Privacy policy

This privacy policy describes how we collect, use, and protect your personal data when you interact with the nexovault.com website. In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Informatique et Libertés), we inform you clearly and transparently about our practices.

Data controller

The data controller is NEXVAULT (a SASU — French simplified joint-stock company — with share capital of 1 000 €, RCS Poitiers 104 281 944), whose registered office is located at MBE n°320, 52 route de Gencay, 86000 Poitiers.

Contact to exercise your rights: contact@nexovault.com

Data collected

We only collect the data strictly necessary for the purposes described below:

• Email address (via the waitlist form)
• Preferred safe model (NXV-V1, NXV-Vcode, NXV-Premium)
• Anonymised technical data (browser, operating system, device type) for statistical purposes only

Providing your email address is required to subscribe to the waitlist. Without it, we cannot keep you informed of the launch. Other data (preferred safe model, anonymised technical data) is optional.

Purposes of processing

Your data is used solely to:

• Inform you of the official launch of NEXOVAULT products
• Keep you informed of major project developments (launch, opening of pre-orders)
• Improve the site's user experience (anonymised statistics)

We undertake to never use your data for third-party marketing, and not to share, sell, or rent it to unauthorised third parties.

Legal basis

The legal basis for processing your data is your freely given, specific, informed, and unambiguous consent, explicitly collected when you sign up to the waitlist (GDPR checkbox).

Data retention period

Your data is retained for a maximum period of 3 years (1,095 days) from your last interaction with our services, or until you request its deletion. This limit is applied automatically by our system: once this period has elapsed, your data is deleted through an automated process, with no human intervention required.

You may request early deletion of your data at any time by contacting us at contact@nexovault.com.

Your rights

In accordance with the GDPR, you have the following rights regarding your data:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): request deletion of your data
• Right to restriction of processing
• Right to data portability: receive your data in a structured format
• Right to object to processing
• Right to withdraw consent at any time

To exercise these rights, send an email to contact@nexovault.com specifying your request. We undertake to respond within a maximum of 30 days, extendable by two months for complex requests (Article 12(3) GDPR).

Data processors

We use the following data processors, all committed to complying with the GDPR:

• Brevo (formerly Sendinblue) — email and waitlist management. French company, data processed within the European Economic Area (EEA).
• Vercel (Vercel Inc., a US company based in California) — site hosting and serverless functions. Vercel acts as a data processor under a Data Processing Agreement (DPA) incorporating the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR) to govern data transfers to the United States.
• Anthropic (Anthropic PBC, a US company based in California) — provider of the Claude artificial-intelligence model used by our assistance chatbot. Conversations are not retained by NEXVAULT beyond the session. They are processed by Anthropic in accordance with its API data retention policy (up to 30 days for trust and safety purposes, then automatic deletion). Anthropic acts as a data processor under an agreement incorporating the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR).

International data transfers

Some of our data processors (Vercel, Anthropic) are established outside the European Union, specifically in the United States. In accordance with Articles 44 to 50 GDPR, these transfers are governed by the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), ensuring a level of data protection equivalent to that applicable within the European Union.

You may obtain a copy of the Standard Contractual Clauses by contacting us at contact@nexovault.com.

Cookies

The nexovault.com website uses no advertising tracking cookies. Only technical cookies strictly necessary for the site to function may be stored (user preferences, 3D animation state). These cookies do not require prior consent under CNIL guidelines.

Security

In accordance with Article 32 GDPR, we implement appropriate technical and organisational measures to ensure the security of your data:

• Encryption of communications via HTTPS (TLS 1.3);
• Pseudonymisation of IP addresses through SHA-256 hashing (Article 4(5) GDPR);
• Authentication tokens (JWT) limited to 72 hours;
• Honeypot anti-spam protection on forms;
• Mandatory double opt-in to confirm any sign-up;
• Restricted data access through strong identity control;
• Robust passwords and secure management of administrator access.

We carry out regular reviews of our security measures to adapt them to evolving risks.

Complaints

If you believe that the processing of your data does not comply with the GDPR, you may lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, the French data protection authority), or with the supervisory authority of your member state of residence: www.cnil.fr.

Changes to this policy

This policy may be amended to reflect legal developments or our practices. Any significant change will be notified to you by email.

This English translation of our privacy policy is provided for information purposes only. The original French version is the only legally binding text. In case of any discrepancy or dispute, the French version prevails.