Privacy and Personal Data Policy

Personal data operator: NX Solutions LLC, Republic of Uzbekistan, Tashkent, email support@nxventurer.ai.

Processing is carried out under the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 2 July 2019 as amended, the Law “On Informatisation”, the Law “On Electronic Commerce” and other legislation of the Republic of Uzbekistan. Mandatory rules of other countries apply to users located there.

The Service's personal data database is subject to registration in the State Register of Personal Data Databases as prescribed by the legislation of the Republic of Uzbekistan.

Account data: email address, hashed password, name, profile photo (optional), interface language and theme, Google account identifier when signing in with Google. Purpose: registration, authentication, workspaces, notifications, support.

Company and stakeholder data: information about shareholders, participants, directors, investors and employees entered by the User or extracted from uploaded documents; company documents. Purpose: ownership, financing and corporate records, due diligence preparation. For this data the User and the User's company own the personal data database and the Operator processes it on their instructions.

Signing data: signer name and email, email confirmation, IP address and device information at the time of the action, consent text and version, timestamps, handwritten signature image, passkey identifiers. Purpose: evidence of the fact, time and authorship of an electronic signature.

Technical data: access logs, IP addresses, session identifiers, error reports, interface usage events. Purpose: security, reliability and improvement of the Service.

Payment data. For Paddle payments, card data is processed by the Paddle payment platform; the Operator receives only the subscription status, the amount and the last digits of the payment instrument. For UZS invoice payments, the Operator processes the payer's details (name, TIN or PINFL, address, email), the payment order number and the payment date. Purpose: invoicing, payment records and performance of the agreement (public offer), accounting and tax records.

Account data is processed under the contract (Terms of Use) and the consent the User gives at registration in electronic form. The profile photo is processed under a separate consent requested at the first upload. Company documents and third-party data they contain are processed under a separate consent and the User's confirmation of a lawful basis, requested at the first document upload.

Consent may be withdrawn by email to the Operator. Withdrawal does not affect processing performed before it and does not stop processing the Operator must continue by law (for example, retention of signing evidence and accounting records).

The Service relies on the following processors: Supabase, Inc. (database, authentication and file storage on Amazon Web Services infrastructure), Vercel, Inc. (application hosting), OpenAI, L.L.C. (document analysis and the assistant), Google LLC (sign-in with a Google account, at the user's choice), Migadu (email delivery), Paddle.com Market Ltd (subscription payments as reseller).

The servers of these processors are located outside the Republic of Uzbekistan (European Union and United States). Personal data is transferred abroad with the data subject's consent, which the User gives at registration and when uploading documents, under agreements with the processors that ensure protection no lower than required by the legislation of the Republic of Uzbekistan.

For document analysis and assistant answers, the text of documents and requests is sent to OpenAI through its programming interface; under its terms the data is not used to train models and is retained for no more than thirty days for abuse monitoring.

The Operator is working to host the personal data databases of citizens of the Republic of Uzbekistan on servers physically located in its territory, as required by the data localisation rules. Until that work is complete, processing is based on the data subject's consent.

Within the Service, data is visible to workspace members within their roles, to external signers within the document sent to them, and to investors within the materials the User published in the investor room via a personal link.

The Operator does not sell personal data and does not pass it to third parties for their own purposes. Data may be shared with the processors in section 4, upon a lawful request of competent authorities of the Republic of Uzbekistan, and with a successor in a reorganisation of the Operator subject to this Policy.

Account data is kept until the account is deleted and for thirty days afterwards to allow restoration, then deleted. Company data is kept while the workspace exists and is deleted at the owner's request. Electronic signature evidence (hashes, logs, consents, certificates of completion) is kept for at least five years after signing is completed because it serves as evidence of the transaction. Payment records are kept for the periods set by tax law. Technical logs are kept for up to twelve months.

Encryption in transit (TLS) and at rest, row-level access control in the database, personal one-time links, email confirmation codes, password hashing, access logging and regular backups are applied. Operator staff access to User data is limited to support upon request and is logged.

The Operator notifies affected Users and the competent authority of a detected personal data breach within the periods set by the legislation of the Republic of Uzbekistan.

A data subject may obtain information about the processing of their data, demand its correction, blocking or destruction, withdraw consent, receive a machine-readable copy of their data and appeal the Operator's actions to the competent authority or a court.

Requests are sent to support@nxventurer.ai; a response is given within ten working days. For data entered by the User's company about third parties, the Operator forwards the request to the workspace owner and assists with fulfilling it.

The Service uses only technically necessary cookies and browser local storage: session, language, interface theme, request forgery protection. Advertising and third-party analytics cookies are not used. Anonymised interface usage statistics are collected by the Service itself without sharing with third parties.

A new version is published with its date and version number. For material changes the Operator requests consent again. The Russian version prevails over the translation.