Who we are
Nexus Signatures Ltd (“we”, “us”, “our”) is the data controller for personal data collected through our website and application at https://nexussignatures.com and https://app.nexussignatures.com. Registered in England and Wales. Companies House number: [Companies House number]. Registered address: [Registered address].
If you have any questions about this policy, contact us at: info@nexussignatures.com
What data we collect
We collect the following personal data:
- Account information: your name and email address when you register
- Profile data: your display name and any details you enter into signature templates (e.g. job title, phone number, company name)
- Billing information: payment details processed securely by Stripe — we do not store card numbers
- Usage data: pages visited, features used, and interaction logs to help us improve the service
- Communications: emails you send to us and support requests
- Technical data: IP address, browser type, device type, and cookies (see Cookies)
How we use your data
We use your data to:
- Provide, operate, and improve the Nexus Signatures service
- Process payments and manage your subscription
- Send transactional emails (account confirmation, invoices, service updates)
- Respond to support queries
- Comply with legal obligations
- Detect and prevent fraud or abuse
Legal basis for processing
Under the UK GDPR, we process your data on the following legal bases:
- Contract: processing necessary to provide the service you have subscribed to
- Legitimate interests: improving the service, preventing fraud, and maintaining security
- Legal obligation: where required by law (e.g. retaining financial records)
- Consent: for any optional marketing communications (you may withdraw consent at any time)
Data retention
We retain your personal data for as long as your account is active. If you cancel your account:
- Account data is retained for 30 days in case you wish to reactivate, then deleted
- Financial records (invoices, payment history) are retained for 7 years as required by UK tax law
- Anonymised usage analytics may be retained indefinitely
Third parties we share data with
We share data only with trusted third-party processors who act under data processing agreements:
Supabase
Supabase Inc. — database and authentication hosting. Data stored in EU regions.
Stripe
Stripe, Inc. — payment processing. Stripe is PCI-DSS compliant.
Resend
Resend Inc. — transactional email delivery.
Vercel
Vercel Inc. — application hosting and deployment.
We do not sell your personal data to third parties.
International transfers
Some of our third-party processors are based outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) in accordance with UK GDPR requirements.
Your rights
Under UK GDPR, you have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate data
- Erasure: request deletion of your personal data (subject to legal obligations)
- Restriction: ask us to limit how we process your data
- Portability: receive your data in a machine-readable format
- Object: object to processing based on legitimate interests
To exercise any of these rights, email us at info@nexussignatures.com. We will respond within 30 days.
Right to complain
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113. Our ICO registration number: [ICO registration number].
Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via the application. Continued use of the service after changes constitutes acceptance.
Contact
Nexus Signatures Ltd
[Registered address]
Email: info@nexussignatures.com