Privacy Policy

We keep this list versioned and dated at nexerapxm.com/company/security. We give thirty days’ notice before adding a sub-processor that handles personal data.

Transfers outside the EEA. For Anthropic, fal.ai, Google and the US-incorporated infrastructure providers above, we rely on the European Commission’s Standard Contractual Clauses, supplemented where the provider holds a current EU-US Data Privacy Framework certification. We have carried out transfer impact assessments for the AI providers and will share a summary on request.

We also disclose data where the law requires it, and to professional advisers under confidentiality.

6. Marketing and product emails

If you create an account, we send onboarding and product emails about the service you are using. Lawful basis: performance of a contract, and our legitimate interest in helping you get value out of the platform.

If you sign up for our mailing list without becoming a customer, we send it only after you have opted in. Lawful basis: your consent.

Every message has an unsubscribe link, and unsubscribing works immediately. You can also object at any time by writing to privacy@nexerapxm.com. We keep a record of when and how you gave consent, because we have to be able to show it.

We do not buy contact lists and we do not send unsolicited cold outreach.

7. Cookies and analytics

The site sets cookies that are strictly necessary to make it work, including your session and security cookies. Those need no consent, and you cannot turn them off without breaking the site.

For website statistics we run Umami on our own European infrastructure. It sets no cookies, does not track you across sites, does not build a profile, and sends nothing to a third party. We use it to count page views and see which pages work.

We do not run advertising pixels, session recording, or third-party analytics.

If that changes, we will ask for your consent through a banner before anything non-essential loads, and you will be able to withdraw it at any time.

8. Where your data lives

Everything except AI stays in Europe. The application, the database, your assets in object storage, authentication, logs, email and SMS delivery, and support conversations all run in EU regions and are not replicated outside the EU, not for analytics, not for backups, not for support.

AI features are the exception, and we want to be plain about it. When you use text enrichment or translation, the content you send is processed by Anthropic in the United States. When you use background removal or 3D generation, the asset is processed by fal.ai in the United States. Neither provider trains its models on your content, and both transfers run under Standard Contractual Clauses.

If your organisation cannot accept US processing of catalog content, do not enable the AI features, and talk to us. We can discuss EU-resident inference for enterprise agreements.

Several of our EU-hosted providers are US-incorporated companies. Your data is stored and processed in Europe, but their staff may access systems from outside the EEA for support and maintenance under contractual restrictions. That is a smaller exposure than a transfer, but it is not zero, and we would rather say so than imply otherwise.

9. How we protect it

Tenant data is isolated at the database row level. Authentication tokens are hashed and never stored in plaintext, with refresh-token rotation and reuse detection. Shopify access tokens are encrypted at rest. Webhook payloads are verified by HMAC. Every destructive action is written to an audit log, role-based access is enforced at the API layer, and impersonation is always logged.

Our full security posture, including the current sub-processor list, is at nexerapxm.com/company/security.

If something goes wrong, we notify affected tenants without undue delay, and in any event within 72 hours of confirming a material incident, followed by a post-mortem. Where the law requires it, we also notify the Autoriteit Persoonsgegevens.

10. How long we keep things