Privacy Policy

2. Definitions

“Personal Information”

Any information that identifies, relates to, or could reasonably be linked to you or your household.

“Platform Data”

Data you input into or generate through NexaState’s services, including queries, uploaded documents, and compliance reports.

“Usage Data”

Information collected automatically about how you interact with our services, including log data, device information, and analytics.

3. Information We Collect

We collect the following categories of information:

Information You Provide

• Account information: name, email address, company name, job title, phone number
• Payment information: billing address and payment method details (processed by our payment processor; we do not store full card numbers)
• Communications: messages sent through contact forms, support tickets, and email correspondence
• Platform inputs: FAR/DFARS queries, contract data, compliance documents, payroll information, and other data you submit for analysis
• Feedback and survey responses

Information Collected Automatically

• Device and browser information: IP address, browser type and version, operating system, device identifiers
• Usage information: pages visited, features used, search queries, session duration, referral URLs
• Log data: server logs, error reports, and performance metrics
• Location data: approximate geographic location derived from IP address (we do not collect precise GPS location)

4. How We Use Your Information

• To provide, operate, and maintain our compliance guidance platform
• To process your queries and deliver AI-generated compliance guidance
• To process payments and manage your subscription
• To respond to your inquiries and provide customer support
• To send service-related communications, updates, and security alerts
• To analyze usage patterns and improve our platform’s accuracy and performance
• To detect, prevent, and address fraud, abuse, and security threats
• To comply with legal obligations, including government reporting requirements
• To enforce our Terms of Service and protect our legal rights

5. AI & Automated Processing

NexaState uses artificial intelligence and machine learning to provide compliance guidance. When you submit queries or documents to our platform, this data is processed by our AI systems to generate responses.

6. Legal Bases for Processing

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data under the following legal bases:

7. Data Security

We implement industry-standard security measures to protect your information:

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted using AES-256 encryption
• Access controls enforce least-privilege principles across our infrastructure
• We conduct regular security assessments and vulnerability testing
• Employee access to customer data is logged and audited

While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Data Sharing & Third Parties

We may share information with the following categories of recipients:

• Service providers: Hosting, payment processing, analytics, and customer support providers who process data on our behalf under contractual confidentiality obligations
• AI infrastructure providers: Third-party AI model providers that process your queries to generate compliance guidance, subject to data processing agreements that prohibit use of your data for model training
• Legal and regulatory: When required by law, subpoena, court order, or to protect our rights, safety, or property
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity

9. Government Contract Data

• We maintain security controls consistent with NIST SP 800-171 guidelines for protection of CUI.
• Platform Data you submit remains under your ownership and control. We process it solely to deliver the requested services.
• Upon account termination, we will delete your Platform Data within 90 days, unless retention is required by law.

10. Data Retention

We retain your information for the following periods:

11. International Data Transfers

NexaState is based in the United States. If you access our services from outside the United States, your information will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and other appropriate safeguards for transfers of personal data from the EEA, UK, or Switzerland.

12. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

To exercise any of these rights, contact us at privacy@nexastate.com. We will respond within 30 days.

13. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: You may request details about the categories and specific pieces of personal information we have collected about you
• Right to delete: You may request deletion of your personal information, subject to certain exceptions
• Right to opt out: We do not sell or share your personal information for cross-context behavioral advertising
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights
• Right to correct: You may request correction of inaccurate personal information

14. Cookies & Tracking Technologies

We use the following types of cookies and similar technologies:

We do not use advertising or tracking cookies. You can manage cookie preferences through your browser settings.

15. Children’s Privacy

NexaState is a business-to-business platform and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at privacy@nexastate.com.

16. Third-Party Links

Our platform may contain links to third-party websites, including government regulatory sites (e.g., SAM.gov, acquisition.gov). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

17. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law. Where required, we will notify affected individuals within 72 hours of becoming aware of the breach, and we will report the breach to relevant supervisory authorities as required.

18. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will notify you of material changes by posting the updated policy on this page, updating the “Last updated” date, and, for significant changes, sending notice via email to the address associated with your account.