Privacy Policy

1. Who we are

NexusG8 is operated by Mecca Digital LLC, a Texas limited liability company ("NexusG8", "we", "us"), which runs the platform at nexusg8.com, nxsg8.com, and related addresses (together, the "Service"). We are based in Dallas, Texas, USA.

On the Service, a person's own page is their NexusG8 and an approved organisation's presence is its Community NexusG8. This Policy explains how we handle personal information across both.

This Policy applies to everyone who visits or uses the Service: visitors, members, community administrators, and people who scan a QR code or open a shared link. It does not apply to information a community or business collects from you outside the Service; their own policies cover that.

2. Information we collect

2.1 What you give us

• Account details. Name, email address, a password (stored only as a hash), and, if you sign in with Google or GitHub, the name, email address, and profile picture that provider shares with us. We ask those providers for nothing beyond basic profile and email.
• Your NexusG8. Everything you choose to put on your page: username, photo, headline, bio, links, city or region, profession, skills, goals, needs, offers, and any cards or notes you add. You decide what is public.
• Recordings. A voice note you leave another member, a note you record for yourself about someone you met, a voice message you leave on someone's page, and the greeting on your own page. Recordings are stored privately and played only to the people each feature names: the sender and the recipient of a voice note, you alone for a note to yourself, and a page's editors for a message left on it. The greeting on your own page is public, like the rest of the page.
• Community information. When you apply to or join a Community NexusG8: your answers to that community's questions, your membership status and role, the date you joined, how you arrived (for example, which QR code or invitation), and community tags.
• The Waiting list. While NexusG8 is by invitation, if you apply: your name, email address and city; who you are applying as (for yourself, a community or a business); the community or business you name and, if you are a steward, its kind and rough size; the address you ask us to keep for you; what you would like to talk about (the agency, own hosting); anything you write; and how you reached us (a community's door, a member's invitation, or the page or posted link you came from). We use it to invite you, to keep your name for you, and to decide which communities to open first.
• Mecca Digital applications. If you apply to Mecca Digital, the community the founder runs on NexusG8: your profession or business, your city, what you can offer and what you are looking for, your agreement to the Community Guidelines, and who invited you. If the person who invited you is on NexusG8, you choose them by name and we need nothing more. If they are not, you give us their name, phone number, email address and one social profile. We use those only to confirm that they invited you; only the founder can see them, and only to confirm it; and we delete them as soon as your application is decided. Please give them only with that person's permission. Choosing "I know the founder" asks you for nothing.
• Messages to us. Support requests, reports about other members, community applications, and anything else you send us.
• Payment details. If you buy a subscription, our payment partner collects your card details directly. We never see or store your full card number; we receive a record of the purchase, the plan, and its status.

2.2 What is generated when the Service is used

• Page views. When someone opens a NexusG8 page we record the viewer's IP address, browser and device type, the page that referred them, the country, and the time. This powers the analytics the page's owner sees (views, devices, countries, top referrers). One record is kept per viewer per page per hour.
• Link clicks. Which card or link on a page was clicked, with the same technical details.
• Scan and share events. When a QR code, NFC tag, Share Pass, or shared link is used, we record that it was used, from which entry point, and when.
• Security and service records. Login activity, rate-limit counters, error logs, and audit records of administrative actions (for example, who approved a membership).
• Cookies and local storage. See section 8.

2.3 Information about people you meet

Your People list holds the people you have connected or swapped details with, and anyone you add yourself: by typing their details in, by importing a list, or by scanning their business card (section 4). For someone who is not a member, that is what you choose to save about them: their name, email address, phone number, company, title and website, where you met, and your own notes. Your People list is yours: other members cannot see it, and it is part of your data export.

Please add only people you have met or who gave you their details. If you send someone a follow-up email through NexusG8, we send it for you, with your name on it and your email address to reply to, and we keep a record that it was sent.

2.4 What we do not collect

We do not collect government identification numbers, precise GPS location, biometric data, financial account numbers, or health information, and we ask you not to put such information on your NexusG8. We do not buy data about you from data brokers.

