Privacy Policy

This Privacy Policy applies to personal data processing activities carried out by Nexus Corporation LTDA, registered under Brazilian CNPJ No. 66.324.183/0001-09 and trading as Nexus Produtos Digitais LTDA, hereinafter referred to as “Nexus”, “we”, “us” or “our”.

It covers websites, sales pages, forms, checkout pages, member areas, digital products, campaigns, advertisements, communications by email, telephone, SMS or WhatsApp, support channels and other digital environments operated by or on behalf of Nexus.

Third-party services used throughout the customer journey, such as Stripe, hosting platforms, member-area providers, email tools and social networks, may also process data under their own policies and legal responsibilities.

This table of contents organizes our privacy practices, data subject rights, and regulatory frameworks for rapid reference.

For the activities described in this Policy, Nexus generally acts as the personal data controller because it determines the purposes and essential means of processing.

Controller: Nexus Corporation LTDA, trading as Nexus Produtos Digitais LTDA.

Brazilian CNPJ: 66.324.183/0001-09.

Privacy and data protection contact: support@nexuscorp.online

The contact channel above may be used for requests relating to the LGPD, the GDPR, cookies, marketing, security, data correction or deletion, as well as questions about this Policy.

Nexus may process the categories below depending on how the data subject interacts with our products and channels:

Data may be collected:

Nexus only processes personal data when it has a legitimate purpose and an applicable legal basis. The specific legal basis may vary according to the country, context and the data subject’s relationship with Nexus.

Payments are processed through Stripe and its affiliates. During checkout, customers enter payment details into Stripe-controlled payment fields or a Stripe-hosted payment page. Stripe directly collects and processes information such as the full card number, expiry date, card security code, bank or payment-method details, billing information, device identifiers, transaction information and fraud-prevention signals.

Full payment card numbers and card security codes are transmitted directly to Stripe and are not collected or stored on Nexus systems. Nexus receives only the limited information required to administer the transaction, provide the digital product and handle support, refunds and disputes, which may include the transaction identifier and status, amount, currency, billing country, payment-method type, card brand and last digits of the card.

Depending on the activity, Stripe may act as a processor on Nexus’s instructions or as an independent controller when it determines its own purposes and means, including for payment-network operations, identity or account verification, security, fraud prevention, legal compliance and the provision and improvement of Stripe services.

Stripe may disclose payment and transaction data to banks, card networks, payment-method providers, fraud-prevention partners, regulators and other parties required to process or secure a payment. Stripe’s processing is governed by its own terms, privacy notices and data-processing arrangements. Customers should review those documents to understand Stripe’s activities and international processing practices.

Stripe Privacy Policy: stripe.com/privacy

Nexus may disclose personal data only to the extent necessary for the purposes described in this Policy. Depending on the service, disclosure may occur through access-controlled provider dashboards, secure technical integrations, APIs, encrypted network connections or other protected electronic channels. Access is limited to authorised personnel and service providers with a legitimate need to process the data.

Recipients may include:

Because Nexus sells digital products globally and uses international service providers, personal data may be stored in or accessed from countries other than the country in which the data subject is located.

For data subject to the LGPD, Nexus will use mechanisms permitted by applicable law and ANPD regulations, including adequacy decisions, standard contractual clauses, specific contractual clauses, binding corporate rules, certifications or other legally permitted grounds.

For data subject to the GDPR, transfers outside the European Economic Area will be made under valid mechanisms, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, binding corporate rules or applicable derogations, together with supplementary measures where necessary.

Data subjects may request additional information about the applicable safeguards by emailing support@nexuscorp.online, subject to trade secrets, security obligations and third-party rights.

Nexus and its service providers may use cookies, pixels, tags, local storage, device identifiers and similar technologies to operate the services, maintain sessions, strengthen security, remember preferences, measure performance, understand how the channels are used and display relevant communications.

Data is retained only for as long as necessary to fulfil the stated purposes, perform contracts, comply with legal and regulatory obligations, prevent fraud, resolve disputes and establish, exercise or defend legal claims.

Nexus maintains a risk-based information security programme and adopts reasonable technical, administrative and organisational safeguards designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. Depending on the system and risk, these safeguards include HTTPS/TLS encryption for data transmitted through Nexus websites and payment flows, restricted and role-based access, authentication controls for administrative accounts, permission management, security and access logging, backups and recovery procedures, supplier assessments, confidentiality and data-protection obligations, and documented incident-response procedures.

Payment security is further supported by using Stripe-controlled payment interfaces so that full card details are transmitted directly to Stripe and do not pass through or remain on Nexus systems. Nexus personnel and ordinary customer-support channels should never request a full card number or card security code.

No system is completely immune from risk. If a security incident occurs that may create a relevant risk or harm to data subjects, Nexus will take containment, investigation, documentation and mitigation measures and, where required, notify the competent authority and affected data subjects.

Data subjects must protect their credentials, avoid sharing passwords and immediately report any suspected unauthorised use.

To exercise a right, email support@nexuscorp.online with the subject line “Privacy — Data Subject Request” and describe the request.

To protect the data subject and prevent improper disclosure, Nexus may request reasonable information to confirm identity, the authority of any representative and the relationship to the relevant data.

Requests will be assessed free of charge and answered within the time limits provided by applicable law. Manifestly unfounded, excessive or repetitive requests may be handled as permitted by law.

Where Nexus acts solely as a processor on behalf of another controller, the request may be forwarded to the responsible controller.

Nexus may send offers, news, content, surveys and checkout-recovery communications by email, telephone, SMS, WhatsApp or other channels only where a valid legal basis exists. Where required by law, Nexus will obtain the customer’s prior consent before sending promotional communications.

Data subjects may stop receiving marketing communications through the unsubscribe link, available preference settings or by emailing support@nexuscorp.online. Nexus will promptly honour valid opt-out requests. Marketing opt-out does not prevent essential transactional, security, access-delivery, billing or customer-support messages.

Abandoned-cart and similar checkout-recovery messages are treated as promotional communications where required by applicable law. Nexus will not use incomplete-checkout data for promotional follow-up unless the customer has received the required notice and, where applicable, has consented. Consent records and opt-out preferences may be retained to demonstrate compliance and prevent unwanted messages.

As a general rule, Nexus does not make solely automated decisions that produce legal effects or similarly significantly affect the data subject. However, payment processors and fraud-prevention services may use automated models to assess risk, authenticate transactions, decline payments or request additional verification.

Where applicable law provides this right, the data subject may request information about the criteria and procedures used and ask for human review, subject to trade secrets, security and fraud-prevention requirements.

Nexus sales channels are not directed at children. Purchases must be made by legally competent persons or by their parents or legal guardians.

Nexus does not knowingly collect children’s data without the required authorisation and safeguards. If a parent or legal guardian identifies inappropriate processing, they should contact support@nexuscorp.online so that the matter can be reviewed and appropriate measures taken.

If a particular product is specifically intended for children or adolescents, a supplementary notice may be provided with specific rules, age-appropriate language and measures designed to protect the child’s best interests.

Nexus channels may contain third-party links, embedded content or integrations. Nexus does not fully control the practices of those third parties and recommends reviewing their privacy policies before providing personal data.

This Policy does not replace the privacy notices of payment processors, banks, social networks, advertising platforms, member-area providers or other independent services.

Nexus may update this Policy to reflect legal, regulatory, technological, contractual or operational changes. The current version will state its last-updated date.

Material changes may be communicated through a notice on the relevant channels, by email or by another appropriate method. Where a new purpose requires consent, consent will be requested before processing begins.

Questions, requests and complaints concerning privacy may be sent to: