Privacy notice.

Last updated 25 October 2026

1Who we are.

1.1 Nexodyne Limited, a company registered in England and Wales (company number 16539459), whose registered office is at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom (“Nexodyne”, “we”, “us”), runs nexodyne.org and its client portal. We are the controller of your personal data: we decide how and why it is used, and we are responsible for it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for people in the European Union, the EU GDPR.

1.2 For anything about your data, email info@nexodyne.org.

1.3 Our ventures (such as RaiseSteady, Nexodyne Studio and Nexodyne Proof) have their own websites and their own privacy notices. This notice covers nexodyne.org only. The forms on those websites send what you type to an address on nexodyne.org; that data is covered by the notice of the site you used, not by this one.

2What we collect, why, and our lawful basis.

What	Details	Why we use it	Lawful basis
Careers application (the form on /careers/)	Your name, email address, discipline, years of experience, a link to your portfolio or profile and an optional second link, your rate if you give it, hours per week, time zone or city, languages, and a short note.	To consider you as a Vetted Pro: we look at your work, and we may invite you to a short call. Applying creates no contract and no promise of work.	Steps you ask us to take before a contract; our legitimate interest in keeping a group of Vetted Pros to match to projects.
Project enquiry (the form on /start/)	Your name, email address, your company or website if you give it, what you need, your budget range, timing, and your description of the project.	To reply, to understand the project and to prepare a proposal.	Steps you ask us to take before a contract; our legitimate interest in answering enquiries.
Portal access request (the form on /portal/)	Your name, email address, company, and how you know us.	To decide whether to open a portal account for you, and to set it up if we do.	Steps you ask us to take before a contract; our legitimate interest in deciding who joins a members-only space.
Portal account and profile	Your name, email address, role (client, team or admin), the project rooms you belong to, and the profile you fill in: title, company, a short “about”, interests chosen from a fixed list, up to three links, and a colour monogram (no photos).	To give you access, to show you to other members in People, and to put you in the right rooms.	Contract (the portal terms) for clients; our legitimate interests for team members and Vetted Pros who use the portal as part of their work.
What you post in the portal	Your messages in rooms and project rooms, replies, edits, “Useful” reactions, and the time of each. Edited and deleted messages are kept as described in section 6.	To run the rooms and project rooms, to show your messages to their members, and to keep the house rules.	Contract (the portal terms); our legitimate interest in a safe, well-run space.
Project rooms	Milestones, links and messages about your project, posted by you and by your Nexodyne team.	To run your project with you. The project itself is governed by its written agreement.	Contract.
Sign-in codes, sessions and invites	A 6-digit code sent to your email (stored scrambled, valid 15 minutes); a session token (stored scrambled) in the cookie hq_session; invite links (stored scrambled, valid 7 days).	To sign you in without a password and keep you signed in for 30 days.	Contract; our legitimate interest in security.
The team inbox	Access requests, applications and enquiries, with their status (new, approved, declined, answered), and who on our team dealt with them.	To handle each request and keep a record of what we decided.	Our legitimate interests, as above.
Moderation and sign-in log	Who signed in and when; messages hidden by the team and why; accounts suspended or closed.	To keep the portal safe and to answer complaints.	Our legitimate interest in security and accountability.
Emails to us	What you send to info@nexodyne.org, and your contact details.	To reply and help you.	Our legitimate interests.
Technical data	Your IP address, scrambled with a secret salt before it is stored (we cannot turn it back into the address), your browser type, and the time of each request; short-lived counters that stop abuse (rate limits). Our web server’s access log keeps your IP address and browser for 14 days.	To keep the site secure and working, and to stop spam and attacks.	Our legitimate interests.

2.1 We only collect what we need. Every form field we store is listed above. A hidden field in each form, which people never see, catches spam robots; if it is filled, we store nothing.

2.2 Please do not put sensitive information in free text (the careers note, the project description, portal messages): for example, about your health, beliefs, politics or private life. If you do, we keep it only as part of that record and delete it on the same schedule.

