Privacy and data handling

This statement describes what NexGuard records and what it does with it. It is written against the behaviour of the running system.

What is collected

• Identity. Name, email address, and optionally a phone number. Passwords are stored only as an Argon2id hash and are never recoverable, by anyone, including NexGuard.
• Professional context. Role, industry, and years of experience, given voluntarily so that study material can be pitched at the right level.
• Study performance. Answers, timing, answer changes, review activity, and retention history. This is the raw material of the diagnostic and every recommendation made from it.
• Field material. Observations, photographs, audio, video, and documents a member chooses to upload.
• Payment records. Amount, method, status, and the operator decision on a manual claim. Card numbers are never received or stored by NexGuard; card payment, when enabled, is completed on the payment provider's own hosted page.
• Operational records. Sign-in events, governed actions, and the source address they came from, written to an append-only audit history.

Who can see it

Member data is read under the identity of the member who owns it. One member cannot reach another member's records through any route in the product, and automated tests hold that boundary. NexGuard operators can reach member records through the Command product to run the service: to review a payment claim, resolve a support request, or investigate a fault. A privileged read of member evidence is written to the audit history, with the operator who made it.

Uploaded files

An uploaded object is held until a malware scanner reports on it. Until then it cannot be opened, by the member or by an operator. An object a scanner reports as infected cannot be opened at all. Originals are kept separately from any derived analysis, so a member's own evidence is never altered by processing.

Artificial intelligence

Where a feature uses AI, the request goes through a single governed gateway that records the provider, the model, the prompt version, the evidence used, and the result. Only the requesting member's authorised data is sent. When no provider is configured on a deployment, the platform answers with a clearly labelled deterministic stand-in and says so on the page; it never presents that output as live AI. Study and field material are not used to train any third-party model.

Third parties

Depending on deployment configuration, NexGuard may pass data to an AI provider, an S3-compatible storage service, a payment provider, a malware scanning service, and email or SMS carriers. Each is listed with its live configuration state inside the Command product, and a service that is not configured receives nothing.

How long it is kept

Study and profile records are kept while the account exists. Financial and audit records are kept after an account closes because they are the evidence of what was charged and what was decided. Uploaded files can be deleted by the member; deletion is recorded, and the stored object is purged.

A member's rights

A member may ask for a copy of their records, ask for a correction, or ask for their account to be closed. Requests are made through the support page.

Security

Sessions are opaque server-side records carried in an HTTP-only cookie, not a token readable by browser code. The member product and the Command product use separate cookies and cannot borrow each other's sessions. Secrets are supplied to a deployment through the environment and are never stored in the repository, returned to the browser, or written to a report.