Privacy Policy

The data controller responsible for the processing of your personal data under this policy is:

This Privacy Policy explains how Nexus ("the Platform"), operated by Next Sight d.o.o. ("we", "us", "our"), collects, uses, stores, and protects personal data when you access the Platform, including account registration, subscription management, investigation case workflows, OSINT tool usage, chat interactions, file uploads, and support requests.

This policy applies to all users of the Platform, including visitors to our public-facing pages. It does not apply to third-party websites or services linked from the Platform.

We may process the following categories of personal data:

• Account and identity data. Name, email address, and authentication identifiers provided during registration and sign-in via our identity provider.
• Subscription and billing data. Subscription tier, billing status, credit balances, and payment transaction identifiers. Payment card details are collected and processed directly by our payment processor and are not stored on our systems.
• Case and investigation content. Messages, notes, case metadata, entity graphs, audit trail logs, findings, tasks, and file attachments you create within your case files. Investigation notes are encrypted client-side before being stored.
• Search and tool inputs. Queries, IP addresses, domain names, email addresses, phone numbers, names, and other identifiers you submit when using OSINT and intelligence tools.
• Documents and files. Files uploaded to case conversations, stored in encrypted storage with automatic expiration (default 7 days).
• Service and reliability data. Error logs, client-side telemetry events, performance metrics, page view data, and operation traces collected for monitoring, debugging, and service improvement.
• Website usage data. On our public website, only with your consent: the pages you view, the links and buttons you use, how far you scroll, glossary search terms, page-speed measurements, the referring website, and your device, browser and approximate location, linked to a random identifier stored in a cookie. Google uses your IP address to derive the approximate location and, according to Google, does not store it in Google Analytics. We use this data only in aggregate reports, not for automated decisions or profiling about you. See "Cookies and Browser Storage" below.
• Terms acceptance records. Timestamps, terms version, and encrypted IP addresses recorded when you accept the Terms of Service. IP addresses are encrypted at rest and are not stored in plaintext.
• OSINT results and analytics. Hashed search query identifiers, breach counts, and aggregated analytics derived from OSINT tool results. Raw search queries are not stored in analytics tables; only cryptographic hashes are retained.

• Directly from you — when you create an account, subscribe, submit searches, upload files, create case content, or contact us.
• From your identity provider — authentication claims (email, name, identifiers) are received from our enterprise identity provider during sign-in.
• Automatically from your device — browser type, page views, performance data, and error information collected via our telemetry systems. See "Cookies and Browser Storage" below.
• From website analytics — on our public website, through Google Analytics, as described in "Cookies and Browser Storage" below.
• From third-party data sources — when you use OSINT tools, results are returned from external providers. These results relate to the subjects of your searches, not to you as the user.

• To authenticate your identity and manage your account.
• To provide and maintain your subscription and credit balance.
• To deliver Platform features, including AI-assisted chat, OSINT searches, entity correlation, investigation reports, and case management.
• To process payments and prevent billing fraud via our payment processor.
• To maintain service reliability, diagnose errors, and monitor performance.
• To enforce our Terms of Service and maintain audit trails for compliance.
• To communicate service updates and respond to support requests.
• To understand how visitors use our public website and improve its content, with your consent (website analytics).
• To comply with applicable legal obligations.

Where applicable data protection law requires a legal basis for processing, we rely on the following:

• Contract performance — processing necessary to provide the Platform and fulfill our obligations under the Terms of Service (account management, subscriptions, feature delivery).
• Legitimate interests — service security, fraud prevention, error diagnostics, performance monitoring, and service improvement, where these interests are not overridden by your rights.
• Legal obligation — where required to comply with applicable law, regulation, or legal process.
• Consent — where you provide explicit consent, such as for OSINT data processing acknowledgements. You may withdraw consent at any time by contacting us.

Website analytics is based solely on your consent (Article 6(1)(a) GDPR and the equivalent provisions of other applicable laws, such as the UK GDPR and the Swiss Federal Act on Data Protection). Giving consent is voluntary, and our website works fully without it. You can give or withdraw consent at any time through "Cookie settings" in the website footer; withdrawing it does not affect the lawfulness of processing carried out before the withdrawal.

Nexus primarily stores application data in the European Economic Area. Our primary database is deployed in AWS eu-north-1 (Stockholm, Sweden). We also use additional cloud services within the Europe geography for certain processing and customer-tenant related operations, including identity management and application monitoring.

File storage (case documents and note attachments) is hosted within the same AWS eu-north-1 region.

Some third-party service providers used by the Platform may process data in locations outside the EEA. See "International Transfers" below.

We use the following categories of service providers to operate the Platform. A detailed list of specific providers is available on request.

While our primary database and identity infrastructure are located within the EEA, certain third-party service providers may process data outside the EU/EEA. This may include providers of AI services, web search, data enrichment, payment processing, content retrieval, and contact form services.

Website analytics is provided by Google Ireland Limited, which processes the data only on our behalf under the Google Ads Data Processing Terms and does not use it for its own purposes. Google may process this data in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework, and Google's data processing terms include the EU Standard Contractual Clauses.

Where personal data is processed by third-party service providers or transferred outside the EU/EEA, we apply appropriate safeguards as required by applicable data protection law, which may include Standard Contractual Clauses, adequacy decisions, or other recognized transfer mechanisms.