3. How we use information

We use personal information to:

1. Run the Service. Create your account, show your NexusG8, keep you signed in, send verification and password emails, and process subscriptions.
2. Operate communities. Deliver your application to a Community NexusG8, let its administrators review it, show you the directory you are entitled to see, and deliver community broadcasts.
3. Discovery and matching. Suggest people, communities, events, and opportunities that fit your skills, goals, needs, location, and affiliations. Matching starts from the structured fields you provide, not from tracking your behaviour elsewhere.
4. The community share. NexusG8 credits a share of each sale to the community it came through: half of what is left for a verified community, a fifth before it is verified. To make that work we record which community's link a purchase came through and which community first approved a paying member, and calculate and report each community's share. Where sponsorships are offered, sponsors receive aggregate results, not your personal information (section 5.4).
5. Improve and build the Service. Understand which features are used, fix problems, test changes, and develop new tools, including AI-assisted discovery and routing. We may use platform data, including your profile fields, to tune our own matching and ranking. We do not hand your data to third-party AI companies for them to train their models.
6. Keep the Service safe. Detect fraud, impersonation, spam, scraping, and abuse; enforce our Terms of Service and Community Guidelines; protect members and communities.
7. Communicate with you. Service messages (which you cannot opt out of while you have an account) and, where you have opted in, digests and announcements.
8. Meet legal obligations and defend legal claims.

3.1 Aggregated and de-identified data

We create statistics and insights that do not identify you, for example "this community has 34 accountants and 12 open mentoring offers". We may use and share aggregated or de-identified data for any purpose, including with Community Partners, sponsors, researchers, and the public. We apply minimum-group-size thresholds so small categories do not point to individuals, and we will not attempt to re-identify anyone from this data.

3.2 Legal bases (for people in the EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (sections 3.1–3.2, 3.7 service messages); legitimate interests (sections 3.3–3.6, 3.8, security, fraud prevention, and the details members save about people they meet so they can keep in touch (section 2.3), balanced against your rights); consent (optional emails, optional features that say they need it, and non-essential cookies if we ever add them); and legal obligation (record-keeping and responding to lawful requests).

4. AI features

Some features use Claude, an AI made by Anthropic, PBC. Each one sends Anthropic only what that one task needs, and only when you use it:

• Reading a business card (Scan, then Paper card): the photo you take, so the details printed on it can be read. We do not store the photo. Nothing is saved until you have checked the details and chosen to save the person to your People list.
• Writing help (the bio writer, the page builder and the note writer, where the Service offers them): the text you type and the fields you choose to include.
• Hadi, the guide (Hi Hadi on the site and in the app, and Hadi in Messages if you add it): your question, and what Hadi reads to answer it: NexusG8's own questions and answers. On Pro or Gateway, Hi Hadi Builder also reads the parts of your own account you ask about: your Personal Gate's views, people in your own Network by what they do (only people you can already see there), and a page or a message you ask it to draft. Hadi never acts for you: anything it drafts waits for you to confirm.
• Hadi for a community you belong to, where its stewards have it: your question and that community's own information and events you may see. For its stewards, it also reads who is waiting at the door and who in the community knows them, to help them answer.
• Hadi for the NexusG8 team (Mission Control): to answer the team's questions about the platform, it reads members' and communities' names, handles, cities, plans and activity. Never an email address or a phone number; a member's contact details are shown to the team only on the team's own screen, and each time it is recorded.
• Mr Hadi, for people the founder invites to learn about NexusG8 as an investment: their questions, answered only from material the founder approved. It never reads or discusses members.
• Talking to Hadi (where offered): the speech recognition built into your browser turns your words into text (in Chrome, Google's servers; in Safari, Apple's) before anything reaches us, and your device reads answers aloud. NexusG8 keeps no recording.

Anthropic processes this for us under its commercial terms. It does not use it to train its models, and it deletes it within 30 days, unless the law requires longer or the request breaks its usage policy (then up to two years). Claude keeps no memory or profile of you from one request to the next. AI output is a suggestion; you decide whether to keep it. We do not make automated decisions about you that have legal or similarly significant effects. Before we add another AI feature, we add it to this section. We keep a record of each question Hadi answers (when, which Hadi, and what it cost), never the question itself, except a conversation with Hadi in Messages, which is kept for 30 days and deleted at once if you remove Hadi.

5. How information is shared

5.1 What you publish

Anything you set to public on your NexusG8 is visible to anyone who has the address, including search engines. Unlisted, community-only, link-only, and private settings limit who can see an item as described in the product.

5.2 Community NexusG8s you join

A community you join, and its authorised administrators, can see what is reasonably necessary to manage the relationship: your name, photo, headline, the answers you gave them, your role and status, and the fields you have made visible to that community. They do not receive your password, your sign-in provider details, your private items, your activity in other communities, or your payment information. Administrators are bound by the Community Guidelines and, for approved partners, the Community Partner Terms, which prohibit exporting, selling, or misusing member information.

