Privacy Policy

1. Data Controller Identity & Governance

This Privacy Policy applies to personal data processed by Nexuuscore Ltd ("Nexuuscore", "we", "us", "our"), a company incorporated in England and Wales under Company Registration Number 17366355, with registered offices at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Nexuuscore Ltd is registered with the UK Information Commissioner's Office (ICO) under Data Protection Registration Number ZC208682. For any inquiries regarding our data protection policies, please contact our Data Governance team at [email protected] or via our universal catch-all inbox at [email protected].

2. Information We Collect & Categories of Processing

We collect and process personal data strictly necessary to provide and secure our enterprise SaaS platform and digital workforce modules:

2.1 Client Account & Workspace Administration Data

When you register an account, configure a workspace, or invite team members via the Team Management dashboard, we collect:

• Account Identifiers: Full name, corporate email address, encrypted password hash, and assigned Role-Based Access Control (RBAC) permissions.
• Security & MFA Credentials: Hardware-backed Time-Based One-Time Password (TOTP) seed secrets and security audit timestamps (Security Settings).
• Workspace Preferences: Company legal entity name, time zone, reporting currency (GBP, USD, EUR), and notification webhook URLs.

2.2 Billing & Transactional Records

When you subscribe to a platform tier or purchase compute credits (Billing, Credits & Top-Up), our payment processor (Stripe) collects payment details. Nexuuscore retains only:

• Masked payment card references (e.g. card brand, expiration month/year, and last 4 digits).
• Stripe Customer IDs and subscription status identifiers.
• Statutory UK VAT invoicing records, tax receipts, and immutable credit ledger balance mutations.

2.3 B2B Prospecting & Intelligence Data (Direct Client Submissions)

When operating the Lead Scout and Campaign Outreach engines (Discovered Leads, Outreach Sequences), our autonomous agents process business information submitted directly by Clients or configured in targeting criteria.

2.4 Technical Telemetry & Cookie-Less Analytics

To monitor system integrity and provide tamper-proof governance, we collect:

• Self-Hosted Umami Analytics: 100% cookie-less traffic analytics hosted in our London infrastructure. We do not use third-party tracking cookies, do not collect personal identifiers across external sites, and anonymize IP addresses.
• Cryptographic Activity Logs: SHA-256 chained transaction logs recording agent actions, Human-in-the-Loop approvals (Action Approvals), and API token dispatches (Developer API Keys).

2.5 Information Notice for Indirectly Collected B2B Business Contacts (UK GDPR Article 14)

In operating our autonomous B2B Lead Scout capability, Nexuuscore processes corporate business contact data that has not been obtained directly from the data subject. In compliance with UK GDPR Article 14, we provide the following statutory notice:

• Source of Data: Publicly available business records, including Companies House corporate filings, company registry databases, corporate websites, official press releases, and public professional business profiles.
• Categories of Data Collected: Business name, corporate role/job title, business corporate email address, company registration number, and industry classification (SIC code). We do not collect personal consumer emails, residential addresses, or special category data.
• 3-Tier Private UK Graph Separation: To guarantee absolute data minimisation and prevent cross-tenant personal data pooling:
  • Tier 1 (Canonical Corporate Graph): Public company profiles, Companies House numbers, and corporate domain mappings containing zero personal data.
  • Tier 2 (Global Governance Plane): Irreversible cryptographic blind indexes (one-way SHA-256 hashes of business contact identifiers) used strictly under Legitimate Interests (Art. 6(1)(f)) to evaluate multi-tenant exclusivity mutexes and universal suppression without pooling readable personal identities across workspaces.
  • Tier 3 (Tenant-Isolated Projections): Named-person prospect profiles exist exclusively inside the client's private workspace, strictly isolated by PostgreSQL Row-Level Security (RLS).
• Purposes & Lawful Basis of Processing: Data is processed under the lawful basis of Legitimate Interests (UK GDPR Article 6(1)(f)) and in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) corporate subscriber rules, to enable commercial B2B market discovery and professional outreach. We have conducted a Legitimate Interests Assessment (LIA) balancing our commercial objectives against individual privacy expectations in a professional B2B context.
• Multi-Identifier Right to Object & Instant Universal Opt-Out: Any business contact identified via our Lead Scout engine has an absolute, unconditional right to object to the processing of their data. You may request immediate removal and blacklisting from all future lead scouting by emailing [email protected] with the subject line "B2B Contact Opt-Out", or by clicking the one-click unsubscribe/opt-out link included in any automated B2B outreach message. Upon receipt, your contact identifiers (email, phone, person name, corporate domain) are permanently recorded in our universal suppression registry, automatically demoting active claims across all client campaigns and permanently blocking future outreach.
• Data Retention for Scraped B2B Prospects: Uncontacted prospect records that are not engaged within ninety (90) days are automatically purged from our lead discovery cache.

