Privacy Policy

• Account data: email, password (stored by Supabase Auth as a hash — we never see it in plaintext), username, display name, avatar, profile bio, and (for sellers) business/location details you choose to show.
• Activity data: listings you create, orders, messages, reviews, and your in-app history (searches and viewed items, stored locally in your browser where applicable).
• Security data: IP address at signup/login (used for fraud detection and rate limiting), device information, and login timestamps.
• Verification data (sellers): education history and credential details you submit for review, plus verification documents you upload (e.g. certificates or transcripts) and portfolio/project items. Uploaded documents are stored in a private storage bucket, are never public, and are accessible only to you and to administrators reviewing your verification. See the Verification Policy.
• Subscription data: seller subscription status, plan, trial dates, and Stripe customer/subscription identifiers. Card details are collected by Stripe during checkout and are never stored by Nexus.
• Support data: anything you send us when you contact support, report content, appeal a decision, or open a dispute.

• Provide and secure the Service (accounts, marketplace, messaging, orders) — performance of our contract with you (Art. 6(1)(b)).
• Enforce subscription entitlements and seller standing — contract (Art. 6(1)(b)).
• Detect and prevent fraud, abuse, and spam, including risk scoring and review flags — legitimate interest in keeping the marketplace safe (Art. 6(1)(f)).
• Process your subscription payments via Stripe and keep the required billing records — contract (Art. 6(1)(b)) and legal obligation (tax and accounting law, Art. 6(1)(c)).
• Respond to disputes, reports, appeals, and support requests — contract and legitimate interest (Art. 6(1)(b), (f)).
• Improve the Service and diagnose problems — legitimate interest (Art. 6(1)(f)).
• Notify you about material changes to these documents and your account — contract and legal obligation (Art. 6(1)(b), (c)).
• Communications are transactional only. We email you about your account, billing, orders, disputes, and required notices. We do not operate promotional/mailing lists, and we send no marketing SMS or push notifications — so there is no marketing consent to withdraw; if that ever changes, this policy will change first and you will be asked, not assumed.

• Supabase — hosts our authentication, database, and file storage. Data is processed under a data-processing agreement and stored in Supabase’s cloud infrastructure.
• Stripe — processes your subscription billing. Stripe receives the payment details needed to bill you; card data is handled by Stripe under its own privacy policy and PCI-DSS scope, not by Nexus. Stripe may set anti-fraud cookies during checkout.
• Google — only if you choose to sign in with Google. We receive your name and email from Google’s OAuth flow.
• Map providers (MapTiler, Mapbox, OpenStreetMap) — power the map in the app. Map requests may include approximate location data needed to render tiles.
• Font & asset CDNs (Google Fonts, cdnjs/Cloudflare) — serve the typefaces and icons the site displays. Your browser downloads these files automatically on every page load and, like any web request, transmits your IP address to the CDN. These requests carry no account data and set no cookies we control.
• Vercel — hosts and serves the website itself (pages, application code, scheduled jobs). Like any hosting provider it sees standard request data (IP address, user agent) for the pages you load.
• Cloudflare— routes and forwards our support email (the contact mailboxes published on this site). If you email us, your message and address pass through Cloudflare's email routing on the way to our inbox.
• Law enforcement / legal process — we disclose data when required by law, court order, or to protect rights and safety.

• We do not sell or rent your personal data.
• We do not collect payment card data directly — Stripe does.
• We do not hold or process marketplace transaction funds — those settle directly between buyers and sellers, outside our systems.
• We do not use cross-context advertising cookies (see the Cookie Policy).
• We do not make fully automated decisions that produce legal or similarly significant effects — see the next section.

We use industry-standard safeguards: encryption in transit (TLS), hashed passwords, server-side authorization on every sensitive operation, row-level security on the database, signed webhook verification for payment events, rate limiting, and regular security audits. No system is 100% secure; if we discover a breach affecting you, we will notify you and the competent authorities as required by law (within 72 hours to the supervisory authority where the GDPR applies to the breach).

The Service is not directed to children under 18, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy. Material changes will be announced in-app and/or by email with a new “Last updated” date. Continued use after the effective date constitutes acceptance of the updated policy; consent-based processing only takes effect after the relevant consent is collected.