Privacy Policy
1. Controller
Marin Stoyanov Pantov, ul. Mechta 32, Haskovo, Bulgaria, nexabalance1@gmail.com. No data protection officer is appointed (not required for this operator).
2. What we process and why
- Wallet: a random wallet identifier, your BALANCE, purchases (package, amount, Stripe payment reference, date) and a ledger of BALANCE changes — to provide the paid service and keep accounts (contract; legal obligations). A wallet is created only when you start a purchase (or restore one with your Balance Code); visiting the sites, browsing the catalog and viewing the two free concepts at positions 1 and 2 create no wallet and set no cookie.
- Balance Code: stored only as a keyed hash; while a new code has not been confirmed by a first purchase, an encrypted copy is kept so it can be shown to you again.
- Cookies (strictly necessary, no consent needed): a session cookie on each NEXA site (30 days), a short state cookie during sign-in (5 minutes), and a device cookie on the NEXA BALANCE service domain balance.nexa-ecosystem.com that keeps your BALANCE in this browser (up to 400 days). All are HttpOnly and Secure. No advertising, analytics or tracking cookies are used.
- Viewed concepts: which concepts you opened per site (your four open concepts, and a 30-day "viewed" marker) — to apply the free re-open rule.
- API tokens (AI agents): stored only as a hash, with the label you chose, until they expire (default 30 days) or are revoked.
- IP address: not stored. To prevent abuse, a keyed hash of it is counted in short time windows (at most one hour) and then deleted automatically. The hosting provider keeps its own technical logs.
- Payments: card details and the e-mail address you give at checkout are processed by Stripe as an independent controller (https://stripe.com/privacy). We receive the payment status and reference, not your card number.
3. Retention
A wallet that never made a purchase is deleted after 30 days without use. Purchase records and payment references are kept for 400 days for refunds and disputes, and as long as tax and accounting law requires. Encrypted backups are kept for at most 30 days.
4. Service providers (processors)
Hosting: Vercel Inc. (EU — Frankfurt, Germany for the NEXA BALANCE service; USA — Washington, D.C. for the server functions of the websites). Database: Upstash, Inc. (EU — Frankfurt, Germany). Payments: Stripe (independent controller). Where data leaves the EU/EEA, the providers' standard contractual clauses / adequacy decisions apply. Vercel processes data under its Data Processing Addendum, which applies to its Pro plan used here; Upstash processes data under its Data Processing Addendum, which forms part of its Terms of Service.
5. Your rights
You may ask for access, rectification, erasure, restriction, portability, and object to processing, by e-mail to nexabalance1@gmail.com. Because wallets are not linked to your name, please include your Balance Code or the Stripe receipt so we can find your data — never send the code to anyone else. You may complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or the supervisory authority of your EU country of residence.
6. Security
Codes and tokens are stored only as keyed hashes, connections are encrypted, and protected content and payments are checked on the server for every request.