Privacy Policy

Controller and contact

The controller of the processing described in this policy is PICCAYA SRL, société à responsabilité limitée under Belgian law, registered office Rue de la Brasserie 122, 1050 Ixelles, Belgique, enterprise number 0461.715.743 (RPM Bruxelles).

For any question or request about your personal data: contact@nexudio.com.

What we process and why

Each processing below lists the data concerned, its purpose and its legal basis under Article 6 of the GDPR.

• Visiting the website. Technical data such as IP address, date and time, requested page and browser information, recorded in the access and security logs of our hosting provider. Purpose: delivering the pages and protecting the website. Legal basis: our legitimate interest in operating a secure website.
• Writing to us. Your email address, your name if you give it, and the content of your message. Purpose: answering you. Legal basis: our legitimate interest in replying to messages, or steps taken at your request before an agreement.
• Signing in to the app (optional in its current version). Your email address, your name, a technical user identifier and technical data related to the sign-in, processed by our identity provider ZITADEL when you sign in. Purpose: confirming your identity and managing private access. Legal basis: the agreement with you as an invited user. At this stage, only PICCAYA SRL signs in, including with test accounts it manages for controlled validations; the data of these test accounts is stored in ZITADEL and on our own installation.
• Website account. A technical identifier given by our identity provider ZITADEL, the login email it provides, the dates of your account creation and last sign-in, the status of your account and whether Nexudio has authorized your access to the app. Purpose: providing your account and protecting it. Legal basis: the agreement with you when you use the account we have authorised.
• Central profile. The information you enter in My account (and, once it is connected, in the app): full name, nickname, contact email, personal address and, if you add them, company name, VAT number and billing address. For each section, we also keep a version number, the date of the last change and whether it was made on the website or in the app. Purpose: providing your profile on the website and, once the Nexudio app is connected to your account, in the app, without one change silently overwriting another. Legal basis: the agreement with you. The company and billing details are optional; they do not create a subscription, an invoice or any right over an organisation.
• Security of the account. A record of your sessions (a hashed session identifier, creation, last activity and expiry dates), a short-lived record of each sign-in attempt, and a record of profile changes already processed (an identifier chosen by your browser or the app and a keyed fingerprint, without the values you entered), used to avoid duplicate or conflicting changes. Purpose: securing sign-in and keeping the profile consistent. Legal basis: our legitimate interest in operating a secure account service.
• Launch notification. Your email address, the version of the text shown when you registered, and the dates of your request, confirmation, unsubscription and of the emails sent to you. Purpose: confirming your address and sending you a single announcement when Nexudio launches; it is not a newsletter. Legal basis: your consent, which you can withdraw at any time by unsubscribing.

What we do not receive

Apart from the launch notification form and the website account, the website has no advertising and no analytics. It sets cookies only for the website account, when you use it, and only those strictly necessary (see Cookies below). It does not load fonts, scripts or media from third parties. The launch emails are sent through Brevo, which currently tracks them: it records whether each email is delivered, whether it is opened, through a small image loaded when the email is displayed, and whether its links are clicked, as each link first passes through a Brevo address before reaching our website. The images in these emails, including our logo, are also loaded through Brevo. We use this information only to check that our emails are delivered, never to build a profile of you or for advertising. You can avoid open tracking by not loading images in your email client. We have asked Brevo to disable this tracking and will update this policy when it is disabled.

The app runs on your Mac. Your content, publication files, statistics retrieved from your platforms, settings and the authorizations you give to platforms are stored on your Mac. They are not sent to us.

When you connect a platform, the app retrieves data from it through its official interface, such as your account identifier, profile information, the list and metadata of your content and the statistics the platform makes available. This data goes directly from the platform to your Mac. The app sends data to a platform only when you ask it to publish or update content.

If you configure your own keys for AI or music-recognition services, the app sends the related text or audio excerpts directly from your Mac to those services, under their own terms.

We do not sell personal data, do not use it for advertising and do not make decisions about you based solely on automated processing.

Cookies and storage in your browser

The website account uses only what is strictly necessary for the service you ask for. These cookies are not used to track you and do not require your consent.

• Session cookie (__Host-nx_acc): keeps you signed in to the website account. It contains a random identifier, of which we store only a hashed version. It ends after 7 days without activity and after 30 days at most, and is deleted when you log out.
• Sign-in cookie (nx_acc_bind): links a sign-in attempt to your browser for 10 minutes at most, and is deleted when the sign-in completes.
• Unsaved changes: while you edit My account, your changes not yet saved are kept in your browser for the current tab only, so that they survive an expired session. They are deleted when they are saved, when you log out, or when you close the tab, and are never shown to another person signing in in the same tab.

Connected platforms and YouTube API Services

Connecting a platform is optional. Each platform processes your data under its own policy, for example TikTok's Privacy Policy.

Nexudio uses YouTube API Services. Data obtained from YouTube is also subject to the Google Privacy Policy. You can revoke Nexudio's access to your Google account at any time from your Google security settings.

Recipients

Your personal data is only shared with the service providers we use to run the website and the website account, our email, sign-in and the launch notification. They process it on our instructions.

