Privacy Policy

This website and the Nexus subscription/licensing service are operated by Joe Kane, a sole trader in the United Kingdom ("we", "us"). For the limited personal data we handle to run subscriptions and licensing, we are the data controller. Contact: [email protected].

Because Nexus is self-hosted, you are the controller of the helpdesk and operational data the Software reads on your own infrastructure — we never receive it, so we are neither its controller nor its processor. This policy covers only the data we handle: billing and licensing records, optional telemetry, problem reports you choose to send, and basic requests to this website.

If you take our optional managed hosting (self-hosting is the default), that changes for your deployment only: we run your own isolated instance on infrastructure we operate in a UK/EU region, so the helpdesk and operational data your board reads is processed there and we act as your processor for it, under our subscription terms. It stays a dedicated per-customer instance (never shared), secrets and tokens are encrypted at rest, and you can export your data and move to self-hosting at any time. Choose self-hosting and this paragraph doesn't apply — nothing operational reaches us at all.

Where UK/EU data protection law applies, we rely on: performance of a contract (to take payment, and to issue, validate and renew your licence); legitimate interests (to keep the service secure, to understand version/plan/provider adoption from minimal telemetry, and to respond to a problem report you send — balanced against your interests, and you can opt out of telemetry); and legal obligation (to keep invoicing/tax records). For the measurement tags on this website — which tell us how our adverts and campaigns perform and how visitors use the pages — we rely on your consent: we ask before they set anything, and you can decline or withdraw it at any time (see §5c).

The marketing site is static. We collect only what's needed to run a subscription: when you subscribe, our payment processor (Stripe) collects and processes your billing details. We receive limited information from Stripe (such as your email, plan and subscription status) to issue and renew your licence.

When you run Nexus, it reads metrics from the providers you connect (e.g. Zendesk Support + Talk). That processing happens on your deployment. API keys and tokens are encrypted at rest on your machine; read access is unauthenticated by design, so you should run Nexus on a LAN or behind a VPN/SSO.

Two parts of Nexus can use an AI provider that you configure (Anthropic or OpenAI) with your API key — both are opt-in:

• Daily summary sends only the day's aggregate numbers (tickets in/solved, the unassigned total, CSAT %, which monitored services are degraded) — never ticket content or anything that identifies a person.
• Switchboard AI routing (the private add-on), when you switch it on, sends the subject and body of an unassigned ticket to your chosen AI provider so it can suggest the best engineer — and only for the tickets the built-in keyword router is unsure about. This is the only Switchboard path that sends ticket content off your server; it always falls back to the on-device router, and with AI routing off nothing is sent. Your API key is encrypted at rest.

When you enable either feature, that data is processed by the AI provider you picked under their terms — it still never reaches us. Leave them off and Nexus uses its built-in, on-device logic only.

To operate subscriptions we store a mapping between your Stripe customer/subscription and the activation token that lets your Nexus fetch signed licence keys. We use this solely to issue and renew your licence and to verify your subscription is active.

We rely on a small number of processors to run the subscription, and we don't sell your data:

• Stripe — payments and subscription management. Stripe's handling of your data is governed by Stripe's own privacy policy.
• Resend — transactional email only. When we send your activation token, billing/renewal notices, or your PDF licence certificate, your email address and that message content pass through Resend to deliver it.
• Google — the Google tag (Google Analytics 4, and Google Ads conversion tracking) loaded directly on this website, used only to measure how our adverts and campaigns perform, including when an advert click leads to starting a subscription. Google sets cookies and receives standard usage data under its own terms; see §5c to opt out.
• Microsoft — Microsoft Clarity, loaded directly on this website: a measurement tool that shows us how visitors use the pages (which links get clicked, how far people scroll) so we can improve the site. It sets cookies and receives usage data under Microsoft's own terms, on the same consent as the Google tag; see §5c to opt out.

