Privacy Notice

1. Public screening tools and AI Opportunity Snapshot

The free AI Opportunity Snapshot asks for high-level business screening answers and, before displaying the complete personalized result, asks for a first name and email address. Company name and mobile phone are optional. When the visitor submits the Snapshot, Nexus stores the submitted contact information, the high-level screening answers, the calculated opportunity score, and the ranked opportunity result so Nexus can deliver the Snapshot, preserve the prospect journey, understand interest in Nexus services, and conduct relevant follow-up. SMS marketing consent is separate and optional; providing a phone number does not by itself constitute consent to receive marketing texts. Other public tools may operate primarily in the visitor’s browser unless the feature expressly states that information will be submitted. Visitors should not enter passwords, authentication secrets, confidential documents, regulated personal data, client secrets, or information they are not authorized to disclose into public screening tools.

2. Client Portal

The authenticated Client Portal is different from the public screening tools. When a user creates or uses a portal account, Nexus’s service providers may process account identifiers, authentication information, company/workspace information, tasks, project dates, milestone records, measurement records, activity records, notifications, and documents intentionally uploaded to the private company workspace. Portal information is used to administer the workspace and, where a signed client agreement exists, to support the contracted engagement.

3. Categories of information

Depending on features used, categories may include business contact information such as name, email, optional phone number, company and role information; Snapshot and diagnostic responses and results; communication and consent preferences; account/authentication records; website and consent information; device/browser and IP-related technical data; project/task information; process and measurement records; communications; filenames and document metadata; and the contents of documents a user intentionally uploads to the authenticated portal.

4. Documents and sensitive information

The portal provides an authenticated, private document workspace, but users should still minimize what they upload. Do not upload passwords, authentication secrets, payment-card data, medical records, highly sensitive personal information, regulated data, or confidential third-party material unless Nexus has expressly approved that data type and handling method in a signed engagement and the user is authorized to provide it. Public forms and public screening tools remain inappropriate for sensitive documents.

5. Purposes

Information may be used to operate and secure the website and portal; generate and preserve requested Snapshot or diagnostic results; respond to inquiries; conduct relevant business follow-up; honor communication and consent choices; authenticate accounts; maintain company workspaces; exchange client-approved documents; coordinate tasks and milestones; record measurement history; provide workspace notifications; administer contracted services; maintain business records; understand website usage after consent; and comply with applicable legal obligations.

6. Service providers and recipients

Information may be processed by service providers used for hosting, database/authentication, private file storage, analytics/CRM, communications, scheduling, automation, security, and professional services, as those functions are actually enabled. Nexus currently uses Supabase infrastructure for database records, authentication, private file storage, and application data services. The public site is delivered through Cloudflare Pages; Vercel may remain available temporarily as a development or rollback path during migration. HubSpot analytics may load only after the applicable analytics consent. Third-party providers process information under their own contractual and technical terms.

7. Portal access controls

The current portal is configured so authenticated company users are scoped to their permitted company workspace and the document bucket is private. Database and file-access rules use row-level authorization controls. These controls reduce exposure but do not make any internet-connected system immune from configuration mistakes, unauthorized access, provider failures, credential compromise, or other security events.

8. Notifications and text consent

The portal may display in-app notifications and, if a user grants browser permission, may display browser notifications while supported by the user’s device/browser. The AI Opportunity Snapshot may collect optional consent for future Nexus text messages. Collecting that consent does not mean an SMS delivery system is currently active, and text delivery is not represented as operational until Nexus enables and discloses the applicable communications service. Email, SMS, push, and other notification delivery are not guaranteed.

9. Analytics and tracking choices

Optional HubSpot analytics is configured to load only after the visitor selects “Accept” in the website consent banner. If the browser exposes a Global Privacy Control signal through the supported browser interface, the current website treats that signal as a decline for optional analytics. Browser “Do Not Track” signals are not treated as a separate universal instruction because there is no single industry-standard interpretation.

10. Sale, targeted advertising, and sensitive data

Nexus does not intend to sell personal information collected through the website or portal. Nexus does not request sensitive personal data through the public diagnostic or Snapshot. If future functionality materially changes these practices, this notice and applicable consent mechanisms should be updated before materially different processing begins.

11. Review, correction, deletion, and privacy requests

Nexus should maintain a monitored privacy contact method as the commercial launch matures. Where applicable law grants access, correction, deletion, opt-out, appeal, or other rights, requests will be evaluated according to the law applicable to the requester and processing at issue. Identity, account ownership, or authority may need to be verified before action is taken.

12. Data minimization and retention

Nexus intends to collect and retain information only as reasonably necessary for the stated business purpose, contractual obligations, legal requirements, security needs, dispute/documentation needs, and operating practices. Portal retention and deletion rules may also be defined in a signed client agreement. Closing an account or completing an engagement does not necessarily require immediate deletion where lawful business, contractual, backup, security, or legal retention obligations remain.

13. Security

Nexus seeks reasonable administrative, technical, and organizational safeguards appropriate to the information and service, including authenticated access and private storage for current portal documents. No website, cloud provider, authentication system, transmission method, storage service, AI system, or security control can be guaranteed completely secure.

14. Children

This business-to-business service is not directed to children and is not intended to knowingly collect personal information from children through lead-generation or portal features.

15. Policy changes

Material changes will be reflected by an updated effective date and, where reasonably appropriate, a website or account notice or renewed consent request before materially different optional processing begins.

16. State and other privacy laws

Different U.S. state and other privacy laws may apply depending on Nexus’s scale, visitors, activities, contractual relationships, and data practices. Applicable thresholds and obligations should be reassessed as the business grows.