Privacy notice

Nexus Soft Ltd is the controller for personal data collected through this public website. Business address: Jordan Nenov 32, Pazardjik, Bulgaria. For privacy enquiries, use our contact form or select Show email in the Legal contact panel and include “Privacy request” in the subject line.

This notice covers www.nexus-soft.org, its member workspace, the separate administration portal at admin.nexus-soft.org, people who contact us and business representatives whose details an authorised administrator provides. It does not replace a deployment-specific privacy notice or data processing agreement where Nexus processes advertising or customer data on documented instructions for a client.

Selling AdTech software is different from using visitor data for advertising. This corporate website does not run customer advertising campaigns or sell advertising profiles. An operator using Nexus modules under its own brand must explain its own traffic collection, partners, consent requirements and data protection roles to its users.

We collect information that you provide, limited technical information required to operate and secure the service, and authentication information created when you use an account.

We use personal data only where a lawful basis applies. The applicable basis can vary with the context of your request.

You can read public pages without an account, submitting an enquiry, using AI or accepting analytics. The contact form requires a name, reply email, area of interest and message so we can handle the request. Company and other project context are optional. You can instead use Show email on the contact page.

Account access needs an email address that you control and successful verification. If you choose Google, we receive identity information, not your Google password or permission to read your Gmail mailbox. Platform onboarding details, where collected, help an administrator evaluate provisioning; an enquiry or retained onboarding request does not automatically create a deployment.

Acknowledging this notice or accepting website Terms is not consent to analytics, direct marketing or customer advertising tracking. Submitting an enquiry does not subscribe you to a newsletter. You may object to business follow-up; essential responses to your request and security or account messages are separate from marketing.

The public MCP server exposes product documentation, structured advertising-format information and deployment guidance. It is not designed to receive personal data and its public tools do not provide arbitrary access to customer databases or credentials.

The website AI assistant selects answers from the Nexus public product knowledge base. Nexus processes the current question and bounded recent messages to identify context. When an OpenAI API connection is configured, we send the current question, inferred product context and candidate public facts to OpenAI to select supporting evidence; we do not send the complete conversation history in that provider request. The request disables response storage, which is not a promise of zero provider-side retention. Without that connection, the guide uses local knowledge selection.

The website application does not save a chat transcript in its database. Conversation state remains in the open page; provider-side security or service retention may apply to external requests. Do not submit personal, confidential, regulated or customer traffic data to the public assistant.

The public guide cannot approve accounts, award a contract, buy media, change a customer platform or make decisions with legal or similarly significant effects about you. Account permissions and platform requests are reviewed by administrators. Authentication and abuse controls may automatically deny a request; contact us if you believe access was blocked in error.

The site uses strictly necessary authentication cookies when you sign in and local browser storage to remember your privacy choice. Google Analytics 4 is an optional capability of the public website: it runs only when configured and after you give valid, current analytics consent. No Google analytics script or request is loaded before that consent.

Analytics is excluded from administrator, member, authentication and API pages and from the administration hostname. Measurement uses canonical public page paths and predefined events, without URL query strings or fragments, form content, AI chat text or account User-IDs. Advertising features and Google Signals are disabled. Marketing tracking is not installed.

After analytics consent, we can distinguish a small set of approved, non-personal campaign labels, such as a company email signature or demo follow-up, and an external referring origin without its path or query. This is website acquisition measurement, not email-open tracking, recipient identification or advertising profiling. Unknown campaign values are not forwarded. A short-lived record in the current browser tab helps preserve that source across public-page navigation; details and expiry are in the Cookie notice.

Analytics cookies are limited to the public website host, use path /, and expire after no more than 180 days without renewal on each visit. Cookie lifetimes and the privacy preference lifetime are separate from Google Analytics property data-retention settings. Full names, purposes and durations are listed in the Cookie notice.

