Privacy policy

1. Who we are and what this covers

Nexus Commerce, Inc. (“Nexus”, “we”, “us”) is a Delaware corporation with its principal office at 1721 Broadway, #201, Oakland, CA 94612, United States. This policy applies to:

• our website at nexuscommerce.co (the “Website”);
• the Nexus app at app.nexuscommerce.co, including the Shopify integration, the project board, chat and Nexus MCP (together, the “Service”);
• our emails, demo calls and support conversations.

We act in two roles:

• Controller for information about Website visitors, people who book a demo, and the people who create and manage Nexus accounts.
• Processor or service provider for personal information about a merchant’s own customers (for example, names, emails and order history from a connected Shopify store). We process that information only on the merchant’s instructions, to deliver the Service. The merchant is the controller of that data.

2. Information we collect

From you

• Account details: name, work email, company and brand name, role, and the teammates you invite. Sign-in is handled by our authentication provider.
• Brand context you give us: brand guidelines, voice and tone notes, logos and other files you upload, goals, and the messages you send in chat.
• Your decisions: approvals, rejections, edits and comments on the work Nexus prepares.
• Demo requests and support: what you submit when you book a demo or email us, including name, email, company and any notes. Demo bookings are made on Cal.com.
• Billing: plan, status, invoices and billing contact. Card details go directly to Stripe. We never see or store full card numbers.

From tools you connect

When you connect a tool, we receive the data your permissions allow, and only to run the features you use. For a Shopify store this can include products, collections, pages and theme settings, orders, customer records and abandoned checkouts, store analytics and discount settings. Other integrations (for example analytics, email or advertising platforms) share the reports and settings that their permission scopes cover. We also read publicly available information about your storefront and your competitors’ storefronts. Connection credentials are held by our integration provider in encrypted form.

Generated by the Service

• Opportunities, scopes, plans, deliverables, drafts and the history of what was approved, shipped or declined.
• If you connect your own AI tool through the Nexus MCP: request logs (which tools were called, when, and by which token), without storing the token itself in readable form.
• Run logs, error reports and usage metrics (for example, credits used).

From your browser

When you visit the Website or use the app we collect your IP address (used to derive approximate location, then truncated or discarded by our analytics tools where they support it), device and browser type, referring page and campaign parameters, pages and sections viewed, scroll depth, clicks on buttons and links, and approximate time on page. See “Cookies, analytics and your choices” below.

3. How we use information

• To provide the Service: analyze your store, detect opportunities, scope projects, prepare deliverables and publish what you approve.
• To operate accounts, authenticate you, process payments and send service messages (receipts, security notices, product updates that affect you).
• To support you, answer questions and run demos.
• To keep the Service secure, prevent abuse and fraud, and enforce our Terms.
• To understand how the Website and app are used, fix problems and improve the product, using aggregated or de-identified data where possible.
• To send marketing emails about Nexus where the law allows. You can unsubscribe in any message.
• To meet legal obligations.

Where GDPR or UK GDPR applies, our legal bases are performance of a contract (providing the Service), legitimate interests (security, product improvement, measuring our own marketing), consent (analytics cookies where required, and marketing where required), and legal obligation.

4. How we use AI

Nexus uses large language and image models to analyze data, reason about opportunities and draft work. To do that we send the relevant excerpts of your store and brand data to model providers over encrypted connections.

• We use model providers under commercial API terms that do not allow them to train their models on our customers’ data.
• We do not use your store data, your customers’ data or your brand files to train general-purpose AI models.
• Your data is used to produce work for your account. It is not used to produce work for other merchants.
• Nothing that reaches your customers, your storefront or your ad accounts is sent or published without your approval.
• AI output can be wrong. You should review everything before you approve it.

If you connect your own AI tool to Nexus MCP, that tool and its provider handle data under their own terms and settings. Check them before you connect.

5. Cookies, analytics and your choices

On the Website we use:

• Essential storage to remember your cookie choice and keep the Website secure. These do not require consent.
• Google Analytics 4 to measure traffic and behavior: pages and sections viewed, scroll depth, clicks on calls to action, plan and FAQ interactions, and whether a visit leads to a demo booking or sign-up. We turn off Google’s advertising features and ad personalization signals, and we do not use the data for advertising.
• Vercel Speed Insights to measure page performance. It does not use cookies to track you across sites.
• Cal.com loads when you open the booking widget. Cal.com handles the booking under its own privacy policy.