3. Lawful Bases for Processing (UK GDPR Article 6)

4. Zero Third-Party AI Model Training Guarantee

5. Field-Level Encryption & UK Data Residency

All primary databases, file storage clusters, and GPU inference engines execute within London, United Kingdom data centres. In accordance with UK GDPR Article 32:

• Field-Level Encryption (FLE): Sensitive PII fields (such as prospect contact identifiers and recipient phone numbers) are cryptographically neutralized with AES-256 before disk persistence.
• Cryptographic Blind Indexing & Zero-Knowledge Collision Mutexes: Global lead exclusivity reservations and multi-tenant collision prevention operate exclusively on salted, one-way SHA-256 blind indexes. Personal contact data is never exposed across tenant boundaries; the platform validates whether an identity is already claimed or suppressed without revealing the identity, target contact, or campaign of competing clients.
• At-Rest and In-Transit Encryption: All database storage volumes utilize AES-256 block encryption. All HTTP communications enforce strict TLS 1.3 encryption.
• API Key Security: Programmatic developer API tokens (`sk-nexuus-live-`) are hashed prior to database anchoring. Raw secret keys are displayed only once upon generation (Developer API Keys).

6. Authorized Sub-Processors

Nexuuscore engages a minimal, strictly vetted roster of sub-processors operating under written Data Processing Agreements (DPAs) compliant with UK GDPR Article 28:

7. Retention, De-Provisioning & "Year Zero" Deletion

Nexuuscore maintains a strict data lifecycle policy:

• Active Subscriptions: Client operational data, campaign histories, and market reports are retained for the duration of your active subscription.
• 30-Day Post-Termination Export Window: Following subscription cancellation, your workspace enters a suspended state for thirty (30) calendar days, during which you may request a full machine-readable JSON/CSV export of your data by emailing [email protected].
• Permanent Cryptographic Purge: Upon expiration of the 30-day window, all client-specific database records, vectors, and instance artifacts are permanently and irreversibly purged from our active storage infrastructure.

8. Your Statutory Rights Under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you possess the following enforceable rights:

• Right of Access (Subject Access Request / SAR): You may request a complete copy of all personal data held about you. We will furnish this record within thirty (30) calendar days free of charge.
• Right to Rectification: You may update or correct inaccurate personal details directly within your Settings dashboard or by contacting our support team.
• Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your personal data where retention is no longer legally justified.
• Right to Restrict Processing: You may request that we suspend active processing of your data during dispute resolution.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object at any time to the processing of your data for direct B2B marketing or prospect discovery.

To exercise any of these rights, please email our dedicated Data Governance team at [email protected] with the subject line "UK GDPR Data Subject Request".

9. Supervisory Authority & Complaints

If you believe that Nexuuscore Ltd has not processed your personal data in accordance with applicable UK data protection law, you have the right to lodge a formal complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk

10. Contact & Communication Routing

To ensure prompt handling of all inquiries, incoming messages are routed as follows:

• Data Protection & GDPR SARs: [email protected]
• Invoicing, Billing & Refunds: [email protected]
• Technical Support & SLA: [email protected]
• Legal Notices: [email protected]
• Universal Catch-All: [email protected] (If you are unsure which inbox to use, contact@ will automatically route your request to the appropriate department).

Nexuuscore Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company No. 17366355 · ICO Registration No. ZC208682
Web: nexuuscore.io