Privacy Policy

This policy explains how Arkenly LLC (“we”) handles personal information on NexoPages: for people who create pages (“owners”), for people who visit pages or contact a business through them (“visitors”), and on nexopages.com. We keep it short and specific to how the product actually works.

1. Who is responsible

• For owners' accounts and for nexopages.com, Arkenly LLC, Wyoming, USA, is the controller. Contact: [email protected].
• For information visitors send to a business through its page (messages, bookings, sign-ups), that business is the controller and we process it on their behalf. If you contacted a business through NexoPages, please ask the business first about your information; we'll help them respond.

2. What we collect

Owners

• Account: email address, name, sign-in records, and the time zone and language you use.
• Your page: the content you add, such as business name, contact details, photos, prices, hours and team members' names and emails.
• Billing: plan, subscription status and invoices from Stripe. Card details are handled by Stripe and never reach us.
• Connections: if you connect Google Calendar, access tokens (stored encrypted), and the busy times and events needed to sync bookings. If you connect Stripe or PayPal, your account's id and name or email, and its status (we don't receive passwords or bank details). If you connect Mailchimp, Kit or Google Sheets, an access token or API key (stored encrypted), the account name, and which audience, form or sheet sign-ups go to. If you connect Instagram, TikTok or your Google Business Profile, an access token (stored encrypted), your account name, and copies of your latest posts (text, link and image) or of your business's reviews (reviewer's name as shown on Google, rating, text and date), refreshed regularly and deleted when you disconnect or remove the block.
• Imports: contacts and upcoming appointments you bring in from a file, Calendly or Google Calendar, and the links you import from a Linktree or Beacons page. A Calendly token you paste is used once and never kept. You confirm that the people you import agreed to hear from you.
• Files you sell: digital downloads you upload, kept private and given only to your buyers.
• AI requests: what you ask the AI to change and the resulting change, kept to show your history and control costs.
• Usage and security: device and browser type, IP address (for security and rate limits), actions in the app, such as publishing a page, and the days you use the app (dates only, kept about 13 months, for aggregated statistics). If you turn on two-step sign-in, we keep its secret encrypted and only a scrambled form of your backup codes.

Visitors to a page

• What you send through the page: for example your name, email, phone number, message, booking time and place, answers to the business's booking questions and any notes, plus your consent choices.
• When you buy or tip: what you bought, the amount, your name, email and country as Stripe or PayPal give them to us, and how many times you downloaded a file. Your card or PayPal details stay with Stripe or PayPal.
• Reviews: if the business asks for reviews, one email after your appointment or order with a private link. What you write (stars, words and the name you choose) goes to the business, and appears on their page only if you agreed and they approve it.
• Basic page statistics: views and taps, with your country and device type. We don't use cookies, advertising trackers or any visitor identifier on pages for this.
• Security information such as your IP address, used for spam protection and rate limits.

3. How we use it

• To provide the Service: host pages, deliver messages and bookings to the business, send confirmations, reminders, review requests the business turned on, and alerts, and sync calendars.
• To run accounts and billing, and to send service emails (sign-in codes, account and billing notices).
• To send owners tips and summaries about their page, which they can turn off any time with the unsubscribe link or in Settings.
• To keep the Service safe: prevent spam, fraud and abuse, enforce our policies, and email you when your account is signed in to from a new kind of device. Automated checks look for phishing patterns in pages as they're published and for signs of spam sign-ups; they only flag a page or account for a person on our team to review, and may hold a new account's page until that review.
• To understand and improve the product, using aggregated statistics, and to credit the business that invited you (only that business and you know an invite was used; they don't see who you are).

If you're in the EEA, UK or Switzerland, our legal bases are: performing our contract with you; our legitimate interests in running, securing and improving the Service; your consent where we ask for it; and legal obligations.

We don't sell personal information, and we don't share it for cross-context behavioural advertising.

4. Who we share it with

We use these service providers (“subprocessors”) under contracts that limit how they may use data:

Pages with a YouTube feed use YouTube API Services: by viewing them you're also subject to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy. Images in YouTube, Instagram and TikTok feeds are copied to our servers, so viewing a page doesn't connect you to those services until you open a post.

Information a visitor sends through a page goes to that page's owner, and, if the owner connects one, to the owner's own Mailchimp, Kit or Google Sheets account, or to a web address or tool the owner sets up with webhooks or an API key, which the owner controls. We may also disclose information when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the Service (with this policy still applying).

5. Where it's stored

Our servers are in the United States. When we transfer personal information from the EEA, UK or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Unfinished page drafts from the sign-up wizard: 7 days.
• Owner accounts and page data: while the account exists. After an owner deletes their account, everything is permanently deleted after 30 days, including photos and files for sale.
• Orders and tips: with the business's account, as part of its sales records. Checkouts that were never paid are closed after 24 hours.
• Email delivery and payment-event logs, and security logs (sign-ins, failed sign-ins and new businesses, with IP address): 90 days.
• Records of sign-ups sent to an owner's Mailchimp, Kit or Google Sheet: 90 days. The email address and name are removed from the record as soon as they are delivered.
• Records of webhooks sent to an owner's web address (what was sent when, and the answer, not the content): 30 days.
• Copies of an owner's latest social posts and Google reviews: replaced at each refresh (every few hours for posts, daily for reviews) and deleted when the owner disconnects the account or removes the block.
• Security audit records: 2 years.
• Backups: up to 35 days.
• Information visitors sent to a business: until the business deletes it or its account.

We keep information longer only when the law requires it, for example under a legal hold.

7. Your choices and rights

• Owners can view and change their information in the app, export their leads, manage email preferences, and delete their account in Settings.
• Depending on where you live (for example under the GDPR or US state laws such as the CCPA), you may have the right to access, correct, delete or receive a copy of your information, to object to or restrict some uses, and to withdraw consent. We won't treat you differently for using these rights.
• To make a request, email [email protected]. We'll confirm your identity and reply within the time the law requires (usually 30 days). You can also complain to your local data protection authority.

8. Cookies and outside content

• The NexoPages app and admin tools use only essential cookies, to keep you signed in and to protect against forged requests.
• Pages and nexopages.com set no cookies. Fonts and images are served by us, so opening a page doesn't contact other companies.
• Videos and booking calendars from other services (such as YouTube, Vimeo, Calendly or Cal.com) load only when you choose to play or show them. That service may then set its own cookies. Your choice is kept in your browser for that page, and you can change it under “Privacy choices” at the bottom of the page.
• Spam protection: forms and bookings may use Cloudflare Turnstile to check that a person, not a bot, is sending them.
• Advertising pixels. Owners on the Pro plan can add a Meta or TikTok pixel to their page to measure their ads. You're asked first (“Allow ad measurement?”), and the pixel loads only if you allow it; Meta or TikTok may then set cookies and receive your IP address, under their own privacy policies, as independent controllers. You can change your answer under “Ad choices” at the bottom of the page.

9. Security

We use encryption in transit, encrypted storage for sensitive tokens, strict separation between businesses' data in our database, least-privilege access for our staff with passkeys and audit logs, and regular backups. No system is perfectly secure; if a breach affects your information, we'll notify you as the law requires.

10. Children

NexoPages is not meant for children. Owners must be at least 16, and we don't knowingly collect information from children under 13.

11. Changes

If we make significant changes to this policy, we'll tell owners by email or in the app before they take effect.

Contact

Arkenly LLC, Wyoming, USA · [email protected]