• Website hosting: Hostinger International Ltd., 61 Lordou Vironos Street, Larnaca 6023, Cyprus, VAT Reg # CY10301365E.
• Email: OVH.
• Sign-in to the website account and to the app: ZITADEL.
• Website account and central profile: stored in a database at our hosting provider.
• Launch notification: the list is stored in a database at our hosting provider; emails are sent through Brevo (SENDINBLUE SAS, 17 rue de Salneuve, 75017 Paris, France).

Retention

• Website logs: kept by Hostinger under its own policy; it does not publish a fixed retention period. We do not download or keep copies of these logs.
• Messages: kept for as long as needed to handle your request.
• Sign-in data: when private access ends, access is withdrawn without delay, and the account data specific to Nexudio is deleted within 30 days. Your content stored on your Mac is not affected, and a ZITADEL identity also used for another service is not deleted. Copies that may remain in our providers' logs or backups are deleted according to their own retention rules.
• Website account and central profile: kept while your account exists. When the account is closed at your request or because we withdraw your authorisation, access and web sessions end immediately and we delete the account data manually within 30 days. Accounts are not deleted automatically after a period of inactivity: we review the authorisations manually and close the accounts that are no longer needed.
• Sessions: deleted when they expire (7 days without activity, 30 days at most) or when you log out. Sign-in attempts: deleted after one day. Records of processed profile changes: deleted after 60 days.
• Backups of the website database at our hosting provider: daily backups kept for 7 days. Deleted data can remain in these backups until they are replaced.
• Data on your Mac: under your control. You can delete the app's data folder at any time. The app currently offers a disconnect action for TikTok and Mixcloud; for the other platforms, you can withdraw Nexudio's access from the platform's own account settings.
• Launch notification: registrations that are not confirmed are deleted after 30 days; the record of the emails sent to you is deleted after 90 days; the list is deleted, at our hosting provider and at Brevo, 3 months after the launch announcement. Until then, an address that was unsubscribed, or that reported our email as spam or could not receive it, is kept only so that no further email is sent to it.

Transfers outside the European Economic Area

The website, including the website account and the central profile, is hosted in France and its backups are stored in Lithuania, both within the EU. Our ZITADEL instance for sign-in to the website account and the app is hosted in ZITADEL's European Union region. ZITADEL provides authentication and may send the messages needed for sign-in. The sub-processors it relies on are listed in ZITADEL's official sub-processor list.

These locations do not exclude other transfers by our providers. Their contracts allow transfers outside the EEA under safeguards. Hostinger states that some of its servers are located outside the EEA and relies on standard contractual clauses for such transfers. ZITADEL is provided by CAOS AG, in Switzerland, a country recognised by the European Commission as providing an adequate level of protection; its data processing agreement allows processing outside Switzerland and the EU, for example in the United States, under standard contractual clauses.

Connected platforms and services you choose to use act under their own policies and may process data outside the EEA under their own safeguards.

Launch notification emails: Brevo states that it stores its customers' data in the European Union. Its data processing agreement allows processing outside the EEA by its sub-processors, under standard contractual clauses or, for the United States, the EU-US Data Privacy Framework.

Your rights

Under the GDPR, and within the conditions it sets, you can:

• access your personal data and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict its processing;
• object to processing based on our legitimate interest;
• receive the data you provided to us in a structured, machine-readable format, where the processing is based on our agreement with you.
• withdraw your consent to the launch notification at any time, using the unsubscribe link in our emails or by writing to us, without affecting what was done before.
• correct most of your profile yourself, at any time, in My account on the website or in the app.

How to exercise your rights

Write to contact@nexudio.com and tell us which right you want to exercise. If we have reasonable doubts about your identity, we may ask for information to confirm it.

We answer without undue delay and in any event within one month. This period can be extended by two further months for complex or numerous requests; we will tell you if it is. Exercising your rights is free of charge.

If you have signed in and want your sign-in data deleted, the same address applies. Data stored on your Mac is not held by us: you can delete it yourself.

To close your website account, write to the same address. Closing it ends your access and web sessions immediately and deletes your central profile as described under Retention; it does not delete the data stored on your Mac. Your ZITADEL identity is kept separately and no longer gives access to the website account. Your login email is managed by your identity provider: to change it, use Manage login and security in My account.

Complaints

You can lodge a complaint with the Belgian Data Protection Authority: autoriteprotectiondonnees.be, or with the supervisory authority of the EU country where you live, work or where you consider an infringement took place.

Minors

Private access may be granted to a person under 18 only with the agreement of a parent or legal representative.

This agreement is a condition of access. It is not the legal basis of the processing described in this policy, which remains the one indicated for each processing above.

The launch notification form is open to all website visitors and is separate from private access to the app. It is intended for people aged 16 or over; if you are younger, please ask a parent or legal representative before registering. We do not ask for your age.

The website account is separate from private access to the app. It is reserved for adults whom we have authorised.

Future features

Subscriptions and payments are not available. If they are introduced, this policy will be updated before they become available.

Changes

We may update this policy. The effective date at the top of the page shows the current version.