Privacy Policy

Version v1.0 · Effective July 22, 2026

This Privacy Policy explains how Command Nexus, a company in formation ("Command Nexus," "we," "us") collects, uses, shares, and protects personal data when you use the Command Nexus website, applications, APIs, and the Nexus Admin software (the "Service"). It is written to reflect what the platform actually collects and do, not a generic template. Terms not defined here have the meaning given in our Terms of Service.

1. Who is responsible for your data

For your Command Nexus account itself, we are the data controller. When an organization uses Command Nexus to manage its members, the organization is the controller of its members' data and Command Nexus acts as a processor on that organization's behalf. This means an organization's administrators can see and manage the data of members in their organization. A Data Processing Addendum is available to organizations that need one.

2. What we collect

Information you provide

• Account identity: username, first/last name, display name, email address, and password (stored only as a secure hash — we never store your plain password).
• Organization & membership data: the organizations you belong to and your role, rank, positions, attendance, certifications, merit/medals, requisition and commendation records, and similar community records.
• Uploads: avatars and images (re-encoded on upload), documents, and other content you submit.
• Support communications: messages you send us and any contact form or support submissions.
• Billing details: billing name, email, and address you enter at checkout, and tax region. We never receive or store your card or bank details — those go directly to PayPal.

Linked accounts

• Discord: if you link Discord, your Discord user ID and basic profile, used for account linking and optional community notifications.
• Steam: if you link Steam, your Steam ID, used to match your in-game identity to your Command Nexus profile.

Information collected automatically

• IP addresses and login-attempt records: we log sign-in attempts and IP addresses to enforce brute-force lockout and protect accounts.
• Session cookies: a single session cookie (set SameSite=Lax, HttpOnly, and Secure) to keep you signed in. We do not use advertising or cross-site tracking cookies.
• Error and diagnostic logs: when the Service encounters an error, we record diagnostic details (which may include your user or organization identifier and the request context) to fix problems and keep the platform reliable.

Game telemetry via Nexus Admin

If your organization runs the Nexus Admin server software, we process in-game administration and anti-cheat data, which may include your Steam/game UID, in-game name, session and connection events, positions, administrative actions, ban records, and anti-cheat flags. This data is used to provide server administration and anti-cheat features to the organization that operates the server.

3. Why we use your data, and our legal bases

4. Who can see your data

• Your organization's administrators can see the data associated with your membership in their organization.
• Command Nexus staff access data only as needed to operate and support the Service.
• We do not sell your personal data and we do not share it for advertising.

5. Subprocessors and third parties

We rely on a small number of service providers to run the platform:

• Hosting (Hostinger) — stores and serves the application and database.
• PayPal — processes payments. PayPal acts as an independent controller of the payment data you give it; it retains transaction records under its own policies, which we cannot erase on your behalf.
• Discord — where you link a Discord account or your organization enables Discord notifications.
• Steam / Valve — where you link a Steam account for in-game identity.

6. How long we keep data

• Account and organization data — kept until you or your organization delete it (see below).
• Payment records — retained for approximately seven (7) years to meet tax and accounting obligations.
• Ban and anti-cheat records — retained as long as necessary to keep the anti-cheat system effective (legitimate interest), even after an account is deleted.
• Login-attempt and error logs — kept for a limited operational window.
• Backups — deleted data may persist in encrypted backups for a limited period before rotation.

7. Deleting your account and data

You can request deletion of your account from your member profile. When you do:

1. your account is deactivated immediately;
2. a 30-day grace period begins, during which you can cancel the request and restore your account by signing in;
3. after the grace period we execute the deletion — personal data is deleted or anonymized across the platform according to our data map, content you authored may be retained as an anonymized "Deleted user" record, and we keep only what we are required or permitted to retain (such as payment records and ban/anti-cheat history). We record a deletion certificate that itself contains no personal data.

PayPal retains its own transaction records independently of this process.

8. Your privacy rights

Depending on where you live — and in particular if you are in the EU or UK — you have rights over your personal data, including to:

• access and receive a copy of your data (we provide a data-export/report);
• rectify inaccurate data;
• erase your data (the 30-day deletion flow above);
• object to or restrict certain processing based on our legitimate interests;
• withdraw consent for processing based on consent (such as account linking), without affecting prior processing;
• lodge a complaint with your local data-protection authority.

For data your organization controls, please also contact your organization's administrators; we will assist them as their processor. To exercise any right, email commandnexusproducts@gmail.com. Whether an EU representative is required for Command Nexus is flagged for legal review.

9. International transfers

Command Nexus is operated from the United States. If you access the Service from outside the US, your data will be processed in the US and other countries where our providers operate, which may have different data-protection laws. Where required, we rely on appropriate safeguards for such transfers.

10. Children

The Service is intended for users 16 and older. We do not knowingly collect personal data from anyone under 16. If we learn we have, we will delete it.

11. Security and breach notification

We protect data with measures including hashed passwords, encrypted transport (HTTPS), tenant isolation, hardened session cookies, upload re-encoding, and brute-force lockout. No system is perfectly secure. If a breach affects your personal data, we will notify affected users and, as a processor, the relevant organization controllers, and any regulators, as required by law and within applicable timeframes.

12. Changes to this Policy

We may update this Policy. When a change is material, we publish the new version in our Legal Center with a new effective date and ask you to re-accept it the next time you sign in or check out.

13. Contact

Questions about this Policy or your data: email commandnexusproducts@gmail.com, our official channel of record. Once the company is formally established in the State of [U.S. STATE — set on LLC formation], its registered contact details will be added here.