Nyxa Privacy Policy

Effective date: [Effective date]

1. Who we are

Nyxa is a software service operated by:

Nyxa OÜ
Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia
Estonian registry code: 17607491

In this policy, "Nyxa", "we" and "us" refer to that entity. "Nyxa" is also the product name.

For privacy questions, data-protection requests and legal notices, contact legal@nyxahq.com. For general enquiries, contact contact@nyxahq.com.

2. What this policy covers

This policy explains how we handle personal data when you:

• visit our website at nyxahq.com, including the early-access request form and any contact form;
• use the Nyxa application at app.nyxahq.com as a firm owner, consultant or client-portal user;
• use the demonstration environment at demo.nyxahq.com;
• email us, request support or send us feedback.

Nyxa is a business-to-business service. Our customers are consultancy firms ("customer firms"). Customer firms invite their own consultants and, optionally, their own clients into Nyxa. If you were invited by a customer firm, that firm has its own privacy practices, which this policy does not cover. Section 3 explains who is responsible for what.

3. Our role: controller or processor

How we are responsible for your data depends on how the data reached us.

Where Nyxa typically acts as a controller. We decide how and why the following data is processed, so we are typically the controller for it:

• website visitor and early-access request data;
• account and contact details of the people who sign in to Nyxa (name, email address, role, firm association);
• billing and subscription records;
• support, feedback and legal correspondence;
• security, access and usage records that we keep to operate and protect the service.

Where Nyxa typically acts as a processor. Customer firms use Nyxa to store and manage information about their own business, including their clients, consultants, engagements, projects, invoices, leads and reports ("customer content"). The customer firm decides what to enter and why. For customer content we typically act as a processor (or service provider) on the customer firm's instructions, and the customer firm is typically the controller. Our customer terms describe what we may do with customer content.

Customer firms are responsible for having a lawful basis to enter information about their clients, consultants and contacts into Nyxa, and for telling those people how their information is used. If you are a client or consultant of a customer firm and you have questions about information the firm holds about you in Nyxa, please contact that firm first. We will help the firm respond where we can.

4. The personal data we collect

4.1 Website and early-access data (nyxahq.com)

When you request early access or contact us through the website we collect what you enter, which may include your name, email address, firm name, role or title, and your message. Website submissions are stored in a database that is separate from the Nyxa application database. We use Resend to send an acknowledgement to your email address and to notify the Nyxa team of your request. The internal notification includes your name, firm and work email. Optional feedback is stored separately and is not included in these emails.

With your consent, we use PostHog to measure visits and early-access conversions on the website. We exclude personal form contents and do not use advertising pixels or session recordings. See section 12 for the data collected, storage periods and how to change your choice. This does not enable analytics in the application.

4.2 Account and user data (app.nyxahq.com)

When you are invited to Nyxa and create a login, we collect:

• your name and email address;
• your role in Nyxa (Owner, Consultant or Client) and the customer firm you belong to;
• authentication and session data needed to keep you signed in;
• invitation status, including the invitation link you used;
• a display-theme preference, stored in your own browser.

Signing in uses a password. We do not currently offer sign-in through third-party identity providers.

4.3 Customer content

Customer firms may enter the following into Nyxa. Some of it is personal data about the firm's staff, clients and contacts:

• client organisations and their contact people;
• consultants, including name, email address, role, specialisms, day rate, standard and flexible availability, time off and engagement history;
• engagements between consultants and clients;
• projects, milestones, progress updates and blockers;
• invoices submitted by consultants and the firm's reconciliation of them, including any attachment (PDF, JPEG or PNG);
• leads and pipeline records, including contact details, notes and follow-up dates;
• client onboarding checklist status;
• in-app notifications generated from the above;
• weekly client reports, where that feature is used (see 4.4).

Nyxa is designed for fraud and compliance consultancies. Customer content may therefore describe investigations, regulatory matters or financial-crime work. Section 11 sets out what should not be entered into Nyxa without prior agreement.