Your choices. If you are in the European Economic Area, the United Kingdom or Switzerland, Google Analytics stays off until you accept it in the cookie banner. Everywhere else it runs by default and you can switch it off at any time with the “Cookie settings” link in the footer. We treat the Global Privacy Control signal and the browser “Do Not Track” setting as a request to keep analytics off. You can also block cookies in your browser or install the Google Analytics opt-out add-on.

The Nexus app uses cookies and local storage that are needed to keep you signed in and to remember your workspace settings. It does not use advertising cookies.

6. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only with the following.

We may also disclose information:

• to professional advisers, and to a buyer or investor in connection with a merger, financing or sale of assets (we will tell you if your information becomes subject to a different policy);
• when we believe in good faith that the law requires it, or to protect the rights, safety and security of users, the public or Nexus;
• with your teammates and the people you add to a workspace, according to the roles you set.

Providers act on our instructions and are bound by confidentiality and data protection terms. We update this list when it changes.

7. Your customers’ information

When Nexus works on data about your customers (for example, to find at-risk customers or draft a win-back email), we process it only for you. We keep it separated from every other merchant’s data, never use it for advertising, never sell it, and delete it as described below.

You are responsible for having a lawful basis and any notices or consents needed to use that data with Nexus, and for your own privacy policy. If one of your customers contacts us about their data, we will point them to you and help you respond. A data processing agreement is available on request at privacy@nexuscommerce.co.

8. Shopify merchants

• We access your store through the Shopify Admin API using the permissions you approve at install, and only request what the features you use need.
• We handle Shopify’s mandatory privacy requests (customer data request, customer data erasure and shop data erasure) and comply with the Shopify API Terms and Partner Program Agreement.
• If you uninstall the app or close your account, we revoke access and delete your store data as described under “Retention and deletion”.
• Changes to your theme, products or pages are made as drafts or after your approval, and use Shopify’s own versioning so you can roll back.

9. Retention and deletion

• Active accounts: we keep account, workspace and project data while your account is active and your tools are connected.
• Raw store data: refreshed on each sync. Earlier snapshots are overwritten rather than accumulated.
• Cancelled accounts and uninstalls: account, store, project and customer data is deleted within 30 days. Deletion covers the related records in our systems. Encrypted backups age out on our hosting providers’ standard schedule.
• Billing records: invoices and tax records are kept for as long as the law requires, which is typically up to seven years.
• Website analytics: event-level data in Google Analytics is retained for up to 14 months.
• Demo and support correspondence: kept while it is useful to serve you, then deleted.

You can ask us to delete your data at any time (see “Your rights”).

10. Security

• Data is encrypted in transit (TLS) and at rest.
• Each merchant’s data is isolated from other merchants, and internal and client-facing endpoints require authentication and are rate limited.
• Connection credentials and MCP tokens are stored encrypted and are never exposed to your browser.
• Agents prepare work for approval. Changes to your store follow a draft-first, approval-gated process.
• We limit internal access to what is needed to run and support the Service.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and the authorities as the law requires. To report a vulnerability, email privacy@nexuscommerce.co.

11. Your rights

Depending on where you live (including the EEA, UK, California and other US states with privacy laws) you may have the right to access your information, correct it, delete it, receive a portable copy, object to or restrict certain processing, withdraw consent, and not be discriminated against for using these rights. In California, you also have the right to know the categories of information we collect and disclose, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA.

To use a right, email privacy@nexuscommerce.co. We may need to verify your identity, and an authorized agent can act for you with your written permission. We respond within the time the law allows (generally 30 to 45 days). If we decline a request you can appeal by replying to our response, and if you are in the EEA or UK you can complain to your local data protection authority.

Personal information about a merchant’s customers is controlled by that merchant. If you are one of their customers, contact the merchant first.

In the last 12 months we have collected the categories of personal information described above (identifiers, commercial information, internet activity, approximate location, professional information and inferences from product usage) for the business purposes described above, and disclosed them to the providers listed above.

12. International transfers

We are based in the United States and our infrastructure is hosted there. If you are in the EEA, UK or Switzerland, your information is transferred to and processed in the United States. Where required we rely on the European Commission’s Standard Contractual Clauses and the UK addendum, or on another lawful transfer mechanism offered by the provider.

13. Children

The Website and the Service are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service, the Website or the law changes. We will change the date above, and if the change is material we will tell account holders by email or in the app before it takes effect.

15. Contact us

Nexus Commerce, Inc.
1721 Broadway, #201, Oakland, CA 94612, United States
Privacy requests: privacy@nexuscommerce.co
General: hello@nexuscommerce.co