And before you ask — no, we don't even use third-party fonts. Go on, ask me about the fonts →

This site and the licensing service run on Cloudflare’s edge network; payments run on Stripe; transactional email runs on Resend; website and advert analytics run on Google and Microsoft. These providers may process the limited data described above on servers outside the UK/EEA (for example, in the United States). Where they do, those transfers are covered by appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses, as offered by each provider. We choose established providers that publish their own data-protection and transfer terms.

The marketing site loads two measurement tags directly: the Google tag (Google Analytics 4, plus Google Ads conversion measurement) and Microsoft Clarity, which measures how visitors use the pages (which links get clicked, how far people scroll). We use them to understand how our website and adverts perform — for example, which campaigns bring visitors who go on to start a trial or subscribe, and which parts of a page people actually read. We ask first: a cookie banner lets you Allow or Decline, and until you allow it the tags stay in Google’s “consent mode” and set no cookies. If you allow them, Google and Microsoft set analytics cookies and receive standard usage data (pages viewed, approximate location derived from your IP, device and browser, and how you move through a page). We use it only to understand traffic and site/advert performance — we don't sell your data. You can change your mind any time by clearing this site's cookies (the banner returns), or opt out of Google's analytics globally with Google's browser opt-out add-on. Aside from that, your in-browser preferences (such as the theme you pick on the homepage) are stored locally in your own browser, not sent to us. Stripe’s hosted checkout may set its own strictly-necessary and fraud-prevention cookies when you go to pay — that’s governed by Stripe’s policy.

This is a website-only thing — the app is a different story. These measurement tags exist purely for web and advertising reasons on this marketing site (nexus.joekane.org); they are not part of the Nexus app you download or self-host. Your self-hosted deployment makes no analytics calls to Google — or to us — at all: it talks only to the integrations you connect and to the licence server to validate your key, and it uses a session cookie purely to keep you signed in to your own deployment. The tracking stops at the website; the product you run stays yours.

Self-hosted (the default) — minimal and opt-out. Licensed Nexus servers send a small periodic beacon (roughly every 30 minutes) to the licence service containing only an opaque licence id, the running version, the plan name, which helpdesk product the board is connected to (e.g. Zendesk or Freshdesk — the product name only) and an optional self-chosen instance label — no customer data, no helpdesk content, and nothing that identifies a person. Nothing operational leaves your server beyond that beacon. We use it solely for version-adoption, plan-mix and provider-mix figures. It is on by default for licensed installs and you can switch it off at any time in Settings → Licence (or with NEXUS_TELEMETRY_OPTOUT=1).

Managed hosting — the same minimal envelope, always on. If you take our optional managed hosting, the board checks in about every five minutes and this cannot be opted out of. It sends exactly the same fields listed above: { licenceId, version, plan, provider, instanceName? }. It does not send a hosted flag, uptime, health status, provider reachability, an error count or an error message, and never sends ticket content, credentials, customer data or anything that identifies one of your end-customers. The licence service adds a last-seen timestamp when it stores the beacon, allowing us to detect a silent board. Choose self-hosting and the same envelope is opt-out, exactly as above.

If you choose to send a problem report from the app (Settings → About & updates → Report a problem), we receive exactly what you type, an optional reply-to email if you provide one, and the same basic install facts as the telemetry beacon (version, plan, helpdesk provider, opaque licence id, and the board's name). The report is emailed straight to us so we can respond — it is not stored in any database, and sending one is always your action, never automatic.

If you use the contact form on this website, we receive your name, your email address, the topic you pick and the message you type. It is emailed straight to the developer so we can reply — it is not stored in any database, and your email address is used only to respond to you. The form is rate-limited and protected by a spam honeypot; sending one is always your own action.

Depending on your location you may have rights to access, correct, export or delete the personal data we hold (which is limited to billing and licensing records). We keep those records only as long as needed to run your subscription and to meet our legal and tax obligations — typically up to seven years for invoicing records after a subscription ends — then delete them. Contact us to exercise any of these rights. If you're in the UK or EU and aren't satisfied with how we've handled your data, you also have the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office.

We may update this policy; the “last updated” date above reflects the latest version.

Privacy questions? Get in touch.