Privacy notice

Nexlumiq is operated by Jack Dyer, trading under the Nexlumiq brand, in Guernsey, Channel Islands. Nexlumiq is not an incorporated company.

Updated 6 October 2026. Contact: privacy@nexlumiq.com.

Information and purposes

We process submitted public website URLs, sampled HTML, scan evidence, proposed wording, approvals, original metadata and change history to provide and verify the requested service. We link saved work to your site-specific authenticated account identity. Security counters use hashed IP/session/account identifiers to limit abuse. Do not submit passwords, private customer records or confidential pages.

We use information needed to provide the service you request, protect its security, respond to support requests and meet applicable legal duties. Optional website access is granted through Webflow OAuth. Tokens are encrypted, account-bound and used only on the server. No raw Webflow password is requested. Paddle handles payment information; Nexlumiq retains transaction/subscription references, status and minimal event records, not card numbers.

Cookies and retention

An essential secure cookie associates an anonymous scan with its browser for up to 24 hours. Unclaimed reports expire after 24 hours and are removed during later scan maintenance. Expired rate-limit counters are removed during later scans. Saved work remains until deletion. Website-bound history and originals are protected against accidental deletion; contact us for safe account closure and removal. Deleting a scan does not cancel a subscription or revoke Webflow access. Revoke the app in Webflow to stop future API access. Billing records may need retention for reconciliation or legal obligations; provider backups/security logs may have separate retention.

Aggregate campaign measurement

For campaign links, we count daily visits and actions such as starting or completing a free scan and clicking sign-in or an onboarding enquiry. These counts contain only the campaign name and action type, not your identity or scanned website. We do not use advertising cookies, recipient identifiers, fingerprinting or tracking pixels for these counts. Aggregates are kept for up to 90 days. We honour Global Privacy Control and Do Not Track for this measurement. Essential service records and provider security logs are separate.

Providers and international processing

OpenAI Sites and Cloudflare provide hosting, storage, networking and account sign-in. Cloudflare DNS checks submitted domains. Google Fonts receives normal font requests. Paddle processes checkout and billing, and Webflow processes authorised website operations. These providers may process data outside Guernsey. No paid AI model receives scanned page content. No advertising trackers are used. Automatic monitoring is restricted to the controlled preview. Current Paddle use is sandbox only; do not enter real payment details.

Your rights

You may request access, correction, deletion, restriction or other applicable data rights by emailing privacy@nexlumiq.com. We may need to verify ownership before disclosing or deleting information. You can raise a concern with Guernsey's Office of the Data Protection Authority. We do not sell your personal information.