PRIVACY POLICY

1. WHAT WE COLLECT

We collect only the data necessary to provide the NEXUS platform service:

• Account data: Name, email address, organization name, password hash
• Usage analytics: Feature usage patterns, session duration, page views (aggregated, no PII)
• Payment information: Billing address, payment method (processed by third-party; we never store card numbers)
• Device information: Browser type, OS, IP address (for security and abuse prevention)

2. LEGAL BASIS

We process your data under the following legal bases (GDPR Art. 6):

• Contract performance (Art. 6(1)(b)) — to provide the NEXUS platform service
• Legitimate interest (Art. 6(1)(f)) — security monitoring, fraud prevention, service improvement
• Consent (Art. 6(1)(a)) — marketing communications (opt-in only)

3. DATA PROCESSORS

We share data with the following processors, all under Data Processing Agreements:

• Cloudflare (USA) — CDN, DDoS protection, DNS
• Hetzner (Germany) — server hosting, data storage
• Monobank / Paddle — payment processing
• Google Workspace — email infrastructure

We do not sell, rent, or share your personal data with third parties for their marketing purposes.

4. DATA RETENTION

• Account data: Retained while your account is active + 90 days after deletion
• Server logs: 90 days rolling retention
• Payment records: 7 years (tax and legal compliance)
• Analytics data: 12 months (aggregated, anonymized)

5. YOUR RIGHTS

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Port your data to another service
• Restrict processing
• Object to processing based on legitimate interest

To exercise any of these rights, contact us at privacy@zeltrex.com. We will respond within 30 days.

6. INTERNATIONAL TRANSFERS

Your data is primarily stored on servers in Germany (Hetzner, EU). Where data is transferred outside the EEA (e.g., Cloudflare edge nodes), we rely on EU Standard Contractual Clauses (SCCs) to ensure adequate protection.

7. COOKIES

We use essential cookies only — those required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

8. CHANGES TO THIS POLICY

We will notify you of material changes via email at least 30 days before they take effect. The updated policy will be posted on this page with the new effective date.

9. CONTACT

For privacy-related inquiries: