous analytics: the type of event (view, tap, save, link click), the time, coarse location (country and city), device type and referring source. To count unique visitors we store a short hash made with a salt that changes daily and is deleted after two days. We do not store IP addresses with analytics and we do not use cookies on public profiles.
• Details visitors choose to share: if a visitor uses Exchange or a lead form, we store what they enter, the consent they gave and the time they gave it, on behalf of the profile owner.

Security logs

To protect accounts we record security events, such as sign-ins, password changes and administrative actions, together with the IP address and browser used. These logs are used only for security and fraud prevention.

• To provide Nexus (contract): run your account, publish your profile, make your cards work, show your analytics and deliver contacts to you.
• To keep Nexus secure (legitimate interests): prevent abuse, rate-limit requests, detect fraud and investigate incidents.
• To bill you (contract and legal obligation): manage plans, invoices and tax records.
• To communicate (contract and legitimate interests): send service emails such as sign-in links, receipts and, if you enable it, a weekly summary. We don't send marketing email without your consent.
• To improve Nexus (legitimate interests): understand, in aggregate, which features are used.

We do not sell personal data, and we do not use it for advertising.

We share data only with the providers that help us run the service (our subprocessors), under contracts that require them to protect it. The current list, with what each provider does and when, is on our security page.

Some providers are used only if you or a visitor choose a feature: for example HubSpot when you connect your CRM, or Apple and Google when a visitor adds your card to their wallet.

We may disclose data where required by law, and we will push back on requests that are not legally valid. If Nexus is ever involved in a merger or acquisition, we will tell you before your data becomes subject to a different policy.

Our primary data region is European Union: our database, backups and uploaded files are stored there. Some subprocessors may process data in other countries; where data leaves the European Economic Area or the United Kingdom, we rely on adequacy decisions or standard contractual clauses.

• Account, profile and contact data: while your account is active. When you delete your account, we delete this data from our live systems, and it drops out of backups as they expire.
• Analytics events: about 25 months.
• Daily analytics salts: 2 days.
• Webhook delivery logs: 30 days.
• Closed sales requests: 2 years.
• Billing records: as long as tax law requires.

Depending on where you live, including under the GDPR and UK GDPR, you have the right to:

• access the personal data we hold about you and get a copy (Art. 15);
• correct inaccurate data (Art. 16);
• delete your data (Art. 17);
• restrict or object to certain processing (Art. 18 and 21);
• take your data with you in a portable format (Art. 20);
• withdraw consent at any time, where we rely on consent.

You can export and delete most data yourself from the dashboard. For anything else, email hello@nexustap.co. We respond within one month. If you shared your details with a Nexus user through their profile, that user is responsible for your data; we'll help them respond, and you can also contact us directly.

You also have the right to complain to your local data protection authority.

Public profiles set no cookies. The dashboard uses strictly necessary cookies to keep you signed in and remember your language and theme. We don't use advertising or third-party tracking cookies, so we don't show a cookie banner.

We protect data with encryption in transit and at rest, field-level AES-256-GCM encryption of contact details and secrets, hashed passwords, optional two-factor authentication, rate limiting and audit logs. Read the details on our security page.

Nexus is a professional tool and is not intended for children under 16. We don't knowingly collect their data.

If we make material changes, we'll tell account holders by email or in the dashboard before they take effect. The date at the top shows when this policy last changed.