4.4 AI-assisted report data

Nyxa can draft a weekly client report for a customer firm on request. When a firm owner triggers a draft, Nyxa assembles relevant customer content for that client (for example project status, milestones and recent progress updates) and sends it to our AI provider, Anthropic, which returns a draft. The owner then edits, saves and decides whether to publish the report to the client portal.

What we store about each AI generation is metadata only: the provider, model, purpose, token counts, timing, cost and outcome. We do not store the text sent to or received from the AI provider in that log. The draft and the final report are stored as customer content, in the same way as anything else the firm saves in Nyxa.

Section 7 explains how our AI provider handles the data it receives.

4.5 Billing and payment data

Payments are handled by Stripe. During our early-access period, customers pay through Stripe payment links, and we set the firm's plan manually.

We hold plan and payment status, Stripe customer, subscription and payment references, invoices and receipts, and billing contact details. Card numbers and full payment details are entered directly with Stripe. Nyxa never stores card numbers.

4.6 Communications and feedback

We keep emails you send us for support, administration or legal matters, delivery metadata for transactional emails we send you (such as invitations and password resets), and feedback you submit through the in-app Feedback form. Feedback submissions are stored with your user account and firm so that we can follow up.

4.7 Demonstration environment (demo.nyxahq.com)

The demo environment contains fictional sample data and shared test logins. It runs on a separate database from the live application. Do not enter real personal data or real customer information into the demo. Anything entered there may be seen by other demo users and may be reset without notice.

5. Why we process personal data and on what basis

Where we rely on legitimate interests we have considered the effect on you and do not believe it overrides your rights. We rely on consent only where the law requires it, for example for optional marketing emails, and you can withdraw that consent at any time.

6. Who we share personal data with

We do not sell personal data. We share it only with the service providers below, with the customer firm you belong to, and where required by law.

6.1 Service providers (subprocessors)

We keep an internal record of each provider's data-processing terms. Supabase's data processing addendum is incorporated into its terms of service and applies to our account, and we subscribe to notifications of changes to Supabase's own subprocessor list.

We will publish an up-to-date subprocessor list at [URL of subprocessor page] and give customer firms notice before adding a provider that will process customer content.

6.2 Your customer firm

If you are a consultant or client-portal user, the customer firm that invited you can see the information you enter in Nyxa according to your role. Firm owners can see all of the firm's data. Consultants can see their own assignments and related projects. Client-portal users can see only what the firm has chosen to make visible to them.

6.3 Nyxa staff

The people operating Nyxa may access account data, customer content and feedback where necessary to run the service, provide support, investigate problems, or respond to legal requirements. Access is limited to what the task requires.

6.4 Legal and business reasons

We may disclose personal data where required by law, a court order or a regulator, to protect the rights, safety or property of Nyxa or its users, or in connection with a reorganisation, financing, merger or sale of the business, in which case we will require the recipient to honour this policy.

7. International transfers and data location

The live Nyxa application database, including customer content and uploaded files, is hosted by Supabase in London, United Kingdom (AWS region eu-west-2).

Some of our providers process data outside the UK and EEA. In particular:

• Anthropic processes AI report requests in the United States or in a global region; no UK or EU processing region is currently available for that service. Under Anthropic's commercial API terms, data sent through the API is not used to train Anthropic's models. Data sent for AI drafting is used to produce the draft and is retained by Anthropic only to the extent permitted by its terms.
• Other providers listed in section 6.1 may have support or infrastructure staff in other countries.

Where personal data leaves the UK or EEA we rely on the transfer safeguards available in the provider's terms, such as the EU standard contractual clauses and the UK addendum or international data transfer agreement, together with any adequacy decision that applies. Supabase's data processing addendum incorporates the standard contractual clauses.

8. How long we keep personal data

Deleted data may persist in provider backups for a limited period before it is overwritten.