All external OSINT and intelligence API requests are routed through our corporate infrastructure so that third-party providers cannot identify or track individual Platform users.

We do not sell personal data. We share data only when necessary to operate the Platform, process payments, deliver requested functionality, or comply with law.

• Service providers — as listed in the subprocessors table above, strictly to the extent necessary for their designated functions.
• OSINT providers — when you use an OSINT tool, your search query (e.g. a domain, IP address, or name) is transmitted to the relevant provider. Queries are routed through our servers; your identity is not disclosed to these providers.
• Legal authorities — where required by applicable law, regulation, or legal process.

Next Sight d.o.o. operates under a strict zero-knowledge principle. Our employees and contractors are legally and technically prohibited from accessing or viewing customer investigation data, including case files, OSINT results, and chat conversations. This is enforced via database-level access control policies.

We retain personal data only as long as necessary to provide the Platform, support account operations, and meet legal and billing obligations.

• Account data is retained for the duration of your account and deleted upon account deletion.
• Uploaded documents expire automatically after 7 days and are deleted via scheduled cleanup processes.
• Case content (messages, notes, findings, entity graphs, tasks, audit trail logs) is retained while your account is active and deleted upon account deletion.
• Billing and credit records may be retained as required by applicable tax and accounting regulations.
• Error logs and telemetry are subject to the retention policies of our monitoring providers and internal log management practices.
• Terms acceptance records (encrypted IP, timestamp, version) are retained as a legal audit trail.
• Website analytics data is kept in Google Analytics for 14 months after your last visit. Analytics cookies expire 13 months after your last visit, and the cookie that records your consent choice 12 months after you make it.

You can request complete account deletion through available account settings. Upon deletion, all user-linked data is permanently removed from active Platform systems, including all case files, messages, findings, entity graphs, uploaded documents, error logs, and the authentication record. This process is irreversible.

We implement technical and organizational measures to protect your data, including:

• Database-level access control policies ensuring users can only access their own data.
• Client-side encryption for investigation notes, so note content cannot be read server-side.
• Server-side encryption of IP addresses collected during terms acceptance.
• HTTPS encryption in transit for all communications.
• Sensitive data masking in OSINT tool outputs, with explicit user confirmation required before revealing full identifiers.
• Authentication tokens validated server-side on every API request.
• Rate limiting to prevent abuse.
• Automated document expiration and cleanup.
• Telemetry data redaction of authorization headers, API keys, and cookies before transmission to monitoring systems.

No system is completely secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security.

The Platform uses the following browser storage mechanisms:

• Authentication state — localStorage and cookies are used by our identity provider library to maintain your authenticated session, including token caching and session management.
• UI preferences — localStorage is used to store interface preferences such as sidebar state. A small first-party cookie stores sidebar collapse state with a 7-day expiration.
• Subscription status caching — localStorage is used to cache the timestamp of the last subscription status check to avoid redundant network requests.
• Application monitoring — when enabled, our application monitoring service may store a small amount of telemetry correlation data in browser storage to support distributed tracing.

Our public website (www.nexus-osint.ai) uses:

• Your consent choice — a strictly necessary first-party cookie (nexus_consent) that records whether you accepted or rejected analytics cookies, for 12 months. It applies across nexus-osint.ai.
• Website analytics — only if you accept: Google Analytics is loaded and sets cookies (_ga and _ga_239T06GSCS) that recognise returning visits, for up to 13 months after your last visit. If you reject or make no choice, Google Analytics is not loaded and no analytics data is sent; if you withdraw consent later, its cookies are deleted and it stops sending data. No advertising cookies are set in any case.
• Embedded video — the product video on our home page and on the law enforcement solution page is hosted on YouTube. Nothing is requested from YouTube until you press play or choose a chapter. The player then loads from youtube-nocookie.com, YouTube's privacy-enhanced mode, and YouTube (Google Ireland Limited) receives your IP address and player requests and may store data in your browser under Google's privacy policy. The "watch it on YouTube" link opens the video on youtube.com instead.

You can change your choice at any time through "Cookie settings" in the website footer.

We do not use third-party advertising cookies or cross-site tracking technologies. Apart from Google Analytics and the click-to-play YouTube video on our public website, as described above, we do not use third-party behavioral analytics services.

Depending on your jurisdiction, you may have rights regarding your personal data, including:

• The right to access the personal data we hold about you.
• The right to request correction of inaccurate data.
• The right to request deletion of your data (you can delete your account directly through the Platform).
• The right to data portability.
• The right to restrict or object to certain processing.
• The right to withdraw consent where processing is based on consent. For website analytics, use "Cookie settings" in the website footer.
• The right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec).

Right to object. Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.

We do not sell your personal data or share it for cross-context behavioural or targeted advertising. If you live in a U.S. state with a consumer privacy law (for example, California), you can use the rights that law gives you, including to know, access, correct and delete your personal information, as described in this section; we will not discriminate against you for exercising them.

To submit a privacy request, contact us at [email protected]. We will respond within the timeframe required by applicable law.

The Platform is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will take steps to delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will provide notice of material changes consistent with the notice provisions in our Terms of Service (minimum 30 days for material changes). The "Last Updated" date at the top of this page indicates when the policy was last revised.