Privacy Policy

This Privacy Policy explains how Blyxxa LLC ("Company", "we", "us", or "our") collects, uses, protects, and discloses your personal information when you visit or use the NexusPages platform (https://nexuspages.com), our global business directory, merchant showcase storefronts, turnkey rental websites, and related software applications. Our objective is to provide absolute transparency regarding our data management practices.

1. Information We Collect

When you browse, register, create a merchant listing, or interact on our Platform, we may collect the following categories of information:

• Account & Profile Information: Full name, email address, telephone number, business profile details, store description, categories, and physical commercial addresses provided voluntarily during registration or profile setup.
• Google User Data (OAuth 2.0): When you authenticate using Google Sign-In, we only request access to your basic public identity profile (name, verified email address, and profile photo) strictly to verify your identity and generate your member profile. We never access your contacts, Google Drive files, or calendar, and we never share, license, or sell Google user data to third parties.
• Corporate Business Verification Credentials: Merchants seeking the "🪪 Document Verified Business" badge may provide commercial registration documents, corporate tax filings, trade licenses, and authorized signatory credentials. These files are reviewed solely by authorized compliance officers to verify legal existence; they are never published on public profile pages or disclosed to third parties.
• Individual Seller Identity & Address Verification: Individual merchants seeking the "🛡️ ID Verified Seller" trust badge may provide government-issued photo identification (Passport, National ID, or Driver's License) and proof of address. These credentials are collected to ensure trust, verify legal age, and prevent fraud in accordance with commercial standards. They are stored in isolated, non-public directories and are never indexed or made visible to search engines or other users.
• Automatically Collected Telemetry: IP address, device hardware models, operating system, browser type, referral URLs, language preferences, and page interaction timestamps recorded via server logs and essential cookies.
• Affiliate Partner Tracking Cookies: If you access our platform via an approved partner's referral link, a secure 30-day tracking cookie is stored on your device solely to attribute potential Pro subscription purchases to the referring affiliate.
• Publicly Sourced Directory Information: Certain business profiles in our directory are compiled from publicly accessible commercial records, public websites, and open trade directories to assist local consumers in discovering local merchants.

2. How We Use Your Information

We process your personal information strictly for legitimate business, commercial, and operational purposes:

• To publish, host, and index your business listings, digital storefronts, and product showcases.
• To verify merchant identities, evaluate documentation, combat fraudulent registrations, and issue verified trust badges.
• To process membership upgrades, featured listing spots, and subscription payments via our merchant payment gateway partner, Stripe under Blyxxa LLC.
• Automated Media Safety & Content Inspection: Uploaded images and media undergo closed-circuit algorithmic screening (perceptual hashing/pHash, dHash, and mathematical color-space inspections) to detect and eradicate Child Sexual Abuse Material (CSAM) and prohibited adult content. These checks execute entirely on our private secure servers without transmitting your files to external artificial intelligence providers.
• To deliver automated transactional notifications, customer inquiries, appointment confirmations, and vital security alerts.
• To optimize website performance, improve user experience, and uphold regulatory compliance.

3. Cryptographic Data Protection & Security Vault (AES-256-GCM)

We enforce rigorous military-grade technological and physical security measures to protect your sensitive personal records and verification documents:

• Encrypted Document Vault (AES-256-GCM): Verification files (passports, driver's licenses, tax certificates) are immediately encrypted upon upload using authenticated AES-256-GCM encryption and assigned encrypted .enc extensions. Original unencrypted files are immediately shredded and purged from disk storage.
• Direct Web Access Prohibition: The storage directories containing verification archives are completely blocked from web access (HTTP/HTTPS). Files can never be browsed directly and are decrypted dynamically into volatile server RAM only when an authorized administrator reviews an active verification ticket.
• Sensitive Field Encryption: Tax identification numbers and personal ID numbers are encrypted at rest at the database layer with dedicated cryptographic keys.
• In-Transit Security & Credential Hashing: Passwords are protected using robust one-way cryptographic hashing algorithms (Argon2id/Bcrypt). All network data transmitted between client browsers and our platform is encrypted via 256-bit TLS/SSL certificates.

4. Third-Party Disclosures & Service Partners

We do not sell, rent, or monetize your personal information to third-party data brokers. Information is shared only with:

• Essential Service Infrastructure: Trusted partners necessary to execute our services, including Stripe Inc. (for PCI-DSS compliant credit card transactions and billing) and certified transactional email infrastructure.
• Legal & Regulatory Compliance: Law enforcement or judicial authorities if required by a valid subpoena, court order, or binding statutory obligation.

5. Data Retention & Permanent Account Deletion

Personal data is retained only for as long as your account remains open or as necessary to fulfill operational obligations. Except for minimum financial transaction records required by commercial tax laws, you hold complete autonomy over your data:

• Self-Service Dashboard Deletion: You can permanently delete your entire user account, business listings, and associated files at any time by navigating to Profile > Delete Account in your account console.
• Automated Web Deletion Portal: In accordance with Google Play and international data protection standards, you can submit an instant deletion request without logging in by visiting our Account & Data Deletion Portal.

6. Global Privacy Rights & Multi-Jurisdictional Compliance

Depending on your geographic location and citizenship, you are entitled to exercise statutory privacy protections under applicable laws:

• United States & California (CCPA / CPRA & State Laws): You have the right to request disclosure of personal information collected, request deletion, and opt out of data sales. We do not sell or share personal data for monetary or other valuable consideration.
• United Kingdom (UK GDPR & Data Protection Act 2018): UK residents have the right to submit a Subject Access Request (SAR), rectify inaccurate data, request erasure, and restrict processing. The supervisory authority is the Information Commissioner's Office (ICO).
• Canada (PIPEDA): Canadian residents have the right to access personal data, verify accuracy, and withdraw consent for data processing at any time.
• Australia & New Zealand (Privacy Acts): We comply with the Australian Privacy Principles (APPs) and New Zealand Privacy Act 2020 governing cross-border transfers and data integrity.
• Singapore (PDPA), India (DPDP Act 2023), UAE & South Africa (POPIA): Residents in these jurisdictions may request access to, correction of, or cessation of unauthorized processing of their personal information.
• International Commercial Scope: NexusPages is operated by Blyxxa LLC from the United States and is tailored for global non-EU markets; it is not directed toward nor solicits business from within the European Union.