Last updated: 20 July 2026

Privacy Policy

This Privacy Policy explains how Nexlify ("we", "us") collects, uses, discloses and protects personal data of visitors and clients, in compliance with the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA) and other applicable laws. 1. Data controller Nexlify is the data controller for information collected through this website. Contact: hello@aiproduct.studio. 2. What we collect - Contact data you submit through forms: name, email, phone, company, website, project description. - Technical data: IP address (truncated), browser, device, pages viewed, referrer. - Marketing attribution: UTM parameters, gclid, Google Analytics client ID, landing page, page URL. - Cookie preferences and consent records (timestamp, version, categories chosen). 3. Legal bases (GDPR) - Consent (Art. 6(1)(a)) — analytics, marketing cookies, marketing emails. - Performance of a contract / pre-contract steps (Art. 6(1)(b)) — responding to your enquiry. - Legitimate interests (Art. 6(1)(f)) — securing the site, preventing fraud, improving our services. - Legal obligation (Art. 6(1)(c)) — tax, accounting, statutory records. 4. How we use your data - Reply to enquiries, prepare proposals, deliver contracted work. - Measure site performance (Google Analytics 4) when you consent. - Send marketing emails only if you explicitly opt in. - Detect abuse and secure the service. 5. Sharing and subprocessors We share data only with vetted processors under a Data Processing Agreement: Supabase (hosting, database, storage), Cloudflare (edge & network), Google Analytics (analytics, if consented), Google Ads (advertising, if consented), and our email provider. We do not sell personal data as defined under CCPA/CPRA. 6. International transfers Data may be processed outside the EEA/UK/your country. We rely on the EU Standard Contractual Clauses and equivalent safeguards for transfers. 7. Retention Lead data is retained up to 24 months after last contact, then deleted or anonymized. Analytics data is retained per Google Analytics settings (default 14 months). Consent records are kept as required to demonstrate compliance. 8. Your rights - GDPR/UK GDPR: access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority. - CCPA/CPRA (California): right to know, delete, correct, opt out of "sale/share", limit use of sensitive personal information, and non-discrimination. Exercise any right by emailing hello@aiproduct.studio. We reply within 30 days (GDPR) / 45 days (CCPA). 9. Do Not Track & Global Privacy Control We honor the Global Privacy Control (GPC) signal as an opt-out of sale/share where applicable. 10. Cookies See our Cookie Policy for categories, purposes and controls. Non-essential cookies load only after your consent. 11. Security Encryption in transit (TLS), encrypted storage, least-privilege access, and audit logs. 12. Children This site is not directed to children under 16 and we do not knowingly collect their data. 13. Changes We may update this Policy; the "Last updated" date reflects the latest version.