Privacy Policy

This Privacy Policy explains how Nexera FZ-LLE (“Nexera”, “we”, “us” or “our”) collects, uses, shares and protects personal information in connection with the Nexera Audio Integration and Modeling Suite, including our websites, applications, APIs and related services (collectively, the “Service”). It applies whenever you create an account, use the Service, or otherwise interact with us.

By using the Service you acknowledge this Privacy Policy. If you use the Service through an organization workspace, your organization may also have its own policies governing your use; this Policy describes our practices, not theirs.

Account and profile information. When you sign up we collect your name, email address and authentication credentials through our identity provider (Clerk). If you sign in with a third-party identity provider (e.g. Google), we receive the profile information you authorize that provider to share, such as your name, email address and profile picture. During onboarding you may also provide optional profile details such as a phone number, company name, role and country. Phone numbers are stored as provided and are not verified.

Billing information. If you purchase a subscription or add-on, payments are processed by Stripe. We receive and store subscription status, plan details, billing history and limited payment metadata (such as card brand and last four digits). We do not store full payment card numbers.

Customer Content. We store the content you create or upload in the Service, including projects, designs, floor plans, venue drawings, documents, product catalogue contributions and related files. Customer Content may incidentally contain personal information that you choose to include; you control that content.

Usage and device information. We automatically collect technical information when you use the Service, such as IP address, browser type, device and operating system information, pages viewed, features used, performance metrics and timestamps. This includes aggregated, privacy-respecting analytics collected through Vercel Analytics and Speed Insights.

Communications. If you contact us (for example by email), we keep a record of the correspondence and any information you provide in it.

We use the information we collect to:

• provide, operate and maintain the Service, including storing and syncing your projects;
• create and manage your account, authenticate you and secure the Service;
• process subscriptions, payments and billing, and prevent fraud;
• enable collaboration features, including organization workspaces and shared projects;
• send transactional communications such as account verification, billing, security and service notices;
• send marketing communications where you have consented (you can opt out at any time);
• understand how the Service is used so we can improve features, performance and reliability;
• provide customer support and respond to your requests;
• comply with legal obligations and enforce our Terms of Service.

Where data protection law (such as the GDPR) applies, we process personal information on the following legal bases: performance of our contract with you (providing the Service you signed up for); legitimate interests (securing and improving the Service, preventing abuse, limited analytics); consent (optional profile fields and marketing communications, which you may withdraw at any time); and compliance with legal obligations (tax, accounting and lawful requests).

We do not sell personal information. We share it only in the following circumstances:

Service providers (subprocessors). We use trusted third-party providers to operate the Service, each of which processes data only as needed to provide their service to us:

• Clerk — identity and authentication (account credentials, sessions, sign-in metadata);
• Stripe — payment processing and billing;
• Supabase — cloud database and file storage for the Service, including Customer Content;
• Vercel — application hosting, content delivery, analytics and performance monitoring;
• Sentry — error monitoring, performance measurement and session replay. Error reports contain the error, the page or endpoint involved and technical diagnostics; we do not send IP addresses, cookies or request headers. Reports from our servers may include the values of variables in use at the moment a failure occurred, which can incidentally include Customer Content. We also record a small sample of sessions, and sessions in which an error occurs, as a replay of on-screen activity — text and form inputs are masked and images and media are excluded within your browser, before any recording is sent;
• email delivery providers — transactional and (where consented) marketing email.

Organization workspaces. If you join an organization, certain information is visible to other members and administrators of that organization as described in Section 6.

Legal and safety. We may disclose information if required by law, legal process or governmental request, or where reasonably necessary to protect the rights, property or safety of Nexera, our users or the public.

Business transfers. If we are involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction; we will notify you of any change in ownership or use of your personal information.

The Service allows projects and folders to be shared with an organization workspace. If you are a member of an organization, your name, email address and role within the organization are visible to other members and administrators of that organization. Content you share with an organization is accessible to its members according to the organization's access levels and settings.

Administrative and membership actions within an organization (such as invitations, role changes and content sharing) may be recorded in an audit log visible to organization administrators. As described in our Terms of Service, content you have shared with an organization is treated as a business record of that organization and may remain with it — including any personal information it contains — after you leave or are removed.

If you contribute product specifications or other data to the community product catalogue, the contributed data becomes part of the shared catalogue available to other users of the Service. Contributions may be associated with your account internally for moderation and quality purposes. Do not include personal information in catalogue contributions.

We use cookies and similar technologies that are necessary to operate the Service — for example, to keep you signed in, remember preferences such as your theme, and protect against fraud and abuse. Our analytics (Vercel Analytics) is designed to be privacy-friendly and does not use third-party advertising cookies or track you across other websites. Essential cookies cannot be disabled without affecting the operation of the Service; you can control cookies through your browser settings.

We retain personal information for as long as your account is active and as needed to provide the Service. After account termination, we may delete Customer Content associated with the account after a reasonable retention period, except content that has been shared with an organization (which remains with the organization) and information we are required to retain for legal, tax or accounting purposes. Backup copies may persist for a limited period after deletion as part of our routine backup cycle.

We use commercially reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls and reliance on established infrastructure providers. No method of transmission or storage is completely secure; you are responsible for safeguarding your account credentials, and we encourage you to use a strong, unique password and to notify us promptly of any suspected unauthorized access.

Our service providers may store and process information in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards for international transfers, such as standard contractual clauses entered into by our providers, to protect personal information transferred across borders.

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete or export it, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. You can update most profile information directly in the Service, and you can delete your account at any time.

To exercise any of these rights, contact us at the address in Section 15. We will respond within the timeframes required by applicable law. If you are in the EEA, UK or a similar jurisdiction, you also have the right to lodge a complaint with your local supervisory authority.

The Service is intended for professional use and is not directed at children. You must be at least 18 years old to use the Service, and we do not knowingly collect personal information from anyone under that age. If you believe a child has provided us with personal information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example by email or an in-app notice) before the changes take effect. Your continued use of the Service after the effective date of an updated Policy constitutes acknowledgment of it. The “Effective date” above reflects the latest revision.

Questions about this Privacy Policy or our data practices: hello@nexerasuite.com