Google Workspace is used for business email and the configured transactional SMTP relay. It processes recipient addresses and message content for registration confirmation, password reset and business correspondence. Account passwords are never included in those messages. Software support for an alternative mail provider does not mean your messages are sent to every supported provider.

Website enquiries are saved in a protected administrator inbox. When email delivery is configured, the selected mail provider also processes the submitted business brief and your email address to notify the Nexus team inbox. Your email is used as Reply-To so the team can respond. Submitting the form does not automatically send an email to the visitor or book a meeting.

Access inside Nexus Soft is limited to people who need the information for sales, support, account administration, security or legal responsibilities. Hosting and database operators process information needed to run the website and private workspaces. Configured monitoring services may receive sanitised technical error and security metadata; the application supports Better Stack for this purpose. Professional advisers or competent authorities may receive information needed for a specific legal matter. Provider access and processing locations must be covered by the relevant service arrangements.

Google receives and returns authentication data when an authorised portal user chooses Google sign-in. OpenAI may process AI chat content only when the external AI connection is configured and you submit a question. We may disclose information where required by law or necessary to protect legal rights and service security.

Google processes the limited public website analytics data described above only when Google Analytics 4 is configured and you consent to analytics. That analytics purpose is separate from Google sign-in and account email delivery. We do not send account User-IDs, form content or AI conversations to Google Analytics.

We do not sell personal data collected through this corporate website.

Google services, an enabled external AI connection and infrastructure or support providers may involve processing outside the European Economic Area, including in the United States. A European company address or server location does not by itself mean that all service-provider access remains in the EEA.

An international transfer requires an applicable safeguard, such as an adequacy decision covering the recipient or Standard Contractual Clauses with any necessary supplementary measures. The relevant mechanism depends on the receiving entity and service agreement, not merely the provider brand. You can request information about the safeguards applicable to your data, including a copy where available, through the privacy contact route. This notice is not itself a transfer agreement or a claim that every provider has the same certification.

The precise hosting region and subprocessors for a customer platform are confirmed in deployment documentation rather than assumed from this public website notice.

The table distinguishes application expiry rules from records that require a purpose-based review. Database expiry cleanup is asynchronous, not instantaneous. A separate restricted record may be kept where a specific legal obligation or active claim requires it. Deleting browser storage does not delete server-side records or correspondence already delivered to a mailbox.

Subject to the conditions in applicable law, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Send a privacy request through our contact form or select Show email in the Legal contact panel and use “Privacy request” in the subject. No account is required. We may request proportionate identity verification, not your password. We respond within one month; if the number or complexity of requests requires up to two additional months, we explain the extension within the first month. Requests are normally free, subject to the statutory rules for manifestly unfounded or excessive requests.

You may complain to the Bulgarian Commission for Personal Data Protection or the supervisory authority in the EU/EEA country of your habitual residence, workplace or the alleged infringement.

Nexus supports member registration with a verified email and password or Google. Passwords are stored as salted scrypt hashes, never plaintext. Email verification and password reset use expiring, single-use links. Revocable opaque sessions use signed HTTP-only cookies; Google sign-in uses state and PKCE protection. Server-side role and platform assignment checks, credential-version checks, administrator allowlists, bounded inputs, trusted-origin checks, rate limits and security audit records protect access. Registration never grants platform access. No internet service is risk-free.

Please do not send passwords, authentication tokens, raw user-level advertising data, payment details, special-category data or other unnecessary confidential information through the contact form or public AI assistant.

This business website and its authenticated services are not directed to children. We do not knowingly request personal data from anyone under 18 through the public website. Contact us if you believe a child has submitted information so that we can review and take appropriate action.

We may update this notice when the website, providers or legal requirements change. Material changes will be identified by a new effective date and, where appropriate, an additional notice.

Controller: Nexus Soft Ltd. Contact us through the contact form or select Show email in the Legal contact panel. Use the subject “Privacy request” so the request reaches the appropriate team.