Privacy
Short version: we set no cookies and use no third-party analytics. We keep privacy-minimized server logs for no more than seven days, plus information you deliberately send through the contact form, email, or Stripe checkout.
Who we are
nexaaly, a sole proprietorship registered in Denmark, CVR 40643419.
Contact: access@nexaaly.com. We reply to privacy requests within 5 working days.
Website access logs
| What | Why | How long |
|---|---|---|
| Time, requested path without query values, method, host, response status, duration, and size | Security, reliability, and aggregate service measurement | Up to 7 days |
| A coarsened network prefix, retaining 24 bits for IPv4 or 32 bits for IPv6 | Rate and session grouping without keeping the full address | Up to 7 days |
| User agent and referring page with query values removed | Separate automated requests from browser-like traffic and understand broad referral sources | Up to 7 days |
We do not keep full IP addresses, network ports, query values, cookies, authorization headers, or submitted passwords in access logs. Logs rotate daily and rolled files are removed after seven days. We do not use them for advertising or sell them.
Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in securing and operating the site, diagnosing failures, and measuring whether the business receives genuine rather than automated traffic. The short retention and data minimization limit the effect on visitors.
Contact and fit requests
If you submit the critical-flow form, we receive your name, work email, product or staging URL, selected flow, description of the expected outcome, and confirmation that you are authorized to request testing. Do not place passwords, tokens, private invitation links, or unrelated personal data in the form.
The full request is delivered to our business mailbox. A small CRM record stores your name, email, requested service, referrer, and user agent so the request is not lost or followed up twice. If no customer relationship begins, we delete the inquiry no later than 12 months after the last contact, or sooner when you make a valid deletion request.
If you write to access@nexaaly.com we keep the correspondence so we can answer you. If no customer relationship begins, we delete ordinary inquiry correspondence no later than 12 months after the last contact. Where it becomes a business relationship, we retain the records needed for the contract, legal claims, and Danish bookkeeping requirements. Mail is hosted by PrivateEmail (Namecheap).
If you become a customer
We store the company details needed to invoice you, including name, address, VAT number, the agreed scope, and the findings produced for you. Temporary test access is removed after the retest window. Danish bookkeeping law requires accounting records to be retained; that retention overrides a deletion request for those specific records, and we will say so plainly if you ask.
Payments are processed by Stripe, who act as an independent controller for payment data. At checkout Stripe also collects the three public page URLs, the main visitor action and handoff date, and your confirmation that you own the site or have written permission to test it. We can access those order details so we can deliver the service. We never see or store your card details.
We never publish your findings, name you as a customer, or quote your code without written permission. We may describe anonymised patterns, such as "an e-commerce site with an unlabelled checkout button", to improve detection.
Sub-processors
| Who | For |
|---|---|
| PrivateEmail (Namecheap) | Email hosting |
| Stripe | Payments, tax, invoicing, and order details |
The website, minimized access logs, CRM, and browser QA tooling run on our own hardware in Denmark. Authorized browser checks are executed there. Page content fetched during a check is processed for the agreed test. We do not publish customer findings, source, or access details without written permission.
Your rights
Under GDPR you can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Email access@nexaaly.com; no particular form is needed.
If we handle it badly you can complain to Datatilsynet, the Danish Data Protection Agency: datatilsynet.dk.
Changes
If this policy changes materially we update the date above and describe what changed rather than quietly replacing the text.