2.3 Do not post other people’s personal details in the portal unless you have the right to. If another member posts yours and you want them removed, email us.

2.4 People read every application, enquiry and access request and make every decision about them. Software, including the AI tools in clause 4.4, may help us sort and draft, but we make no decisions about you with legal or similarly significant effects by automated means. Rate limits and the spam field are anti-abuse measures, not decisions about you.

2.5 We send no marketing emails. The only emails from the site are the ones you ask for: confirmations, sign-in codes, invites and answers.

2.6 The three forms and the portal open only when we switch them on. While a form or the portal is closed, nothing you type in it is sent to us or stored, and the page tells you so.

3Who sees what inside the portal.

3.1 The portal is for our clients, our team and our Vetted Pros. It is invite-only and never indexed by search engines.

3.2 Your profile in People is visible to every member, including other clients. Choose what you put in it.

3.3 Messages in a room are visible to every member of that room. The open rooms (such as General or Introductions) are open to all members. A project room is private to the client members and the Nexodyne team on that project (and the service providers in section 4, including providers of AI models).

3.4 Our team and admins can see every room, hide messages that break the house rules, and see the team inbox. They are bound by the same confidentiality rules as every member (see the terms).

4Who handles your data.

4.1 We use a small number of service providers. All but the providers of AI models (clause 4.4) act only on our instructions and must keep your data secure.

Provider	What for	Where
Contabo	The server that runs the site and the portal, and stores our database	Germany (European Union)
Cloudflare	Delivers our pages and protects the site from attacks. It sees your IP address while the page is delivered.	Worldwide, including the United States
Purelymail	Our email provider: sends the emails the site sends (confirmations, codes, invites) and receives yours	The United States
GitHub (Microsoft)	Stores encrypted copies of our database backups; only we hold the key	The United States
Providers of AI models (such as Anthropic)	Help us draft, build, test and organize our work, so they may process what you send us (clause 4.4)	Several countries, including the United States

4.2 We may also share data if the law requires it, to protect the rights or safety of our members or us, with our professional advisers, or with a buyer if our business is sold, who must then protect it as this notice says.

4.3 We never sell your personal data. We share nothing with advertisers, and we run no advertising or analytics scripts.

4.4 We work with advanced artificial intelligence: leading AI models, set up with our own instructions and tools for our tasks. We use them throughout our work, for example to draft, build, test and organize. So information you send us (such as your messages, answers, project details and files) may be processed by AI models from more than one provider, such as Anthropic. We share only what a task needs. The providers handle it under their own terms and privacy policies, and some of them process data in the United States (clause 5.3). Please do not send us sensitive information we have not asked for (clause 2.2). No AI system makes decisions about you with legal or similarly significant effects (clause 2.4).

5International transfers.

5.1 Our server is in the European Union and our company is in the United Kingdom. Data moves between the two under the UK’s adequacy regulations for the European Economic Area, and under the European Commission’s adequacy decision for the United Kingdom.

5.2 Cloudflare, Purelymail (our email provider) and GitHub (our encrypted backups) may access data from the United States or other countries. For those transfers we rely on the UK–US data bridge or the EU–US Data Privacy Framework where the provider is certified, and otherwise on the UK’s International Data Transfer Agreement or Addendum, or the EU standard contractual clauses. Email us for details.

5.3 Providers of AI models may process what we share with them in the United States or other countries, under their own terms and privacy policies (clause 4.4). Email us to ask which providers we use.

6How long we keep data.