If you ask to join a community at its door while NexusG8 is by invitation and you have no account yet, that community's stewards see your name, email address, city and anything you wrote, so they can let you in. The form tells you this before you send it. A steward who doesn't know you can take you off their community's list; you stay on the Waiting list itself.

5.3 People you share with

A Share Pass, QR code, or contact download shows exactly the fields you chose for it, nothing else.

5.4 Sponsors and opportunity providers

Where sponsorships or promoted opportunities are offered, we route them to relevant audiences inside the platform. Sponsors receive reach and outcome figures in aggregate. They do not receive your personal information unless you choose to contact or apply to them, at which point what you send them is governed by their policies.

5.5 Service providers

We use a small number of companies to run the Service. They may process personal information only on our instructions and under contracts that protect it:

• Hosting: Hetzner Online GmbH (Nuremberg, Germany). Application servers.
• Database and file storage: Supabase (Frankfurt, Germany region). Your account, page, community, and analytics records; uploaded images.
• Email delivery: Resend (United States). Verification, password, and notification emails.
• Phone verification: Twilio Inc. (United States). Your phone number, to send and check a code, only when you confirm a number.
• Sign-in providers: Google LLC and GitHub, Inc. Only if you choose to sign in with them.
• Payments: Stripe, Inc. Subscriptions, one-time purchases, contributions and invoices. Stripe receives your card details directly; we receive a customer reference, the amount and your email.
• AI: Anthropic, PBC (United States). Only what an AI feature you use sends it (section 4): the text you type for writing help, the photo of a business card you scan, and your questions to Hadi with what Hadi reads to answer them.
• PostHog (PostHog Inc., EU Cloud in Frankfurt, Germany): product analytics. Which pages of NexusG8 are visited (the page's path, never what follows it in the address), your browser, device type and country. Never your name, email, phone, messages, private card, billing pages or the investor pages. No cookies are set for it, and it respects your browser's Do Not Track setting. Kept for up to 12 months.
• Sentry (Functional Software, Inc., EU region in Frankfurt, Germany): reports of errors in the app and on our server, so we can fix them: the error, where in the code it happened, the page's path, and your browser. Never your name, email, phone, cookies or what you typed. Kept for 30 days.
• Off-site backups: Cloudflare, Inc. (R2 object storage, eastern North America). A nightly copy of the database, in a private bucket encrypted at rest.
• Push notifications: Apple, Google and Mozilla push services. Only if you switch notifications on; they carry a delivery token, not your content.
• Wallet cards: Apple, when your card is in Apple Wallet (its push service tells the pass to update); and Add This Card (addthiscard.com), only if you choose it to add your card on another phone, which receives your display name, your NexusG8 handle and your page's address.

We will update this list when providers change.

Some pages also show content from other services: a map (OpenFreeMap, OpenStreetMap), the weather (Open-Meteo), prayer times (Al Adhan), link icons (Google), and videos, music or posts a page owner embeds (for example YouTube, Vimeo, Spotify, Apple Music or X). Your browser, or our server on its behalf, fetches that content from them, so they can see the address that asked and what was asked for. They receive nothing from your account, and their own policies apply.

5.6 Legal, safety, and corporate

We may disclose information when we reasonably believe it is necessary to comply with law or a valid legal request; to protect the safety, rights, or property of any person or of NexusG8; to investigate fraud or abuse; or in connection with a merger, financing, acquisition, or sale of assets, in which case this Policy continues to apply to the transferred information.

5.7 We do not sell your personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act. We have not done so in the preceding twelve months. We do not run third-party advertising trackers on the Service.

6. Where information is stored and international transfers

Your information is stored in the European Union (Germany). NexusG8 operates from the United States, and some service providers listed in section 5.5 process information in the United States. Where information about people in the EEA, UK, or Switzerland is transferred outside those areas, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism. Wherever it is, your information is protected by this Policy.

