Privacy Policy
Last updated: 11 August 2026
Review before publishing. This is a drafted policy, not legal advice. It describes the data handling this platform actually performs, but the operating entity and any regulator-specific obligations must be confirmed by you or a solicitor.
This policy explains what personal data Nexov's Gateway ("we", "us") collects when you use this website, the tools portal, or contact us to purchase a service, and what we do with it.
1. Data we collect
Information you give us
- Contact details. Your name and email address when you request access, join the waitlist, or open an account.
- Purchase context. The reason you give for wanting access, and the payment method you choose.
- Payment references. The transaction identifier for a cryptocurrency payment. We do not receive or store card numbers, wallet private keys, or bank details.
- Correspondence. Messages you send us over Telegram or email.
- Case material. For removal work, the URLs you want addressed and whatever you send to evidence your basis for the request. This can include sensitive personal data about you, and in some cases identity documents.
Information collected automatically
- Account activity. A record of each query you run through the tools, including the tool used, the target you queried, the time, and whether it succeeded.
- Technical data. IP address, browser user-agent, and a derived device identifier, used to enforce the per-account device limit and to detect account sharing.
- Contact form submissions. Your name, email address, the service you selected and your message, together with the IP address and browser user-agent the message was sent from. The message content is used to answer you; the IP address and user-agent are kept to investigate abuse of the form.
- Session data. An authentication cookie that keeps you signed in.
Search terms
Some tools accept a search term that may itself be personal data, such as an email address, a phone number, or a name. Where we log that a search occurred, the term is masked before it is stored (for example a**@example.com). We keep a record that a lookup happened and roughly against what; we do not retain a second copy of the value you searched for.
2. Why we use it
| Purpose | Lawful basis |
|---|---|
| Providing the service you paid for | Performance of a contract |
| Submitting removal requests on your behalf | Performance of a contract |
| Verifying payment and preventing fraud | Legitimate interests |
| Enforcing device limits and preventing account sharing | Legitimate interests |
| Maintaining an audit trail of tool usage | Legitimate interests; legal obligation where applicable |
| Responding to your messages | Legitimate interests |
| Launch notifications, if you asked for them | Consent |
3. Sharing
We do not sell personal data. We share it only with:
- Infrastructure providers that host the platform and its database.
- Email delivery providers, to send account and password messages.
- Upstream data providers, when a query you run must be forwarded to answer it. Queries are forwarded with our credentials, not your identity.
- Platforms, hosts and registrars, where a removal request must be submitted to them. We send only what that process requires. Where a platform demands proof of identity, we tell you before sending it.
- Law enforcement, where we are legally required to respond to a valid request.
4. Retention
- Account records. Kept while your account is active, and for 12 months after closure.
- Audit logs. Kept for 12 months, then deleted.
- Payment records. Kept for 6 years, as financial records generally must be.
- Waitlist entries. Kept until you ask to be removed.
- Unpaid invoices. Kept for 12 months, then deleted.
- Case material. Kept for 12 months after a case closes, so we can evidence what was done and why. Identity documents are deleted as soon as the platform requiring them has accepted the request. You can ask us to delete case material sooner.
5. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to processing, or to withdraw consent. To exercise any of these, contact us using the details below. We respond within 30 days.
If you are in the UK or EEA and are unhappy with our response, you may complain to your national data protection authority.
6. Security
Passwords are hashed with bcrypt and never stored in readable form. Sessions use signed, HTTP-only cookies. Traffic is encrypted in transit. Access to the administrative console is restricted and every action against a user account is logged.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant regulator where the law requires it.
7. Cookies
We use two cookies, both strictly necessary: a session cookie that keeps you signed in, and a CSRF token that protects forms against cross-site submission. We do not use advertising or third-party analytics cookies.
8. International transfers
Our infrastructure and database providers may process data outside your country. Where that happens, transfers rely on the safeguards those providers have in place, such as standard contractual clauses.
9. Children
This service is not directed at anyone under 18, and we do not knowingly collect their data.
10. Changes
If we change this policy materially, we will update the date above and, where the change affects you, tell you by email.
11. Contact
Questions or requests: [email protected] or Telegram.