Privacy Policy

Effective date: July 17, 2026

Last updated: July 17, 2026

1. Introduction

Nexsus Growth (“we,” “our,” “us”) operates https://nexsusgrowth.com and provides AI-powered automation services for businesses, including our AI assistant Nex, the free AI Automation Audit, Messenger and WhatsApp commerce automation, workflow automation, and related services. Nexsus Growth is based in Bangladesh.

This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it. It is written to comply with the Personal Data Protection Ordinance, 2025 (Bangladesh)(“PDPO”), and, where applicable to international users, the EU/UK General Data Protection Regulation (GDPR), as well as Meta Platform Terms for Messenger and WhatsApp integrations.

By using our website or services, you acknowledge this policy. Where the law requires consent, we ask for it explicitly and you may withdraw it at any time (Section 8).

2. Data We Collect

2.1 Information you provide directly

Contact and lead forms: name, email address, phone/WhatsApp number, business name, business details you choose to share
Free AI Automation Audit form: information about your business operations (e.g., order volumes, delivery and return rates, response times) used to generate your personalized report
Booking data: appointment details when you schedule a call via our scheduling provider
Client account data: login credentials (passwords are stored only as secure hashes), profile information, files you upload
Support and correspondence: messages you send us by email, chat, or messaging platforms

2.2 Information collected automatically

Technical data: IP address, browser type, device type, operating system, pages visited, referral source
Usage analytics and performance data (loaded only after you accept non-essential cookies in our consent banner)
Security signals: bot-protection challenge results, rate-limit and abuse-prevention logs

2.3 AI conversation data

When you chat with Nex (our AI assistant) on our website or through connected messaging channels, we process the content of your messages, timestamps, and delivery metadata to generate responses and provide the service. Conversations may be logged for quality, safety, and service improvement.

2.4 Messaging platform data (Messenger / WhatsApp)

If you interact with us via Facebook Messenger or the WhatsApp Business API, we receive data permitted by the respective platform, such as your public profile name, profile picture, message content, and delivery status — always subject to Meta’s Platform Terms and your platform settings.

2.5 Payment data

Payments are processed by our payment providers (Stripe and/or SSLCommerz, where enabled). We do not store full card numbers or payment credentials on our systems; we receive only transaction confirmations and billing metadata.

We practice data minimization: we do not collect data irrelevant to the purposes described in this policy.

3. Why We Use Your Data (Purposes & Legal Bases)

Service delivery

Generating your AI Audit report, running automations, operating Nex, client dashboards

Legal basis: Contract performance; consent

Communication

Responding to inquiries, service notices, appointment reminders

Legal basis: Contract performance; legitimate interest

Marketing

Newsletters and follow-ups where you have opted in; you can unsubscribe at any time

Legal basis: Consent

Security & fraud prevention

Bot protection, abuse detection, login security, audit logging

Legal basis: Legitimate interest; legal obligation

Product improvement

Aggregated analytics, error monitoring, AI response quality review

Legal basis: Consent (analytics); legitimate interest

Legal compliance

Tax, accounting, responding to lawful requests

Legal basis: Legal obligation

Under the PDPO, where consent is the basis of processing, your consent is explicit, voluntary, specific, and revocable, and the burden of proving valid consent rests on us. We log consent events for compliance evidence.

We do not sell your personal data. Ever.

4. Third-Party Subprocessors

We use a small set of carefully selected service providers to operate our platform. Each processes data only as necessary to provide its function and is bound by its own data protection commitments:

Vercel: Website hosting and content delivery
Neon: Database hosting (PostgreSQL)
Cloudflare: CDN, security/WAF, bot protection (Turnstile), file storage (R2)
Anthropic: AI language model that powers Nex and report generation
Resend: Transactional and service email delivery
Sentry: Error monitoring (with PII redaction)
Cal.com: Appointment scheduling
Upstash: Caching and rate-limiting infrastructure (Redis)
Langfuse: AI interaction observability and quality monitoring
BetterStack: Uptime monitoring
Stripe / SSLCommerz: Payment processing (where enabled)
Meta Platforms (Facebook Messenger, WhatsApp Business API): Messaging automation, where you interact with us on those channels

Workflow automations run on infrastructure we operate ourselves. We may update this list as our stack evolves; material changes will be reflected on this page.

