Privacy Policy

1. Introduction

Nexus Netra ("Nexus Netra," "we," "our," or "us") operates a software-as-a-service platform available at nexusnetra.com and app.nexusnetra.com (together, the "Platform"). The Platform is designed to help members build and manage their professional network, track prospects and contacts, and lead growing teams.

This Privacy Policy explains what personal information we collect and why; how we use, store, and protect that information; with whom we share it; and what rights you have with respect to your personal information.

This policy applies to all users of the Nexus Netra Platform, regardless of where you are located. By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

This policy is intended to comply with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (Law 25), as well as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), to the extent applicable to our users.

2. Who We Are — Data Controller

Nexus Netra is the data controller responsible for the personal information collected through the Platform.

For the purposes of Quebec Law 25, Nexus Netra is the enterprise responsible for the protection of personal information.

For the purposes of the GDPR (where applicable), Nexus Netra is the data controller.

Nexus Netra is based in Montreal, Quebec, Canada. Contact details for privacy-related requests are set out in Section 22 below.

3. Information We Collect

3.1 Information You Provide at Registration

When you create a Nexus Netra account, we collect:

• Full name — required.
• Email address — required, used for sign-in and account communications.
• Password — if you use email/password sign-in. Stored only as a cryptographic hash by our authentication provider; we never have access to your plaintext password.
• Age attestation — required. You must confirm you are 18 years of age or older before an account can be created.

If you sign in using Google or Apple instead, we receive your name, email address (or, for Apple, an email address or private relay email), and a unique account identifier from those providers. We never receive your Google or Apple password.

When your account is created, we automatically generate a unique Netra ID, a free-tier subscription record, and default notification preferences.

3.2 Profile Information

After signup, you may provide the following information. Fields noted as optional are not required to use the Platform:

Rank is a self-selected, display-only label. We don't calculate, verify, or attach any compensation to it — see Section 11. If someone invited you, their referral code is used later during onboarding to create a pending team-join request; it isn't linked to your profile unless and until that request is approved by both sides.

3.3 Information Generated Through Platform Use

As you use the Platform, we collect and store:

• Messages — content of direct messages you send to and receive from other members. See Section 9.
• Prospect, lead, and contact records — information you enter about third parties. See Section 4.
• Team hierarchy position — your place in the network relative to other members. See Section 11.
• Appointments, calendar entries, to-dos, personal notes, and quick links — content you create within the Platform.
• Notification history — in-app notifications generated by Platform activity, which may include another member's name, rank, and avatar, and — for connection requests specifically — their email and phone number.
• Billing and subscription data — see Section 7.

3.4 Automatically Collected Information, Cookies & Local Storage

Our authentication provider automatically records technical session information tied to your account — including IP address, browser/device information, and sign-in timestamps — to keep your account secure. Our backend also keeps limited technical logs when app features run (which function ran, for which account, whether it succeeded) to help us diagnose problems; our own application logs don't include full message content or IP addresses. We don't operate any independent analytics platform, advertising network, or behavioral tracking system.

The App uses your browser's local storage — not cookies — to keep you signed in and to remember simple preferences like your language, sound settings, and whether your sidebar is collapsed. We use one functional cookie, to remember whether your sidebar is open or closed; we don't use advertising, analytics, or cross-site tracking cookies.

Our marketing site loads font files directly from Google Fonts. As a result, Google receives your IP address and browser information when the site loads, independent of whether you have a Netra account.

4. Information You Enter About Third Parties

Nexus Netra is designed for members who manage contacts, prospects, and team relationships. As part of your normal use of the Platform, you may enter personal information about individuals who are not themselves Nexus Netra users. This includes, but is not limited to:

• Full names, phone numbers, and email addresses
• Province / region and country
• Relationship labels and pipeline or follow-up status
• Free-text notes about interactions

This information is stored under your account and is subject to the access controls described in Section 12. We don't independently verify, contact, or market to these individuals on your behalf.

