Privacy Policy

Version 2026-08-11 · Effective 2026-08-11

The short version

We collect what we need to make your devices work and show you your numbers. We log each tap or scan, including an approximate location derived from the visitor’s IP address. We never store the visitor’s full IP address, name, or the content of any review. We do not sell personal data. We email you about your account, and about our other products only if you asked us to.

1. Who this covers

This policy applies to two different groups: business users who hold a Nexphaz account, and visitorswho tap or scan a device installed at a business. We explain each separately, because we collect very different things about them.

2. If you are a business user

We collect:

Account details — your name, email address and password (stored hashed, never in readable form). If you sign in with Google, we receive your name, email address and profile picture from Google; we never receive your Google password.
Business details — the business name, address, Google Place ID and review link you select during activation. This comes from Google’s public business data when you pick your business.
Device records — which devices belong to you and when they were activated.
Usage — sign-in times and actions taken in the dashboard, to keep the account secure.
Consent records — which version of our Terms and this policy you accepted, when, and from what IP address. We keep these as proof of agreement.

We use this to operate your account, run your devices, show your dashboard, provide support, prevent abuse, and meet our legal obligations. Our legal basis is performance of our contract with you, and our legitimate interest in running and securing the Service.

3. If you tapped or scanned a device

You do not need an account, and we do not ask you for anything. When a device is used, we record:

which device was used, and the date and time;
whether the redirect to Google succeeded;
the type of device used (for example “mobile”) and browser type;
an approximate city and country worked out from the IP address of the request.

We do not store your full IP address, your precise location, your name, your Google account, or anything you write in a review. Once you reach Google, you are on Google’s site and Google’s privacy policy applies — we cannot see what you do there, and we cannot connect a review back to a scan.

We do this so the business that installed the device can see how often it is used. Our legal basis is the legitimate interest of that business in understanding usage of its own equipment, balanced against the very limited, non-identifying nature of what we keep.

4. Cookies

We use strictly necessary cookies only: a session cookie to keep you signed in, and a short-lived cookie that carries your consent choice through the Google sign-in redirect. We do not use advertising or third-party tracking cookies, and there is no analytics pixel on the redirect path.

5. Marketing email

We will always email you about your account: activation confirmations, security notices, service changes, and anything legally required. These are not marketing and you cannot unsubscribe from them while you hold an account.

We will only send you marketing — product news, tips, or information about other Nexphaz services — if you ticked the optional box asking for it. That box is never pre-ticked, it is separate from accepting the Terms, and you can withdraw it at any time from your account settings or the unsubscribe link in any such email. Withdrawing it does not affect your account or your devices.

6. Who we share data with

We do not sell personal data. We share it only with:

Google — we call Google’s Places API to look up your business during activation, and Google’s sign-in service if you use it. Visitors are redirected to Google to leave their review.
Our hosting and email providers — the servers that run the Service and send our email, acting on our instructions.
Authorities — where we are legally required to, or to establish or defend legal claims.

7. Where data is held, and for how long

Data is stored on our own servers in the United States. If you are in the European Economic Area or the UK, this means your data is transferred to the US; we rely on the European Commission’s Standard Contractual Clauses for that transfer.

Account and business data — for as long as your account is open, then deleted or de-identified within 90 days of closure.
Scan records — 24 months, then deleted.
Consent records — 6 years after account closure, because they are our evidence that you agreed.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, object to or restrict how we use it, receive a copy in portable form, and withdraw consent you previously gave.

California residents: you have these rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under California law.

To exercise any right, email cm@nexphaz.com. We respond within 30 days. If you are in the EEA or UK you may also complain to your local data protection authority.

9. Security

The Service runs over HTTPS. Passwords are hashed. Each business’s data is isolated at the database level so one account cannot read another’s. Access to production systems is limited to people who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.

10. Children

The Service is for businesses. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it.

11. Changes

If we make a material change we will notify you by email and ask you to accept the new version. The version and effective date are always shown at the top of this page.

12. Contact

Privacy questions or requests: cm@nexphaz.com