7. How long we keep information

• Account and page data: for as long as your account exists. After you delete your account we remove or de-identify your personal information within 30 days, except as described below.
• Business card photos: not stored by us. Each is read and dropped; Anthropic deletes it within 30 days (section 4).
• Your People list: until you remove someone from it or delete your account.
• A reference on a Mecca Digital application: the name, phone number, email address and profile of a person who invited you and is not a member, until your application is decided, then deleted. The application itself is kept with your account.
• Recordings: until they are deleted, or the account they belong to is deleted.
• Page analytics (views and clicks): kept while the page exists so its owner's statistics stay accurate; deleted with the page.
• Community records: a community keeps a minimal record that you were a member and when you left, so its history and profit-share reports stay accurate. Your answers and profile details are removed from its view when you leave or delete your account.
• Analytics and error reports: up to 12 months for product analytics, 30 days for error reports.
• Hadi: a conversation with Hadi in Messages, 30 days (deleted at once if you remove Hadi); the record of each question (when, which Hadi, its cost, never the question), 13 months; something Hadi drafted for you to confirm, 90 days.
• Mr Hadi: an invited person's name, email, questions and when they opened their link, for as long as the link lasts and 12 months after.
• Security, audit, and financial records: up to seven years where needed for fraud prevention, dispute resolution, tax, or legal requirements.
• Backups: a nightly copy of the database is kept on our server for 14 days and a second copy off site (see section 5.5) for 30 days, so information you delete leaves them within 30 days. An occasional complete snapshot, taken by hand before a large change, is kept until we remove it.
• Aggregated and de-identified data: may be kept indefinitely.

8. Cookies and similar technologies

We set only our own cookies, never a third party's:

• Signing in: a strictly necessary cookie that keeps you signed in (seven days, renewed while you use the Service), plus short-lived security cookies while you sign in.
• Invitations: while NexusG8 is by invitation, a cookie carries an invitation from the page that opened it to sign-up, for up to 60 days.
• Referrals and campaign links: when you arrive through a member's, a community's, an Ambassador's or a partner's link, or a link we posted, a cookie remembers which one for 30 days, so the person who brought you can be credited and we can see which posts bring people in. It holds the link's tag, nothing about you.
• Preferences: your choice of colour palette, for 90 days.
• Our investor page: cookies that remember you registered to read it, for 30 days.

In your browser's local storage we keep your theme, the tips you have closed, drafts you have not sent (a business listing's draft includes its photos), and a copy of your pocket card so it opens offline. That data stays on your device. We do not use advertising cookies or third-party analytics scripts. If that changes we will ask for your consent first.

9. Security

We protect information with encryption in transit (TLS) and at rest, role-based access controls, row-level security in our database, server-side authorisation on every sensitive action, rate limiting, audit logs, and restricted administrative access. Passwords are stored only as salted hashes. No service is perfectly secure; please use a strong password, keep your devices safe, and tell us at once at privacy@nexusg8.com if you think your account has been compromised. If a breach affects you, we will notify you and any regulator as the law requires.

10. Your rights and choices

Wherever you live, you can:

• Access the personal information we hold about you and receive a copy in a portable format.
• Correct anything inaccurate (most of it you can edit yourself in your account).
• Delete your account and personal information.
• Object to or restrict certain processing, including matching and discovery, by adjusting your visibility settings or by asking us.
• Withdraw consent where processing is based on consent, without affecting what was done before.
• Opt out of non-essential email using the link in any message.
• Complain to us, and to your data protection authority if you are in the EEA, UK, or Switzerland.

If a member saved your details (for example from your business card) and you are not a member yourself, you have these rights over that information too. Write to privacy@nexusg8.com and we will remove it.

California residents additionally have the right to know the categories and specific pieces of personal information we collect, the sources, our purposes, and the categories of third parties we disclose it to (all set out above); the right to delete; the right to correct; and the right not to be discriminated against for exercising these rights. Because we do not sell or share personal information, there is nothing to opt out of; we also do not use or disclose sensitive personal information for purposes that require a right to limit. You may use an authorised agent by giving them written permission that we can verify.

To exercise a right, email privacy@nexusg8.com from the address on your account, or contact us through your account settings. We will verify your identity, respond within 30 days (45 days for California requests, extendable once where permitted), and we will not charge you unless a request is clearly unfounded or excessive.

11. Children

The Service is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect any information from children under 13. If we learn that we have, we delete it. If you believe a child has created an account, email privacy@nexusg8.com. If we ever launch a programme for younger members through schools or community organisations, it will come with guardian consent and its own safeguards, and this Policy will be updated first.

12. Third-party links

NexusG8 pages and Community NexusG8s link out to websites, social networks, payment pages, and event tools that we do not control. Their privacy practices are their own. Check their policies before giving them information.

13. Changes to this Policy

We will post any changes here and update the date at the top. For material changes we will also tell you by email or a notice in the Service at least 14 days before they take effect. Continuing to use the Service after that date means the updated Policy applies.

14. Contact

Privacy questions and requests: privacy@nexusg8.com
Everything else: support@nexusg8.com
Post: Mecca Digital LLC (NexusG8), Dallas, Texas, USA

If you are in the EEA, UK, or Switzerland and are not satisfied with our response, you can lodge a complaint with your local supervisory authority.