5. How We Use Your Information

We use the personal information we collect for the following purposes:

• Account management and authentication: To create and maintain your account, verify your identity, manage your sign-in sessions, and enable Platform access.
• Service delivery: To provide all Platform features, including team hierarchy management, prospect tracking, direct messaging, appointment scheduling, and related tools.
• Subscription and billing: To manage your subscription tier, process payments, handle billing events, and display accurate billing information within the Platform.
• Team hierarchy and sharing: To enable connections between upline and downline members and to support the explicit, user-controlled data-sharing features of the Platform.
• In-app notifications: To deliver notifications about messages, follow-up reminders, connection requests, and other Platform activity relevant to you.
• Platform security and integrity: To detect and respond to unauthorized access, enforce our Terms of Service, and protect the security of user data.
• Platform operations and improvement: To maintain the reliability and performance of the Platform, using only internal operational data.
• Legal compliance: To comply with applicable laws, respond to lawful requests from public authorities, and fulfill our obligations under applicable financial and tax regulations.

6. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases under the GDPR or UK GDPR to process your personal data:

Where we rely on consent as a legal basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Payments & Billing

Payments for Nexus Netra subscriptions are processed by Stripe, Inc. ("Stripe"). When you subscribe to a paid plan or manage your subscription, you're directed to Stripe's hosted checkout and billing portal. Your full payment card details are entered directly on Stripe's secure servers and are never transmitted to or stored on our systems.

We store the following Stripe-related metadata to manage your subscription:

• Stripe customer, subscription, price, and schedule identifiers
• Plan type and subscription status
• Billing period, renewal, and cancellation dates
• Grace-period and past-due status
• Discount eligibility, including for our Founder tier

We also keep an internal technical log of the payment notifications ("webhooks") Stripe sends us, used only to keep your subscription status accurate. This log isn't accessible through the app to any user, including you — it's restricted to our backend systems for audit and reconciliation.

Stripe operates under its own privacy policy, available at stripe.com/privacy. Stripe is an independent data controller for the payment and fraud-prevention data it processes.

8. Authentication & Account Security

You may sign in to Nexus Netra using any of the following methods:

• Email address and password — your password is stored only as a secure cryptographic hash by our authentication provider; we never have access to your plaintext password.
• Google (OAuth) — Google returns your name, email address, and a unique identifier to our authentication system. We do not receive your Google password.
• Apple (OAuth) — Apple returns your name, email address, and a unique identifier to our authentication system. We do not receive your Apple password.

Session storage: your authentication session — including an access token and a refresh token — is stored in your browser's localStorage, not in a cookie. Sessions are persistent by default and refresh automatically, so you'll generally stay signed in across visits until you sign out.

We recommend using Nexus Netra only on trusted personal devices and signing out when you finish your session, particularly on shared devices.

9. Messaging

Nexus Netra includes a direct messaging feature that allows you to send and receive text messages with other Platform users. Sending messages requires a premium subscription; receiving and reading them does not.

• Government identification numbers (such as Social Insurance Numbers or Social Security Numbers)
• Banking credentials or full financial account details
• Medical or health information
• Passwords or security credentials

Messages cannot be edited or deleted once sent. See Section 15 for what happens to your messages if you delete your account.

10. Profile Images & Public Storage

Profile avatars and quick-link icons are stored in publicly accessible cloud storage. This means that any person with the direct URL to one of these images can access it without authentication — this is an intentional design choice, similar to how profile photos work on many social and professional networking platforms. Avatar file paths include your account identifier, so a public avatar URL discloses that identifier alongside the image.

You should only upload images that you're comfortable making publicly accessible. If you upload a photo of another individual (for example, as part of a contact record), please ensure you have their appropriate consent to do so.

11. Team Hierarchy & Network Visibility

Nexus Netra visualizes your position within a team hierarchy: an "upline" of the person or people who introduced you, and a "downline" of people you've introduced. This visibility is a core part of how the Platform works, and it's enforced at the database level with a maximum lookup depth of 50 levels.