9. Your rights

If you are in the UK or the EEA you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted in certain circumstances;
• restrict or object to certain processing;
• receive the data you gave us in a portable format;
• withdraw consent where we rely on consent;
• complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EEA you may complain to the authority in your country of residence or work.

To exercise these rights, email legal@nyxahq.com. We may need to verify your identity. We aim to respond within one month.

If your request concerns customer content held by a customer firm, that firm is normally the controller, and we may refer your request to the firm or help the firm respond, rather than acting on it ourselves.

If you are outside the UK and EEA you may have similar rights under local law. Contact us and we will help where we can.

10. How we protect personal data

We take reasonable technical and organisational measures to protect personal data. These currently include:

• separation of each customer firm's data at the database level, enforced with row-level security so that a user can reach only the data their firm and role allow;
• role-based access within each firm (Owner, Consultant, Client);
• private file storage with short-lived access links, scoped to the firm that uploaded the file;
• encryption of data in transit;
• encryption at rest and other infrastructure security provided by our hosting providers;
• a live application that is separate from the demonstration environment and its database;
• least-privilege access for the people who operate Nyxa;
• no storage of card numbers by Nyxa.

No system is completely secure. If we become aware of a personal-data breach affecting you or your firm we will notify the customer firm and, where required, the affected people and the relevant authority without undue delay.

We do not currently hold any security certification such as ISO 27001 or SOC 2 and do not claim one.

11. Children and sensitive data

Nyxa is for business use and is not intended for anyone under 18. We do not knowingly collect personal data from children.

Nyxa is not designed to store special-category data (such as health, biometric or genetic data, or data revealing racial or ethnic origin, political opinions, religious beliefs, sexual orientation or trade-union membership), regulated health information, or full payment-card data. Customer firms should not enter such data unless they have a lawful basis, have agreed it with us in writing, and appropriate safeguards are in place.

Fraud and compliance work can involve information about suspected offences, investigations or sanctions. Customer firms remain responsible for ensuring they are permitted to record that information and for limiting what they enter to what their engagement requires.

12. Cookies and similar technologies

The application uses cookies that are necessary for it to work:

• an authentication cookie that keeps you signed in;
• a security cookie on the demo environment that records that you entered the shared demo password (valid for up to 30 days).

Your display-theme preference (light, dark or system) is stored in your own browser's local storage and is not sent to us.

Optional website analytics

When website analytics is enabled, we ask for your consent before measuring your visit with PostHog. Rejecting optional analytics does not affect the early-access form or any other website feature. You can change your choice using Privacy settings in the footer.

We measure landing-page views, early-access button clicks, form starts, successfully saved requests and completed surveys. Events include the button location and the headline displayed at that moment. A random identifier connects actions during a visit; it is not linked to your early-access submission or an app account. We do not send names, email addresses, firm names, form answers, URL query strings or referring page addresses to PostHog. We do not use session recordings or automatic interaction capture.

Events pass through our website server, which does not forward your browser headers or IP address to PostHog. Location enrichment and person-profile creation are disabled for these events. Our hosting provider still processes connection information to serve and protect the website.

Your analytics choice is stored in your browser’s local storage for up to 180 days. After you accept, the random visit identifier is held in session storage, expires after 30 minutes of inactivity, and normally clears when the tab closes. Rejecting analytics removes that identifier and stops future events. Events already received cannot be unsent. If browser storage is unavailable, preferences and identifiers last only for the current page.

Analytics event retention in PostHog: up to one year. Our PostHog project is hosted in its EU Cloud region. We use no advertising cookies. Analytics on this landing page does not enable analytics in the Nyxa application.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it was last changed. We will post updates on nyxahq.com. If a change materially affects how we use your data, we will notify customer firms by email or with a notice in the application before it takes effect.

14. Contact

Privacy, data-protection and legal matters: legal@nyxahq.com
General enquiries and support: contact@nyxahq.com
Postal address: Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia