Privacy Policy

1. Introduction

Nexdue is a subscription and warranty tracking service that helps individuals and small teams monitor renewal dates and receive timely reminders. This Privacy Policy explains what personal data Nexdue collects, why it is collected, how it is used, and the rights you have over your data.

By creating an account and using Nexdue, you agree to the practices described in this policy. If you have questions, contact us at [email protected].

2. Data We Collect

We collect only what is necessary to provide the service.

• Account data. Email address, display name, first name, last name, country, gender, and date of birth - provided by you when you create or update your account.
• Subscription and warranty data. Item names, amounts, renewal dates, billing cycles, notes, and categories - everything you enter into Nexdue to track your renewals.
• Billing data. Payments for the Prime plan are processed by DodoPayments, our Merchant of Record. Nexdue does not store card numbers, bank details, or raw payment data. DodoPayments handles all payment processing under their own terms and privacy policy.
• Auth and session data. Authentication is managed by SuperTokens. This includes session tokens, email verification status, and login timestamps.
• Reminder preferences. Your timezone, notification channel preferences, and reminder email address, used to schedule and send renewal alerts.
• Server logs. IP address, browser type, and request timestamps, collected automatically as part of standard server operation.

3. Why We Collect It (Legal Basis)

• Account data. To create and maintain your account and deliver the service. Legal basis: contractual necessity.
• Subscription and warranty data. To deliver the core renewal tracking functionality. Legal basis: contractual necessity.
• Billing data. To process payments for the Prime plan via DodoPayments. Legal basis: contractual necessity.
• Reminder preferences. To send renewal reminder emails you have opted into. Legal basis: legitimate interest / consent.
• Server logs. For security monitoring, abuse prevention, and service reliability. Legal basis: legitimate interest.

4. Third-Party Services

Nexdue uses the following third-party services. Each receives only the data necessary for its function.

• DodoPayments. Processes payments for the Prime plan as Merchant of Record. Receives billing name, email, and payment details directly. Nexdue does not see or store raw payment data.
• ZeptoMail. Delivers transactional emails - account verification messages and renewal reminder emails. Receives your email address and notification content.
• SuperTokens. Manages authentication and session handling. Receives your email address and login activity data.
• Hetzner. Cloud infrastructure provider based in Germany (EU). All Nexdue servers and data at rest reside in Hetzner data centres within the European Union.

5. Data Retention

• Account and subscription data. Retained while your account is active. Deleted within 30 days of a verified account deletion request.
• Financial and billing records. Retained for 7 years to comply with applicable legal and tax obligations.
• Server logs. Retained for 90 days, then automatically deleted.

6. Your Rights

Under GDPR and applicable law, you have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate or incomplete data.
• Deletion. Request deletion of your account and personal data, subject to legal retention requirements.
• Portability. Export your subscription data at any time via the CSV export feature in Settings.
• Opt out of reminders. Disable renewal reminder emails at any time from your account Settings.
• Complaints. Lodge a complaint with your national data protection supervisory authority.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Data Security

Nexdue uses encrypted connections (HTTPS) for all data in transit. Data at rest is stored on EU-based Hetzner infrastructure with restricted access. While we take reasonable technical and organisational measures to protect your data, no internet service is completely immune to risk. If you discover a security issue, please contact [email protected].

8. Children

Nexdue is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact [email protected] and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. For significant changes, we will notify you by email or via an in-app notice. Continued use of Nexdue after changes are published constitutes acceptance of the updated policy.

10. Contact

For privacy questions, data requests, or concerns about how we handle your personal data, email [email protected]. We aim to respond to all privacy requests within 30 days.