Privacy policy

1 What this policy covers

This policy explains what Neexaa collects when you use neexaa.com and the sites built on it, why, how long it is kept, and what you can do about it. It covers three groups: site owners and their teams, visitors of sites built on Neexaa, and customers of shops on Neexaa.

Each site built on Neexaa belongs to its owner, who decides what they collect through their forms and shop and how they use it. For that data the owner is the controller and Neexaa is their processor: we store and process it only to run the platform for them.

2 Owners and team members

• Account: your name, email, password (stored hashed, never readable by us), the sites you belong to and your role, when you signed up and last signed in, and, if you turn it on, a two-step sign-in secret and backup codes (stored hashed).
• Content: everything you put on your sites, which is public by design when the site is published.
• Payments: which plan you bought, when, the amount, and the payment reference from our payment partner. We never see or store card numbers; those go directly to the payment partner. If you save a card for automatic renewal, the partner keeps the card and gives us only a token, the card's brand, its last four digits and expiry, so we can show you which card is saved and ask the partner to charge it.
• Support: messages you send us through the Support page, with your email so we can answer.
• Technical: the address your requests come from and your browser, in server logs kept for thirty days for security and troubleshooting.

We use this to run your account and sites, to email you about them (confirmation, resets, team invitations, scheduled publishing, new messages and orders, plan reminders, domain status, the Monday shop summary), and to answer your questions. We do not send marketing email unless you ask for it.

3 Visitors of sites built on Neexaa

Sites built on Neexaa count page views without cookies: for each view we keep the page, the day, the device type and a code derived from your address and browser that changes every day, so views on the same day can be grouped and nothing links days together. Your address itself is not stored. Sites that turned analytics off count nothing. If your browser sends Do Not Track, you are not counted.

The platform sets only what it needs to work: a session cookie for signed-in owners and customers, a security token on forms, a language choice, and a “remember this device” cookie for two-step sign-in that you chose. No advertising or tracking cookies, and nothing from third parties, so no cookie banner is needed.

What you type into a site's form goes to that site's owner. Check their own privacy notice for how they use it.

4 Customers of shops on Neexaa

• When you order, the shop keeps your name, email, phone, delivery address, what you ordered and for how much, and the payment method and status. This is needed to deliver and to answer you about the order.
• Card, KNET and PayPal details go straight to the payment partner (SWAP Payments, MyFatoorah or PayPal) on their pages; neither the shop nor Neexaa sees them. We keep only a payment reference.
• You sign in with a link sent to your email; there is no password. Your customer record belongs to that shop only and is never shared with other shops on Neexaa.
• If you bought a PDF and read it on the site, we keep the page you stopped at so you can continue on another device.
• The shop's owner and their team see your details to serve you. The shop is the seller and the controller of this data; ask them about corrections or deletion, or write to us and we will pass it on.

5 Where data is kept and who helps us

The platform runs on Amazon Web Services in Frankfurt (eu-central-1). Pictures and files are stored in Amazon S3 in the same region; files sold as digital products are private and reached only through short-lived links. Email is sent through Amazon Simple Email Service. Payments are handled by SWAP Payments (on MyFatoorah) and, where offered, PayPal, each under their own privacy terms. With AI assistance switched on, the text or pictures an owner asks about are sent to Anthropic to produce a suggestion and are not used to train models.

We do not sell personal data, and we share it only with these providers to run the service, with a site's owner for their own site, or when the law requires.

6 How long we keep things

• Account and site content: while the account exists, and thirty days after it is closed.
• Orders and customers: while the shop exists, since the owner needs them for accounting; the owner can remove customers who have no orders.
• Page-view records: pruned automatically; individual records are deleted after ninety days and only aggregated counts remain.
• Server logs: thirty days. Backups: fourteen days, encrypted at rest.
• Support messages: until answered and for a year afterwards.

7 Your rights

You can see and change your account details on the Account screen, export everything on a site with one click from its Settings screen, and delete your account from the Account screen (with a thirty-day grace period). For anything else, such as a copy of personal data we hold about you or a correction, write to hello@neexaa.com; we answer within thirty days. Customers of a shop should ask the shop first, since the shop controls that data; we help either way.

8 Security

All traffic is encrypted with HTTPS, including on your own domain. Passwords and two-step secrets are stored hashed. Access to the servers is limited to the people who run the platform, over encrypted connections with keys. Backups run nightly. If we ever learn of a breach affecting your data, we tell you without undue delay.

9 Changes and contact

We may update this policy; the date at the top is the version in force, and material changes are announced by email or on the dashboard. Questions about privacy go to hello@neexaa.com or the Support page.