Privacy Policy
Last updated: July 13, 2026
Overview
Nexusplan ("Nexusplan", "we", "our", or "us") operates the website at nexusplan.io and the planning application at app.nexusplan.io (collectively, the "Service"). This Privacy Policy explains what personal information we collect, how we use and protect it, and the rights you have over your data. It applies to all visitors, registered users, and anyone who interacts with our Service.
If you do not agree with this policy, please do not use our Service. By using the Service you acknowledge that you have read and understood this policy.
Information We Collect
Account Information. When you register, we collect your name, email address, and a hashed password. If you sign up via an OAuth provider (Google, GitHub), we receive only the profile data that provider shares (name, email, avatar).
Project Data. Floor plans, device placements, wall configurations, room layouts, cable routes, simulation settings, notes, and any other content you create in the Service ("Project Data") are stored on our servers to provide the Service.
Usage Data. We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, session duration, browser type, operating system, screen resolution, and referring URL. This data is tied to your account when you are signed in, and to an anonymous session identifier when you are not.
Payment Information. If you subscribe to a paid plan, payments are processed by our payment processor (Stripe). We receive only a payment confirmation token and the last four digits of your card — we never see or store your full card number.
Communications. If you contact us by email or through the contact form, we store the message content and your email address so we can respond.
Cookies and Similar Technologies. We use session cookies (required for login), preference cookies (theme, locale), and optional analytics cookies. See the Cookies section below for full details.
How We Use Your Information
We use the information we collect to:
- Provide and improve the Service — render your projects, run simulations, generate exports, and operate all core features.
- Authenticate you — verify your identity on each session.
- Send transactional emails — account verification, password resets, subscription receipts, and important service notices.
- Send marketing emails — product updates, tips, and new features, only if you have opted in. You can unsubscribe at any time via the link in any such email.
- Analyse usage — understand aggregate patterns to improve the product. Analysis is performed on anonymised or pseudonymised data wherever possible.
- Detect and prevent abuse — identify suspicious activity, enforce our Terms, and protect users and the Service.
- Comply with legal obligations — respond to lawful requests from authorities or meet regulatory requirements.
We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with similar requirements, we rely on the following legal bases to process your personal data:
- Contract — processing necessary to deliver the Service you signed up for (account data, project data, payments).
- Legitimate interests — usage analytics, security monitoring, and product improvement, where these interests are not overridden by your rights.
- Consent — optional analytics cookies and marketing emails, where you have given explicit consent. You may withdraw consent at any time.
- Legal obligation — retaining records as required by applicable law.
How We Share Your Information
We share your information only in the following limited circumstances:
Service Providers. We use trusted third-party services to operate the Service, including cloud hosting (Cloudflare), email delivery, payment processing (Stripe), and error monitoring. These providers process data only on our behalf under confidentiality agreements.
Business Transfers. If Nexusplan is acquired, merged, or undergoes a restructure, your data may be transferred to the successor entity. We will notify you by email and in-app notice before any transfer, and you will have the opportunity to delete your account.
Legal Requirements. We may disclose your information if required to do so by law, court order, or government authority, or when we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.
Aggregated or Anonymised Data. We may share aggregated, non-personally-identifiable statistics (such as "X% of users prefer zigbee layouts") publicly or with partners. Such data cannot identify you.
We do not share your Project Data with any third party for advertising or profiling purposes.
Data Retention
We retain your personal information for as long as your account is active, or as needed to provide the Service and comply with legal obligations.
- Account data — retained until you delete your account, plus up to 30 days in backups before purging.
- Project data — deleted permanently within 30 days of account deletion.
- Usage logs — retained for up to 12 months, then deleted or anonymised.
- Payment records — retained for 7 years to comply with tax and financial regulations.
- Emails you send us — retained for up to 3 years for support continuity, then deleted.
You may request deletion of your data at any time (see Your Rights below).
Data Security
We implement industry-standard technical and organisational measures to protect your data, including:
- TLS encryption in transit for all connections.
- Encrypted storage for sensitive fields (passwords are hashed with bcrypt; payment tokens are stored encrypted at rest).
- Access controls that limit which employees can access personal data.
- Regular security reviews and dependency auditing.
No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you discover a security vulnerability, please report it responsibly to security@nexusplan.io.
Your Rights
Depending on your location, you may have some or all of the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate or incomplete data.
- Deletion — ask us to delete your personal data ("right to be forgotten").
- Portability — receive your Project Data in a machine-readable format (JSON or PDF export).
- Restriction — ask us to pause processing of your data while a complaint is resolved.
- Objection — object to processing based on legitimate interests, including profiling.
- Withdraw Consent — withdraw consent for optional analytics or marketing at any time without affecting prior lawful processing.
To exercise any of these rights, email us at privacy@nexusplan.io with the subject "Privacy Request". We will respond within 30 days. We may ask you to verify your identity before processing the request.
If you are located in the EEA or UK and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection authority.
International Data Transfers
Our servers are located primarily in the United States and European Union via our cloud infrastructure provider. If you are located outside these regions, your data is transferred to and processed in these countries. Where required, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards, to legitimise such transfers.
Children's Privacy
The Service is not directed to children under the age of 16 (or 13 in jurisdictions where that is the minimum age of digital consent). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at privacy@nexusplan.io and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes we will notify you by email (if you have an account) and by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.
Contact Us
If you have questions or concerns about this Privacy Policy or how we handle your data, please contact us at:
Email: privacy@nexusplan.io Postal: Nexusplan, PO Box [TBC], [City, Country]
We will respond to all privacy inquiries within 30 days.