Privacy Policy

1. Introduction

This Privacy Policy explains how Nixus ("we", "us", "our") collects, uses, and protects personal information when you use Nixus (the "Service").

We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Data Controller

The data controller responsible for your personal information is:

• Entity:
• Address: Casablanca, Morocco
• Email: raissmohamadamine@gmail.com

3. Data We Collect

3.1 Information you provide

• Account data: name, email, username, password (hashed), company details.
• Billing data: processed by PayPal. We do not store card numbers.
• Client data: names, emails, addresses, tax IDs, and other info you enter about your clients.
• Invoice data: line items, amounts, currencies, notes, terms.
• Communications: messages sent via our contact form or email support.

3.2 Information collected automatically

• Log data: IP address, browser type, user agent, pages visited, timestamps.
• Device data: operating system, screen size, language preference.
• Usage data: features used, actions taken (stored as activity logs for security).
• Session data: cookies and session tokens required to keep you signed in.

3.3 Information from third parties

• PayPal: subscription status, transaction IDs, payment events (via webhook).
• Email provider: delivery status of transactional emails.

4. How We Use Your Data

We use your information to:

• Provide, operate, and improve the Service.
• Authenticate you and secure your account.
• Send transactional emails (verification, password reset, invoice notifications).
• Process subscription payments through PayPal.
• Respond to support requests.
• Detect and prevent fraud, abuse, and security threats.
• Comply with legal obligations.
• Send product updates and announcements (you can opt out at any time).

We never sell your personal data. We never use your client or invoice data for advertising or marketing.

5. Legal Basis (GDPR)

If you are in the EEA, our legal bases for processing your data are:

• Contract: to provide the Service you signed up for.
• Legitimate interests: security, fraud prevention, service improvement.
• Consent: marketing emails (you may withdraw at any time).
• Legal obligation: tax, accounting, and regulatory compliance.

6. Data Sharing

We share your data only with trusted service providers ("sub-processors") who help us operate the Service:

Each sub-processor is bound by a Data Processing Agreement (DPA) and only processes your data on our instructions.

We may also disclose your data if required by law, court order, or to protect our rights.

7. International Transfers

Some of our sub-processors are located outside the EEA, including in the United States. When we transfer your data internationally, we rely on:

• The EU Standard Contractual Clauses (SCCs).
• Additional technical measures (encryption, access controls).

8. Data Retention

• Account data: kept as long as your account is active. On deletion, retained for 30 days then permanently removed.
• Invoice & client data: kept as long as your account is active. You can delete individual records at any time.
• Activity logs: kept for 90 days, then automatically pruned.
• Backups: encrypted backups retained for 30 days.
• Legal records: kept as required by tax and accounting law (typically 7 years).

9. Security

We take the security of your data seriously. Measures include:

• Encryption in transit: TLS 1.2+ for all connections.
• Encryption at rest: sensitive fields encrypted with Fernet (AES-128).
• Password hashing: scrypt with per-user salt and pepper.
• Two-factor authentication: TOTP available for all accounts.
• Rate limiting: on authentication and sensitive endpoints.
• Session hardening: HTTP-only, Secure, SameSite cookies.
• Audit logs: all critical actions logged.
• Regular backups: encrypted, tested, and pruned.

No system is 100% secure. If you discover a vulnerability, please disclose it responsibly to raissmohamadamine@gmail.com.

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

To exercise any of these rights, contact us at raissmohamadamine@gmail.com. We respond within 30 days.

You can also export all your data directly from Settings → Data → Export, or delete your account from Settings → Data → Delete Account.

11. Cookies

We use only essential cookies required for the Service to function:

• Session cookie: keeps you signed in.
• CSRF token: protects forms from cross-site attacks.
• Preferences: stores your theme (dark/light) and language.

We do not use advertising cookies, tracking pixels, or third-party analytics that identify you personally.

12. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page.
• Notify you by email or in-app for material changes.

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

For any questions about this Privacy Policy or to exercise your data rights:

• Email: raissmohamadamine@gmail.com
• Phone: +212 632376348
• Address: Casablanca, Morocco
• Data Protection Officer: raissmohamadamine@gmail.com