Privacy Policy

1. Data Controller and Data Processor Roles

2. Categories of Data We Collect

We collect personal information in the following structured categories:

3. How We Use Your Data (Purposes of Processing)

We process personal information strictly for legitimate operational purposes:

• Service Delivery: Account creation, client identity verification, project milestone delivery, payment billing, and customer support.
• Platform Improvement: Analyzing aggregate usage trends to optimize web performance, patch bugs, and deploy new feature enhancements.
• Security & Fraud Prevention: Monitoring systems for unauthorized intrusion, DDoS mitigation, cyber attack prevention, and security audits.
• Legal & Regulatory Compliance: Fulfilling corporate tax, accounting, audit, and legal disclosure duties.
• Communications: Sending operational service alerts, security notices, invoice updates, and opt-in newsletters.

4. Legal Bases (GDPR) & CCPA Business Purpose

Under the European General Data Protection Regulation (GDPR), we process personal data under four lawful bases:

For California residents, these categories align with permissible “business purposes” under the California Consumer Privacy Act (CCPA) and CPRA.

5. Data Sharing & Vetted Subprocessors

Nexelix Tech does not sell personal data. We only share personal data with trusted third-party service providers bound by Data Processing Agreements (DPAs) and strict confidentiality obligations:

6. Cookies & Tracking Controls (ePrivacy Directive)

Under the EU ePrivacy Directive and global web guidelines, non-essential cookies require prior explicit opt-in consent:

You may modify or withdraw cookie consent at any time by clicking the “Cookie Preferences” link in our website footer.

7. International Data Transfers

Nexelix Tech operates globally. Personal data may be transferred to or hosted in servers located outside your home jurisdiction (e.g., United States, EU). When transferring personal data out of the European Economic Area (EEA) or UK, we rely on recognized legal safeguards, including the European Commission’s Standard Contractual Clauses (SCCs) and Data Privacy Framework (DPF) certifications.

8. Data Retention Policies

We retain personal data only as long as necessary to fulfill the purposes for which it was collected or to comply with statutory accounting, legal, and dispute resolution duties. Account data is retained during active subscription status and archived for up to 6 years following account closure for corporate compliance. Following expiration of retention windows, data is securely overwritten, erased, or anonymized.

10. Data Security Measures

Nexelix Tech implements robust technical and organizational security controls aligned with ISO 27001 standards:

11. Children’s Privacy

Our Services are designed exclusively for business and professional users. We do not knowingly collect or solicit personal data from children under 16 years of age. If we discover that a minor under 16 has submitted personal information, we will immediately delete such data.

12. AI & Automated Decision-Making Transparency

Nexelix Tech develops AI/ML integrations for enterprise client applications. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on users without human intervention. Any client AI model execution is subject to human-in-the-loop oversight and custom DPA terms.

13. Changes to this Privacy Policy

We may revise this Privacy Policy periodically to reflect technological updates or legal changes. Material revisions will be posted on our website alongside an updated “Last Updated” date and, where appropriate, communicated via email. Continued use of the Services signifies acceptance of the revised policy.

14. Incident Response & Data Breach Notification

Nexelix Tech maintains a formal Data Incident Response Plan. In the event of a confirmed security incident impacting personal data:

• GDPR Notification: Regulators and impacted data subjects will be notified without undue delay and within 72 hours of confirmation where required by law.
• US Notification: Applicable US state Attorneys General and consumers will be notified within statutory deadlines (30–45 days).

15. Contact Information & DPO Status

Nexelix Tech has designated a dedicated Privacy Response Team. (As an agile software startup, no formal Data Protection Officer (DPO) is currently required under statutory thresholds; if designated in future, details will be published here).

16. Service Level Agreement (SLA) & Beta Features Addendum

Service Level Agreement (SLA): Nexelix Tech strives for 99.9% uptime across production SaaS infrastructure. SLA availability guarantees, scheduled maintenance windows, and service credit terms are defined in individual customer service level agreements.

Beta Features: Features designated as “Beta”, “Preview”, or “Experimental” are provided strictly “AS-IS” without uptime guarantees, SLA coverage, or warranties.

17. Open-Source Software & Anonymized Analytics

Nexelix Tech services utilize open-source software libraries licensed under MIT, Apache 2.0, and BSD licenses. Open-source components are subject to their respective software license disclaimers. Aggregate anonymized metrics collected for web performance optimization do not identify individual users.