Privacy Policy

Nexus Sentinel is operated by WaveNexus Digital Invest (“we”). This policy explains what we collect when you use Nexus Sentinel, why, and the choices you have.

What we collect

• Account information: your name, email address, a hashed password (or your Google account identifier if you sign in with Google), time zone and notification preferences.
• Organization information: your company name, optional logo, team members and their roles.
• Client information you enter: client business names, industries, notes, and the vendors, products, keywords and domains on each client's watchlist.
• Device information for alerts: the web push subscription your browser creates (an endpoint URL and encryption keys) and the browser's user-agent string.
• Billing information: handled by Stripe. We store your Stripe customer and subscription identifiers and status, never your card number.
• Security and usage records: sign-in events, IP addresses on security-relevant actions, an audit log of account changes, and records of alerts we sent.

What we don't collect

We do not install software on, scan, or connect to your clients' networks or devices. We don't sell personal information or use it for advertising.

How we use it

• To match public security incidents to your clients' watchlists and send the alerts, digests and reports you ask for.
• To run your account: sign-in, email verification, password resets, invitations and billing.
• To keep the service secure: rate limiting, abuse prevention and audit logs.

Service providers

We use Vercel (hosting), Railway (database and background jobs), Stripe (payments), Resend (email delivery), Google (optional sign-in), browser push services operated by your browser vendor, and Anthropic (to summarize public incident reports; no customer or client data is sent to Anthropic).

Retention

We keep account and organization data while your account is open. When you delete your organization or account in Settings, its data is deleted from our production database; backups roll off within 30 days. Billing records may be retained as required by law.

Your choices

• Export your organization's data as JSON from Settings (owners).
• Turn digest emails off in Settings or with the unsubscribe link in any digest.
• Delete your account or organization from Settings.
• Contact us at chris.repstein@wavenexusdigitalinvest.com for access, correction or deletion requests.

Changes

If we make material changes we'll email account owners before they take effect.