5. Data Sharing

We share personal data only:

with the subprocessors above, to the extent needed to deliver the service;
with your explicit consent or at your direction;
when required by law, regulation, or valid legal process;
in connection with a business transfer (merger/acquisition), with notice to you.

6. Cookies & Tracking

Our cookie consent banner offers three categories:

Essential — required for the site to function (always on)
Analytics — performance and usage measurement; loads only after you accept
Marketing — campaign measurement (e.g., Meta Pixel where enabled); loads only after you accept

Your choice is stored in your browser and logged server-side as compliance evidence. You can change your preferences at any time via browser settings or by clearing site data, after which the banner will re-appear.

7. Data Retention

We retain personal data only as long as needed for the purposes above or as required by law. Indicatively:

Lead and audit-form data: for the duration of our business relationship or until you request deletion
Security and audit logs: up to 1 year, then archived or deleted
Consent records: retained as compliance evidence for as long as legally required
Financial records: as required by Bangladesh tax and accounting law

When data is no longer needed, it is securely deleted or irreversibly anonymized, consistent with the PDPO’s retention-limit and destruction requirements.

8. Your Rights

Subject to applicable law (PDPO for Bangladesh; GDPR for EEA/UK users), you have the right to:

Access a copy of your personal data
Correct inaccurate or incomplete data
Delete your data (“right to erasure”) — see Section 9
Port your data in a structured, machine-readable format
Withdraw consent at any time — processing based on that consent will then cease
Object to or restrict certain processing
Opt out of marketing at any time via the unsubscribe link in any email

To exercise any right, email jobeyarrj@nexsusgrowth.com. We will acknowledge your request within 48 hours and fulfill it within 30 days, unless the law allows or requires otherwise. We may need to verify your identity before acting.

9. Data Deletion Requests (including Messenger & WhatsApp)

You may request deletion of your personal data at any time:

Option A — Email: Send a message to jobeyarrj@nexsusgrowth.comwith the subject line “DATA DELETION REQUEST”, including your name, the email/phone used with our services, and (if applicable) your Messenger or WhatsApp identity.

Option B — In-chat: Send the message “DELETE MY DATA” to us in Facebook Messenger or WhatsApp. You will receive confirmation and any follow-up instructions.

Upon a verified request we delete: your identification details, conversation logs and chat history, contact preferences, and associated usage records. We may retain limited data where the law requires it (e.g., tax records, consent evidence, fraud-prevention records), and we will tell you if so.

Timeline: acknowledgment within 48 hours; completion within 30 days; email confirmation on completion.

10. Security

We design for security by default: encrypted transport (HTTPS/TLS), encryption of sensitive data at rest, least-privilege access controls, multi-factor authentication for administrative access, structured logging with PII redaction, rate limiting and bot protection on public forms, and audit logging of sensitive actions. No system is perfectly secure; if a breach materially affects your data, we will notify you and the relevant authorities as required by law.

Security researchers: please report vulnerabilities to jobeyarrj@nexsusgrowth.com rather than filing public issues.

11. International Data Transfers & Data Residency

Some of our subprocessors store or process data outside Bangladesh. Where personal data is transferred internationally, we rely on appropriate safeguards such as our providers’ standard contractual clauses and equivalent protections. Where the PDPO designates categories of restricted personal data that must be stored within Bangladesh, we will maintain compliance with those residency requirements as they take effect.

12. Children

Our services are directed to businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to This Policy

We may update this policy to reflect changes in our practices or the law. We will post updates on this page and revise the “Last updated” date; for material changes we will provide additional notice (e.g., email or site banner).

14. Contact & Complaints

Nexsus Growth — Bangladesh
Email: jobeyarrj@nexsusgrowth.com
Website: https://nexsusgrowth.com

If you are in Bangladesh, you may lodge a complaint with the data protection authority designated under the PDPO. If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority.