This Privacy Policy explains how NexaSift collects, uses, shares and protects your personal data when you use our Service.
NexaSift is a service offered under the NexaDev brand and operated by [OPERATOR NAME], an individual based in Brazil, who is the data controller responsible for the processing described in this Policy.
We process personal data in accordance with applicable data protection laws, including the LGPD (Brazil), the GDPR (EU/EEA) and other applicable transparency and privacy requirements.
We do not claim certifications or formal compliance statuses that have not been independently audited.
We collect only the data necessary to provide and operate the Service:
• Account data: name, email, authentication data and language preference.
• Subscription data: plan, billing interval, Stripe customer ID, Stripe subscription ID, billing status and billing metadata.
• File data: JSON files you upload or paste, their metadata (name, size, hash) and derived reports and comparisons.
• Technical data: we may collect limited technical logs for security and operational purposes.
• Analytics: aggregated, pseudonymized usage events (see Section 22).
We do not collect data we do not need. We do not assert collection of data categories that our system does not actually process.
Payment processing is handled by Stripe. NexaSift does not store your full card number or CVV.
From Stripe, we receive only: the Stripe customer identifier, subscription identifier, subscription status, price/billing metadata and billing period information necessary to manage your plan.
Stripe's privacy policy applies to the payment data it processes. We recommend reviewing Stripe's privacy practices at stripe.com/privacy.
Some viewer operations can be processed locally in your browser. Features that require storage, reports, account history or server-side processing may transmit data to our infrastructure.
We do not state that files never leave your device, because certain features — such as saving files, generating PDF reports and comparing stored files — require server-side processing.
When you use the public viewer without an account, files are processed in your browser whenever possible and are not stored unless you create an account and save them.
When you create an account and save files, those files are stored in your account and associated with your user identifier.
Files are stored to enable the features you request: library, folders, report generation and file history.
You can delete your files at any time from My Files. Deleted files are moved to trash and permanently removed after the retention period configured in your account settings.
Reports derived from your files are stored separately and can also be deleted from the Reports page.
Your JSON files may contain personal data of third parties. NexaSift processes this data solely to provide the features you request (viewing, analysis, reports, comparison).
You are responsible for having an adequate legal basis or authorization to process any personal data contained in the files you submit.
We do not use the content of your files for purposes other than providing the features you request.
We do not use your files or personal data to train artificial intelligence models.
If this changes in the future, we will update this Policy and provide appropriate notice before doing so.
We process your data for the following purposes: creating and authenticating your account; providing the Service; storing files; generating reports; performing comparisons; billing subscriptions; preventing fraud; ensuring security; providing support; producing analytics; and complying with legal obligations.
Depending on your jurisdiction and the purpose, we rely on the following legal bases:
• Execution of a contract: providing the Service you requested, including file storage and report generation.
• Consent: where required for specific processing, such as non-essential analytics.
• Legitimate interests: security, fraud prevention and service improvement.
• Legal obligation: complying with applicable laws and regulatory requirements.
The specific basis corresponds to each processing purpose. We do not apply a single basis to all processing.
Depending on your location and applicable law, you may have the right to: access your data; correct inaccurate data; delete your data; confirm whether we process your data; portability of your data where applicable; object to processing; restrict processing; withdraw consent; and receive information about sharing.
To exercise any of these rights, please submit a privacy request using the contact information in Section 23.
We do not promise rights that do not exist under the law applicable to your jurisdiction.
You can submit privacy requests through the contact channel configured for the Service.
We will process your request in accordance with applicable law. You may be asked to verify your identity before we act on your request.
You can request deletion of your account and associated data by contacting us.
If a self-service deletion feature is available, it will be accessible from the Account page. If not, our team will process your request upon contact.
We retain your data for as long as your account is active and as necessary to provide the Service.
Files and reports you delete are moved to trash and permanently removed after the configured retention period.
Billing data is retained for as long as necessary to comply with legal, tax and accounting obligations.
Technical logs are retained for a limited period necessary for security and operational purposes.
If backups of the database exist, deleted data may remain in backup copies until the backup expires according to our technical retention schedule.
We do not keep deleted data in backups longer than technically necessary.
We use the following subprocessors to provide the Service:
• Base44 — platform infrastructure, database, authentication and hosting.
• Stripe — payment processing and billing.
• Google — authentication via Google Sign-In (when you choose this option).
We do not list any company as a subprocessor unless it actually processes user data in connection with the Service.
Stripe processes your payment information as our payment service provider. Stripe may process billing data according to its own policies.
Stripe's privacy policy is available at stripe.com/privacy. We do not copy or reproduce Stripe's policy here.
Because NexaSift serves users globally and may use infrastructure located outside your country, your data may be processed in countries other than your own.
We do not assert a specific legal transfer mechanism unless it has been formally confirmed. We rely on applicable transfer safeguards as required by law.
We implement reasonable security measures, including access controls, authentication, data segregation via row-level security, HTTPS encryption, server-side secrets and backend validation.
We do not detail security configurations to the point of creating operational risk, and we do not promise absolute security.
If a personal data breach occurs, we will handle it in accordance with applicable legal requirements, including notifying the relevant authorities and affected individuals when required.
We do not commit to a specific legal response time that has not been formally defined.
NexaSift is not directed to children. The Service is intended for users who have the legal capacity to contract.
We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will take appropriate steps.
We use a privacy-conscious analytics approach: we track pseudonymized, aggregated usage events (such as "viewer opened" or "report generated") to understand how the Service is used and to improve it.
We do not send full file contents, personal data from your files or your IP address to analytics providers.
Analytics events are processed through the Base44 platform infrastructure.
For privacy questions or to submit a privacy request, please contact us at nexadevempresa@gmail.com.