Nexus Netra does not calculate, store, or display any commission, override, or compensation data. The Platform is a networking and relationship-management tool, not a compensation or income platform — see our Terms of Service for our full disclaimer regarding team and network structures.

12. Data Sharing & Disclosure

We do not sell your personal information to third parties. We may share your information only in the following limited circumstances:

User-Controlled Sharing Within the Platform

Nexus Netra includes a built-in data-sharing system that allows you to grant other Platform users access to specific portions of your data (such as your prospect list or tracking sheet link). Any such sharing is explicit — you must actively grant access — scoped to the categories of data you choose, and revocable at any time. No sharing occurs without your affirmative action.

Service Providers

We share data with the third-party service providers described in Section 13, only to the extent necessary for them to deliver their respective services.

Legal Requirements

We may disclose personal information if required to do so by applicable law, regulation, subpoena, court order, or governmental or regulatory authority. We may also disclose information where we believe in good faith that disclosure is necessary to protect our rights, the rights of other users, or the safety of any person, or to detect or prevent fraud or illegal activity.

Business Transfers

In the event that Nexus Netra is acquired, merged with, or otherwise transferred to another organization, your personal information may be transferred as part of that transaction. We will provide reasonable notice before your information becomes subject to a materially different privacy policy and will seek your consent where required by applicable law.

13. Service Providers

We work with the following third-party service providers to operate the Platform. Each provider processes personal data only as necessary to deliver their services and is subject to appropriate contractual data protection obligations.

We do not use advertising networks, behavioral analytics platforms, session-recording services, error-tracking services, or external AI / machine-learning processing services in connection with the Platform.

14. International Data Transfers

Nexus Netra is operated from Montreal, Quebec, Canada. Our infrastructure providers — including our database, authentication, and hosting provider — process and store personal information in the United States (currently in an AWS data center located in the western United States).

Quebec residents: your personal information is communicated outside of Quebec for processing by our service providers. We take steps to help ensure that personal information handled this way receives a level of protection comparable to that afforded under Quebec's Law 25, primarily through contractual provisions with those providers.

EEA and UK users: if you are located in the European Economic Area or the United Kingdom, your personal data may be transferred to and processed in countries that are not subject to an adequacy decision by the European Commission. Where such transfers occur, we rely on the appropriate safeguards established by our service providers, including Standard Contractual Clauses (SCCs) as adopted by the European Commission or equivalent mechanisms under UK law.

You may request more information about the safeguards applicable to international transfers by contacting us at the address listed in Section 22.

15. Data Retention & Account Deletion

What happens when you delete your account

You can delete your account at any time from Settings. Deletion happens in two phases:

• Immediately: your subscription is canceled, your profile is anonymized (your name is replaced and identifying fields such as your avatar, phone number, and tracking sheet link are cleared), any direct recruits are reassigned to your own upline so their position in the network isn't disrupted, pending requests are declined, and all of your sessions are revoked.
• 7 days later: your prospect/contact records, notes, follow-ups, tasks, calendar entries, notifications, and similar data tied to your account are permanently deleted, along with your uploaded avatar file.

To request deletion of your account or a copy of your personal information, you can use the in-app deletion flow or contact us using the information in Section 22.

16. Security Measures

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, use, disclosure, alteration, and destruction. These measures include:

• Row-Level Security (RLS): every table in our database is subject to access controls that ensure each member can only read and modify their own authorized data, enabled across all tables that contain personal data.
• Privileged server-side functions: sensitive data operations (for example, reading a tracking sheet link, or computing your team hierarchy) are governed by server-side functions that perform explicit authorization checks before returning data.
• Authenticated API access: our backend functions require a valid, authenticated request; no personal data is served to unauthenticated requests.
• Stripe webhook signature verification: all incoming Stripe payment events are cryptographically verified before processing, preventing spoofed webhook attacks.
• Hierarchical access model: access to team data is governed by a depth-limited organizational hierarchy combined with an explicit, user-controlled access-grant system.
• Server-side secret management: API keys and service credentials are stored as server-side secrets and are never exposed to client-side code.
• Minimal client-side storage: the App does not use cookies for authentication — your session is stored in localStorage. We use a single functional cookie for a UI preference, and no advertising or tracking cookies anywhere.

