Privacy Policy

1. Who we are

MyNexusBiz is operated from Olival Basto, 2620-036 Odivelas, Portugal. For any privacy question, or to exercise the rights described below, contact support@mynexusbiz.com.

2. Information we collect

Information you give us

• Account details — name, email address, and password. Passwords are stored only as a bcrypt hash; we cannot read them.
• Optional profile details — company name and phone number.
• Content you create — the text, prompts, images, and videos you enter into our tools or attach to a post.
• Order details — when you order a custom ad, the product information and contact details you submit with that order.

Information from connected social accounts

When you connect a social account, the platform gives us an access token and basic profile information (account name, username, profile picture, and the Pages or accounts you chose to grant). We describe exactly how these are used in section 4.

Information collected automatically

• Login session — a signed token stored in your browser so you stay logged in.
• Server logs — IP address, browser type, and request times, kept for security and troubleshooting.

We do not use advertising cookies or third-party tracking pixels on this site.

3. How we use your information

Purpose	What this involves
Providing the service	Running your AI requests, saving your calendar and content, publishing posts you approve
Account management	Authentication, credit balance, trial and subscription status
Support	Answering your emails and investigating problems you report
Security	Detecting abuse, rate limiting, preventing unauthorised access
Service emails	Important notices about your account or the service

We do not sell your personal data, and we do not use your content to train AI models.

4. Social media connections

This is the most sensitive data we hold, so we want to be precise about it.

• What we store — an access token for each account you connect, plus the account name, username, and profile picture so you can identify it in our interface.
• How tokens are protected — every token is encrypted with AES-256-GCM before it is written to our database, using a key held only on our server. Tokens are never sent back to your browser and never appear in any API response.
• When we post — only when you click Publish, or at a time you scheduled yourself. We never post on your behalf otherwise, and never to an account you did not select.
• What we do not do — we do not read your existing posts, messages, followers, or contacts. We do not post advertising or promotional content of our own to your accounts.
• Disconnecting — you can disconnect any account at any time from Connected Accounts. The stored token is deleted immediately.

5. Who we share information with

We share only what is necessary for the service to work:

Recipient	What they receive	Why
Anthropic (Claude API)	The prompt and content you submit to an AI tool	To generate the output you requested
Meta (Facebook, Instagram)	The post content and media you chose to publish there	To publish the post
X, LinkedIn, Google/YouTube, TikTok, Pinterest	The post content and media you chose to publish there	To publish the post
Hosting and database providers	Data stored by the service	To host the application and database

Each platform handles your data under its own privacy policy once it is published there. We may also disclose information if required by law.

6. How long we keep information

• Account data — while your account is open, then deleted within 30 days of a deletion request.
• Social tokens — until you disconnect the account or delete your account.
• Uploaded media — retained so scheduled posts can use it; removed when you delete it or close your account.
• AI prompts and outputs — content you save (such as a calendar) is kept until you delete it. We do not keep a separate copy of one-off AI requests after the result is returned.
• Server logs — approximately 30 days.

7. Security

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. Social access tokens are encrypted with AES-256-GCM at rest. Access to production systems is limited to the operator.

No system is perfectly secure. If a breach affects your personal data, we will notify you at the email address on your account without undue delay.

8. Your rights

You can ask us to:

• Give you a copy of the data we hold about you
• Correct anything inaccurate
• Delete your account and associated data
• Stop processing your data for a particular purpose

Email support@mynexusbiz.com and we will respond within 30 days. See our Data Deletion Instructions for the deletion process.

9. If you are in the European Union or the UK

We operate from Portugal, so the General Data Protection Regulation applies to how we handle your data. In addition to the rights listed above, you have the right to:

• Data portability — receive your data in a structured, machine-readable format, or have us send it directly to another provider where technically feasible.
• Object to processing — including any processing we carry out on the basis of our legitimate interests.
• Restrict processing — ask us to hold your data without using it while a dispute about its accuracy or our use of it is resolved.
• Withdraw consent — where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
• Complain to a supervisory authority — in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), and you may also complain to the authority in your own country of residence.

Why we are allowed to process your data

We rely on the following legal bases: performance of a contract for everything needed to run your account and deliver the service you subscribed to; legitimate interests for security, fraud prevention and improving the product; consent for optional marketing email, which you can withdraw at any time; and legal obligation for records we are required to keep, such as invoices.

Transfers outside the EU

Some of the services we use to run MyNexusBiz process data outside the European Economic Area — for example our AI provider and our hosting and payment providers. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision. A current list of these providers is in section 4 above.

10. Children

MyNexusBiz is a business tool and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.

11. International transfers

Our servers are located outside your country, and the third parties listed in section 5 operate internationally. By using the service you understand that your data will be processed in these locations.

12. Changes to this policy

If we make a material change we will update the date at the top of this page and notify active users by email. Continuing to use the service after a change means you accept the updated policy.

13. Contact