Privacy Policy
NexifyAI OÜ (“NexifyAI”, “we”, “us”) is an Estonian company that provides content and brand protection services to businesses. We respect your privacy and process personal data in line with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
01Who is responsible
The controller of personal data processed through this website is:
NexifyAI OÜ
Riia tn 2, korrus 4, büroo 412
Tartu, Tartu maakond 51004
Estonia
You can reach us about any privacy matter, including requests to exercise your rights, through our contact page. Please mention “Privacy” in your message so it is routed correctly.
02Scope of this policy
This policy explains how we handle personal data when you visit our websites (including client portal pages such as dazn.nexifyai.com), submit one of our forms, or otherwise contact us. It applies to business contacts at our clients, prospects and partners.
When we deliver our content and brand protection services (piracy monitoring, notice-and-takedown, search delisting and social or marketplace removals), we also process limited data about online content, such as URLs, account or channel names and the contact details of hosts, platforms and registrars. That processing is carried out to protect our clients' intellectual property rights and is governed by our agreement with each client, including a data processing agreement where we act as a processor.
03Personal data we collect
Audit and contact requests. When you use the form on our contact page, we collect your first and last name, work email, phone number, company name, what you need to protect and how you heard about us.
Partner enquiries. When you use a partner form, we collect your name, work email, company, partner type, details of the current opportunity and your message.
Technical data sent with a form. To prevent spam and abuse, each submission is stored with your IP address, the approximate location derived from it (city, region and country), your browser's user agent and a random device identifier.
Website analytics. We run our own first-party analytics. For each visit we record your IP address, approximate location derived from the IP address, user agent, the pages you view and how long you stay on them, the referring page, browser language, screen resolution, connection type, whether you have visited before, and a random device identifier. We do not use third-party advertising or tracking networks.
Client portal sign-in pages. The email address and password typed into a client portal sign-in page are not stored, transmitted to our database or logged by the website. Visits to those pages are recorded with the same technical analytics data described above.
Security records. Where a device or IP address is used to abuse our website, we may keep a record of it in order to block further access.
04Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to audit, demo, contact and partner requests and preparing a proposal | Steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Managing the business relationship with clients and partners | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) |
| Website analytics, to understand how the site is used and improve it | Legitimate interests (Art. 6(1)(f)) |
| Security, spam prevention, rate limiting and blocking abusive devices | Legitimate interests in protecting our website and services (Art. 6(1)(f)) |
| Keeping records required by accounting, tax and other laws | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can object at any time (see section 08). We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
05How long we keep data
- Enquiries: for as long as needed to handle your request and for up to 24 months after our last contact, unless a business relationship follows. Client and partner records are then kept for the duration of the relationship.
- Website analytics: up to 12 months from the visit.
- Security records: for as long as needed to protect the website against the abuse concerned.
- Accounting records: for the period required by Estonian law (currently seven years under the Accounting Act).
When a retention period ends, the data is deleted or anonymised.
06Service providers
We share personal data only with service providers that process it on our behalf, under written agreements and our instructions:
- Vercel: website hosting and delivery.
- Neon: managed database in which form submissions and analytics are stored.
- ipapi.co: converting an IP address into an approximate location (city, region, country).
- Cloudflare: DNS and, where enabled, bot protection on our forms.
We may also disclose personal data to professional advisers, or to authorities where the law requires it. We do not sell personal data.
07International transfers
Some of our service providers are based in, or use infrastructure located in, countries outside the European Economic Area, including the United States. Where data is transferred outside the EEA, we rely on an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework for certified recipients) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can request more information about these safeguards through our contact page.
08Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased, or its processing restricted, in the cases set out in the law;
- receive data you provided to us in a portable format;
- object to processing based on legitimate interests, including direct marketing;
- withdraw any consent you have given, without affecting earlier processing.
To exercise a right, contact us through our contact page. We may ask you to confirm your identity and will answer within one month.
You also have the right to lodge a complaint with a supervisory authority. In Estonia this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee. You may also contact the authority in the EU country where you live or work.
10Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), restricted and logged access to our admin area, hashed credentials and rate limiting. No system is completely secure, and we will notify affected people and the authority of a personal data breach where the law requires it.
11Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top of this page shows when it last changed. Material changes will be highlighted on this page.