Despite these measures, no method of electronic storage or internet transmission is completely secure. We cannot guarantee the absolute security of your information. In the event of a data breach, we will notify affected users and applicable regulatory authorities in accordance with applicable law.

17. Your Privacy Rights

Rights Under Canadian Law (PIPEDA and Quebec Law 25)

If you are a Canadian resident, you have the following rights with respect to your personal information:

• Right of access: request access to the personal information we hold about you and information about how it is being used.
• Right to correction: request that we correct inaccurate or incomplete personal information — most of this you can also do directly in Settings.
• Right to withdraw consent: where our processing is based on your consent, you may withdraw it at any time.
• Right to complain: file a complaint with the Office of the Privacy Commissioner of Canada (OPC) or, if you are a Quebec resident, with the Commission d'accès à l'information (CAI).

Quebec residents have additional rights under Law 25, including the right to request destruction or anonymization of data no longer needed for its original purpose (see Section 15 for how account deletion works, including the messages exception); the right to receive a copy of your personal information in a structured, commonly used format, which we currently fulfill manually within 30 days of request; and the right to be informed when your personal information is communicated outside of Quebec (see Section 14).

Rights Under the GDPR (EEA and UK Users)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR or UK GDPR:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): request deletion of your personal data where there is no overriding legitimate reason for us to retain it.
• Right to restriction of processing (Art. 18): request that we limit our processing of your data in certain circumstances.
• Right to data portability (Art. 20): receive personal data you have provided to us in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: file a complaint with your local data protection supervisory authority.

How to Exercise Your Rights

To exercise any of the rights described in this section, please contact us at support@nexusnetra.com. Please include your name and the email address associated with your account so we can verify your identity before processing your request. We aim to respond to all requests within 30 days of receipt, or such shorter period as may be required by applicable law.

18. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• Right to know: the right to know what categories of personal information we collect, the purposes for which it is used, and with whom it is shared.
• Right to delete: the right to request deletion of personal information we hold about you, subject to certain legal exceptions (see Section 15 for how deletion works, including the messages exception).
• Right to correct: the right to request correction of inaccurate personal information.
• Right to opt out of sale or sharing: the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
• Right to non-discrimination: the right not to receive discriminatory treatment for exercising your CCPA/CPRA rights.

To submit a CCPA/CPRA request, please contact us at support@nexusnetra.com. We will verify your identity before processing your request.

19. Children's Privacy

Nexus Netra is intended for people 18 years of age or older. We require you to affirmatively confirm that you meet this age requirement before an account can be created.

We do not knowingly collect personal information from anyone under 18. If we learn that we've collected information from someone under 18, we will delete the associated account and information. If you believe a minor has created a Nexus Netra account, contact us at support@nexusnetra.com.

20. Automated Processing & AI

Nexus Netra doesn't send your personal information to any external AI or machine-learning service. A small feature that parses natural-language dates when you quickly add a task (for example, typing "next Tuesday") runs entirely in your browser and never transmits your data anywhere.

Features like your activity tracker and dashboard rankings are simple counts and sorting of your own activity — not profiling, scoring, or automated decision-making with a legal or similarly significant effect on you.

21. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, the Platform's features, or applicable legal requirements. Every version of this policy is numbered, and when we make material changes, you'll be asked to review and accept the updated version the next time you sign in — you won't be able to continue using the Platform until you do. We keep a record of each version of this policy you've accepted and when.

Your continued use of Nexus Netra after accepting an updated policy constitutes your agreement to it. If you disagree with a change, you may delete your account instead — see Section 15.

22. Contact Information

Person Responsible for Personal Information

Nexus Netra has designated a Privacy Officer responsible for compliance with Quebec's Law 25. For questions, requests, or complaints regarding personal information, contact:

For users in the EEA or United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights under the GDPR or UK GDPR have been violated. A list of EEA supervisory authorities is available at edpb.europa.eu.