Data processing summary

Last updated: October 18, 2026

1. Roles

Situation	Role of Nexus	Role of the partner
Monitoring a partner’s or client’s domains and sending alerts	Processor (acts on the partner’s or client’s instructions)	Controller, or processor for its client
Outreach, applications and payouts	Controller	Individual contact

2. What data is processed

Domain and site information: domain names, public DNS records, public site settings. Usually not personal data.
Account and alert contacts: names and work email addresses of people who receive reports or alerts.
Reports: findings and recommended fixes for the domains monitored.
Not collected: passwords, payment card numbers of end users, or the content of email.

3. Purpose

To provide monitoring, alerts and reports, and to run the partner program. Nexus does not use this data for advertising and does not sell it.

4. Sub-processors

Provider	Purpose	Location
Cloudflare	Hosting, analytics, inbound email routing	United States and global network
Resend	Form auto-replies, alerts and reports (not cold outreach)	United States
Cloudflare	One-to-one outreach mailbox on a separate sending domain	United States and global network
Formspree	Partner application form	United States
Cal.com	Scheduling	United States

Nexus will tell partners about new sub-processors 30 days in advance where the law requires it.

5. Security measures

Encryption in transit (HTTPS), a separate sending domain for outreach, and authenticated email (SPF, DKIM and DMARC).

6. Incidents

Nexus will notify the partner without undue delay, and within 72 hours where agreed, after becoming aware of a breach that affects the partner’s data, with the details needed to meet its own obligations.

7. Requests and assistance

Nexus will help partners answer data subject requests and will pass on any request it receives about the partner’s data.

8. Return and deletion

At the end of the agreement, Nexus will delete or return the partner’s data within 30 days on request, unless the law requires it to keep some records.

9. International transfers

Data is processed in the United States and, for Cloudflare, on its global network. For transfers out of the EU or UK, Nexus relies on standard contractual clauses (with the UK addendum) or the EU-U.S. Data Privacy Framework where the provider participates.

10. Signed DPA

For a signed DPA, write to hello@0infra.dev.