Privacy Policy

• 'Personal Data' means any information that identifies or could identify a living individual, directly or indirectly (e.g., name, email address, IP address).
• 'Processing' means any operation performed on Personal Data, including collection, storage, use, and deletion.
• 'Data Subject' means any individual whose Personal Data is processed under this policy.
• 'Minimal Data' refers to our operating principle of collecting only the absolute minimum data required for a defined, specific purpose.

This Privacy Policy is designed to be consistent with internationally recognized data protection principles, including but not limited to:

• General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679: We apply GDPR principles of lawfulness, fairness, transparency, data minimization, purpose limitation, accuracy, storage limitation, and integrity/confidentiality to all personal data processing, regardless of the data subject's location.
• Personal Data Protection Act (PDPA) — applicable to clients and data subjects located in Singapore and other PDPA-framework jurisdictions: We process personal data only for purposes for which it was provided, and we do not transfer it outside the engagement context.
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA): California residents retain the right to know what data is collected, to request deletion, and to opt out of sale. We do not sell personal data under any circumstances.
• Children's Online Privacy Protection Act (COPPA): We do not knowingly collect data from individuals under 13 (or under 18 in applicable jurisdictions). Our services are directed exclusively at adults.

Regardless of your jurisdiction, Nexvara applies the highest applicable standard of privacy protection to all clients and site visitors. If there is a conflict between applicable local law and this policy, we will comply with the more protective standard where operationally feasible.

All personal data processing is limited to explicitly defined, lawful purposes:

• Purpose: Responding to project inquiries. Basis: Legitimate interest / pre-contractual necessity.
• Purpose: Delivering and managing agreed project work. Basis: Performance of contract.
• Purpose: Issuing invoices and maintaining minimum billing records. Basis: Legal obligation (accounting/tax law compliance).

We do not process personal data for marketing, profiling, behavioral analysis, product improvement, or any purpose beyond the specific engagement. We do not use automated decision-making or profiling that produces legal or similarly significant effects on data subjects.

We do not share, sell, rent, disclose, or transfer your personal data to any third party. This is an unconditional commitment, not a qualified statement subject to carve-outs.

• No analytics platforms, advertising networks, or marketing services.
• No data brokers, aggregators, or data resellers.
• No government, law enforcement, or regulatory agencies — we do not respond to voluntary data requests. In the rare event of a legally binding compelled disclosure order, our minimal-retention architecture ensures there is effectively no substantive personal data available to produce.
• No affiliated entities, business partners, or third-party processors.

In the event of any future business restructuring, acquisition, or dissolution: all client personal data will be permanently deleted prior to any transfer of other business assets. Personal data is not a transferable business asset under Nexvara's operating principles.

We operate on a strict minimal-retention principle. We do not maintain databases of client profiles, historical correspondence, or past project records beyond what is operationally active or legally required.

• Active project data: Retained only for the duration of the active engagement.
• Post-project communications: Deleted upon project completion and final settlement.
• Billing records: Minimum identifying information (e.g., client name, invoice amount, date) retained for the period required by applicable tax and accounting law — typically 5–7 years depending on jurisdiction — and no longer.
• Inquiry data (no project initiated): Deleted within 90 days if no engagement proceeds.

You may request deletion of any personal data we hold at any time. Because our retention is minimal by design, most deletion requests can be fulfilled immediately and completely.

Regardless of your location, Nexvara recognizes and will honor the following data subject rights:

• Right of Access (GDPR Art. 15 / CCPA): Request a copy of any personal data we hold about you.
• Right to Rectification (GDPR Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure / 'Right to be Forgotten' (GDPR Art. 17 / CCPA): Request deletion of your personal data. We will comply without undue delay, subject only to minimum legal retention obligations.
• Right to Restriction of Processing (GDPR Art. 18): Request that we limit processing of your data in certain circumstances.
• Right to Data Portability (GDPR Art. 20): Request your data in a structured, commonly used, machine-readable format.
• Right to Object (GDPR Art. 21): Object to processing based on legitimate interests.
• Right to Non-Discrimination (CCPA): Exercising your privacy rights will not result in denial of service or differential treatment.

To exercise any of these rights, contact us through nexvara.pro. We will acknowledge your request within 72 hours and fulfill it within the timeframe required by applicable law (typically 30 days under GDPR). We do not charge fees for rights requests.

The most secure data is data that does not exist. Our minimal-collection and minimal-retention approach constitutes the primary layer of our security posture. For the limited personal data we do handle:

• All client communications are conducted over encrypted channels (TLS/SSL).
• Access to project data is restricted to personnel directly involved in the engagement.
• We do not store client data in shared or public-accessible systems.
• No centralized client databases are maintained.

While no system can guarantee absolute security, our architecture is intentionally designed to minimize the attack surface. In the unlikely event of a data breach affecting personal data, we will notify affected individuals and relevant authorities as required by applicable law, within the legally prescribed timeframes (e.g., 72 hours under GDPR Art. 33).

Our website may contain hyperlinks to external websites or services. Nexvara has no control over, and assumes no responsibility for, the content, privacy practices, or data handling of any third-party sites. We encourage you to review the privacy policy of any external site before providing any personal information.

Nexvara's services are directed exclusively at adults (18 years of age or older). We do not knowingly collect, process, or retain personal data from individuals under 18. If we become aware that personal data from a minor has been submitted, it will be deleted immediately. If you believe such data has been provided, please contact us immediately through nexvara.pro.

Nexvara operates with clients globally. We do not transfer personal data to third parties or across borders as part of our operations. Where limited cross-border communication occurs in the normal course of a client engagement (e.g., email), this is at the direction and initiation of the client. We do not operate international data pipelines, cloud sync, or data warehousing systems that would constitute a regulated transfer under GDPR Chapter V.

This Privacy Policy is designed to reflect the highest standards of applicable data protection law globally. The following frameworks inform our practices:

For any privacy-related questions, data subject rights requests, or concerns about our data practices, please contact us through nexvara.pro. Given our minimal-retention architecture, most requests are fulfilled immediately. We are committed to transparent and prompt communication on all privacy matters.