Data	How long
Careers applications	12 months after you apply, deleted automatically; sooner if you ask. If you become a Vetted Pro, your record continues under your engagement with us.
Project enquiries	12 months after you send it if no project follows; sooner if you ask. If a project follows, the enquiry joins the project file under the project agreement.
Portal access requests	Approved: becomes your account record. Declined: deleted 6 months after the decision. Unanswered: deleted 6 months after you sent it.
Portal accounts and profiles	While your account is open and 12 months after it is closed, then deleted. Your name on messages you leave behind becomes “Former member”.
Messages in open rooms	For the life of the room. A message you delete is hidden at once and removed from our database 30 days later.
Project rooms (messages, milestones, links)	We review each project room 24 months after the project closes and delete it or move it into the project file.
Sign-in codes	Expire after 15 minutes; deleted within a day.
Sessions	30 days after you last used the portal, or until you sign out.
Invite links	Expire after 7 days; deleted 30 days after that.
Moderation and sign-in log	12 months.
Rate-limit counters	In memory only; at most a day.
Team mailbox copies of form submissions	Deleted on the same schedule as the record they belong to.
Server logs	14 days.
Backups	Our database backups are kept on our server for 14 days, on a company computer for 30 days, and in encrypted form with GitHub. A deleted record can stay in them until the backups themselves are deleted. We use them only to recover from a failure, never to bring deleted data back into use.
Emails to info@nexodyne.org	As long as needed to answer and to keep a record of what was agreed, then deleted or archived.

6.1 When we no longer need data, we delete it or make it anonymous.

7Your rights and how to use them.

7.1 You have the right to:

• ask for a copy of your data;
• ask us to correct data that is wrong (in the portal you can edit your own profile and messages yourself);
• ask us to delete your data;
• ask us to limit how we use your data;
• object to our use of your data where we rely on legitimate interests;
• receive the data you gave us in a common format, or ask us to send it to someone else;
• withdraw consent at any time, where we rely on consent (we do not rely on it for anything on this site today).

7.2 To use any of these rights, email info@nexodyne.org. We reply within one month. It is free. We may ask you to confirm your identity first, usually by writing from the email address we hold for you.

7.3 If you ask us to delete your portal account, we delete your profile and your account record. Messages you posted stay in their rooms under “Former member”, unless you ask us to delete those too. Then we delete them, and any quotes of them in replies.

7.4 If you are unhappy with how we handle your data, please tell us first: we confirm we have your complaint within 30 days and look into it without delay. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113. If you live in the European Union, you can complain to your local data protection authority.

8Cookies and browser storage.

8.1 nexodyne.org sets no cookies for visitors. There is no analytics cookie, no advertising cookie, and so no cookie banner.

8.2 The client portal sets one cookie, hq_session, when you sign in. It is strictly necessary: without it the portal cannot know you are signed in. It is HttpOnly and sent only over HTTPS, and it lasts 30 days from your last visit, or until you sign out.

8.3 Cloudflare, which sits in front of our site, sets no cookie on it today. If its security features ever need one (such as __cf_bm, which tells people from bots), it is strictly necessary, and we list it here.

8.4 The portal keeps three small settings in your browser, and never a message or a personal detail: whether the details panel is open (kept on your device until you clear it), and, for the open tab only, the screen to return to after you sign in and a one-time note to open a form. You can clear them in your browser settings.

9Children.

9.1 nexodyne.org is for adults. You must be 18 or over to apply to become a Vetted Pro, send an enquiry or request portal access. The portal is for business clients and the people who work with them.

9.2 We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal information, email us and we will delete it.

10Security.

10.1 We protect your data with encrypted connections (HTTPS), security headers, limited access, scrambled sign-in codes and session tokens, and IP addresses stored only in scrambled form.

10.2 Sign-in needs a code sent to your email address, so keep that mailbox secure. If you think someone else has used your account, email us at once.

10.3 No system is perfectly secure. If a breach puts your data at risk, we will tell you and, where the law requires it, the ICO.

11Changes to this notice.

11.1 We may update this notice. The date at the top shows when it last changed. If we make a significant change, we will tell portal members by email, and everyone else on this page, before it applies.

12Contact.

Nexodyne Limited
71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Company number 16539459
Email: info@nexodyne.org