Privacy policy

1. Who this covers

This policy explains how Tandem Business Strategies, LLC, doing business as Tandem Nexus, of 15400 Knoll Trail Dr. #503, Dallas, Texas 75248 ("Tandem Nexus," "we," "us," "our"), handles personal data when people use Nexus: the Nexus apps, Nexus Gateway (where people sign in), the AI features, and support. The organizations that use Nexus have their own privacy notices for the people they collect data about. The tandemnexus.com website has its own privacy policy.

2. Our two roles

• Controller for account, usage, log, and support data: Tandem Nexus decides how it's used to run Nexus.
• Processor (or service provider) for Customer Data: the organization that uses Nexus decides what it collects about its customers and contacts, and we process that data on its behalf, as our terms of service describe. If you're one of that organization's customers, contact the organization first; we'll help it answer you.

3. What we collect

Account data

Your name and email address; your password, which Nexus Gateway stores only as a hash; the secret for your authenticator app if you set one up, stored encrypted; the organizations you belong to; the brands you can open; and your roles in each app.

Customer Data processed for an organization

Whatever an organization brings into Nexus or collects through it: leads, contacts, and their consent records; messages sent to them and how they engaged; website events collected by Nexus site tags on the organization's own sites; data imported from advertising and analytics platforms the organization connects; content and creatives; and the results of AI features.

Usage and log data

Sign-ins and failed sign-ins with the time, IP address, and browser; who changed what in Nexus (audit records); when people from other organizations work in an organization under an operator grant; counts of metered use, such as messages sent and AI processing; and the technical logs Nexus needs to run and to fix problems.

Support requests

What you write, the app and page it's about, how urgent it is, your name and email address, your organization, and the replies.

Cookies

Nexus sets cookies to keep you signed in to each app and to Nexus Gateway, and to protect forms from forgery. It doesn't set advertising or analytics cookies. Your choice of light or dark mode is kept in your browser.

4. How we use it

• To provide Nexus: sign you in, show you what your roles allow, and run the features your organization uses.
• To keep Nexus secure: notice unusual sign-ins, look into misuse, and keep an audit trail.
• To bill your organization for its plan and its metered use.
• To answer support requests and send service email, such as invitations, setup links, security notices, and replies to your requests.
• To fix problems and improve Nexus, using usage and log data.

We don't sell personal data, and we don't use Customer Data for advertising. Where the law asks us to name a legal basis, we rely on performing our contract with your organization, our legitimate interest in running a secure and reliable service, and our legal obligations.

5. Customer Data

For Customer Data we act on the organization's instructions. We process it to provide Nexus to that organization, keep it apart from other organizations' data, protect it as section 8 describes, and help the organization answer requests from the people the data is about. Our subprocessors may use it only to provide their service to us.

6. Subprocessors

Other companies help us run Nexus, and they process personal data only to provide their service to us.

• AI model providers. The AI model providers an organization enables in its settings in Console, including any account it connects with such a provider. When someone uses an AI feature, the provider of the model that answers receives what the task needs, such as the request, the brand kit, and the records involved. Each organization's admins can see in Console the model its Ask box uses and any AI accounts it has connected.
• Hosting and email delivery. The providers that host Nexus and deliver its email.

You can ask for the current list of subprocessors, with what each does and where it processes data, at support@tandemnexus.com.

7. How long we keep it

• Account data: while you have an account. When an account is deactivated, we keep its records and sign-in history to protect Nexus and look into problems.
• Customer Data: while the organization's subscription lasts. After it ends, we delete it as our terms of service describe.
• Event history: Console keeps each organization's archive of Nexus events for 90 days.
• Support requests: we keep them so we can look back at earlier problems. To have yours deleted, write to support@tandemnexus.com.
• Logs and usage records: as long as we need them for security, billing, and the law.

8. Security

We protect personal data with measures that include:

• passwords held only by Nexus Gateway and stored as hashes, with an authenticator app as a second sign-in step for anyone who sets one up;
• access by role, and operator access that each organization grants, can see, and can revoke;
• in most apps, a database for each brand with a login that can reach only that database;
• credentials for connected platforms encrypted before they're stored, and never shown again;
• connections to Nexus over HTTPS;
• audit records of changes, and a person's approval before an AI-proposed action that sends, publishes, or spends.

No system is perfectly secure. If we learn of a breach that affects your personal data, we'll tell you or your organization as the law requires.

9. Your rights and requests

Depending on where you live, you may have the right to see the personal data we hold about you, correct it, get a copy, have it deleted, or object to or limit how we use it. You can change your name and your authenticator app on your Nexus Gateway account page. For anything else, write to support@tandemnexus.com.

We'll confirm who you are before we act, and we'll answer within the time the law requires. If your request is about Customer Data, we'll pass it to the organization that controls the data and help it respond. You may also complain to your local data protection authority.

10. International transfers

We and our subprocessors may process personal data in countries other than yours, which may have different data protection laws. Where the law requires it, we protect those transfers with safeguards such as the European Commission's standard contractual clauses.

11. Children

Nexus is for organizations and the people who work with them. It isn't meant for children, and we don't knowingly create accounts for them. If an organization's Customer Data includes data about children, that organization is responsible for collecting and using it lawfully.

12. Changes to this policy

We'll post any update here with a new date. If a change materially affects how we handle your personal data, we'll email your organization's admins before it takes effect.

13. Governing law

This policy is governed by the laws of the State of Texas, without regard to its conflict-of-law principles.

14. Contact

Questions and requests about privacy go to Nexus Support at support@tandemnexus.com. For anything else, write to hi@tandemnexus.com.

Tandem Business Strategies, LLC, doing business as Tandem Nexus
15400 Knoll Trail Dr. #503, Dallas, Texas 75248