Privacy Policy

About This Policy

This Privacy Policy explains how Nexusdesk Pte Ltd ("Nexusdesk", "we", "us") handles personal data in connection with the website at nexusdesk.io. Nexusdesk is a private company limited by shares incorporated in Singapore (UEN 202528726G).

This policy covers the nexusdesk.io company and investor website only. Our product website at evidor.ai is operated by the same legal entity but has its own privacy notice covering its forms and product interactions. If you are interacting with Evidor, please read the policy published at evidor.ai.

Who We Are and How to Contact Us

Nexusdesk Pte Ltd is the data controller for personal data processed through nexusdesk.io. For privacy questions, data subject requests, or any concern about this policy, you can reach us at privacy@nexusdesk.io. We aim to respond within 30 days.

What We Collect

nexusdesk.io is an informational website. It has no account creation and no e-commerce. The categories of data we handle are limited to the following.

• Analytics data. We use Cloudflare Web Analytics to count visits and understand which pages are read. Per Cloudflare's published documentation, this product does not set cookies, does not store IP addresses, and does not build profiles of individual visitors.
• Server and edge logs. Our hosting provider, Cloudflare, generates standard edge logs when you load a page. These logs include your IP address, user agent, timestamp, and the URL you requested. We use them for security monitoring, abuse prevention, and operational troubleshooting.
• Email correspondence. If you email any of the published addresses at our domain (for example press@nexusdesk.io, investors@nexusdesk.io, or privacy@nexusdesk.io), your message and any information you include in it are received in our Google Workspace inbox. We treat your message as a contact record.
• Meeting bookings. If you book a call through a booking link on this site, the details you enter (usually your name, email address and chosen time) are collected by Cal.com, our scheduling provider, for us. The booking also records which type of call you chose, such as an Evidor pilot call or an intro call, and may include a short tag showing which button you used.
• Register your interest. If you register your interest, we collect your first name, last name and email address. Our form handler, which runs on Cloudflare, sends them to a Nexusdesk email inbox in Google Workspace and does not keep a copy. Cloudflare Turnstile checks that the form is being used by a person.

We do not run third-party advertising trackers on nexusdesk.io. We do not use Google Analytics, the Meta Pixel, the LinkedIn Insight Tag, or any similar product on this site.

Why We Process This Data

We process the data above for the following purposes.

• Analytics data is used to understand site traffic in aggregate, so we can decide what to publish and improve the site.
• Server and edge logs are used to keep the site available, defend it against attacks and abuse, and investigate operational issues.
• Email correspondence is used to reply to you, to manage business relationships (investor, press, partner, candidate, vendor), and to keep a record of conversations that have legitimate business value.
• Meeting bookings are used to arrange and hold the call you booked, and to prepare for the topic you chose.
• Interest sign-ups are used to send you marketing emails from Nexusdesk: a short introductory series, then news about Nexusdesk and Evidor, offers and invitations to talk, until you unsubscribe. We may use an email service provider to send them; it is named under Service Providers. We do not share your sign-up with anyone else.

Legal Bases

Under the Singapore Personal Data Protection Act 2012 ("PDPA"), we rely on the notification of purpose described above. Where you email us, you are providing personal data voluntarily for the purpose of obtaining a reply, and we treat that as deemed consent under the PDPA. When you register your interest, you consent to the emails described above, and you can withdraw that consent at any time.

For visitors located in the European Economic Area or the United Kingdom, where the General Data Protection Regulation ("GDPR") or UK GDPR applies, we rely on the following legal bases under Article 6(1):

• Legitimate interests for privacy-respecting analytics, security logging, and replying to unsolicited correspondence. Our interests are running a secure and useful website and responding to legitimate enquiries; we have considered the impact on you and the data involved is limited.
• Consent where you actively choose to email us or register your interest, for the purpose of receiving a reply, any follow-up about the matter you raised, or the updates you asked for.
• Compliance with a legal obligation where we are required to retain records or respond to lawful requests from regulators or courts.

Service Providers

We use a small set of established service providers to operate nexusdesk.io. We do not sell personal data to anyone.

• Cloudflare, Inc. Hosting (Cloudflare Pages), edge network, web analytics, the form handler that sends sign-ups to our inbox, and Turnstile bot protection. Traffic to nexusdesk.io passes through Cloudflare's global network.
• Google LLC. Google Workspace, which hosts our inboxes.
• Cal.com, Inc. Scheduling for calls booked through this site, under data processing terms that form part of its contract with us.

Each provider processes data under its own privacy and security commitments. We rely on the standard data transfer mechanisms they publish, including standard contractual clauses where applicable.

International Transfers

Because Cloudflare, Google and Cal.com operate global infrastructure, your data may be processed at data centres outside Singapore and outside your country of residence. We rely on our contracts with these providers, including their data processing terms and, where they apply, standard contractual clauses, as safeguards recognised under the PDPA and the GDPR.

Cookies

nexusdesk.io does not set cookies of its own. Cloudflare may set operational or security cookies at the network level, for example the __cf_bm bot management cookie, to protect the site from automated abuse. These are strictly necessary for the site to function safely and are not used for advertising. Our sign-up form uses Cloudflare Turnstile, which checks browser signals to tell people from bots. Cloudflare handles that data under its own privacy policy.

Your Rights

Under the PDPA, you have the right to ask us what personal data we hold about you, to correct it if it is wrong, and to withdraw any consent you have previously given. You also have the right to make a complaint to Singapore's Personal Data Protection Commission.

If you are in the European Economic Area or the United Kingdom, you have additional rights under the GDPR or UK GDPR, including the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing carried out under legitimate interests. You may also lodge a complaint with your local supervisory authority.

If you are a California resident, you have rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know what personal information is collected about you, the right to delete it, the right to correct it, and the right to opt out of any sale or sharing of personal information. We do not sell or share personal information collected via nexusdesk.io.

To exercise any of these rights, write to privacy@nexusdesk.io. We may need to verify your identity before acting on a request.

Retention

We keep personal data only as long as we need it for the purposes described in this policy.

• Analytics data is retained by Cloudflare in accordance with its product retention periods. It does not identify you individually.
• Server and edge logs are retained for a short operational window, typically around 30 days, unless we need to keep a specific log entry longer to investigate a security incident.
• Email correspondence is kept for as long as the business relationship or matter justifies, and thereafter in line with our internal records management practice. You can ask us to delete your correspondence at any time, subject to any legal obligation we have to retain it.
• Booking details are kept for as long as the meeting and any follow-up conversation justify.
• Interest sign-ups are kept while we send you emails. If you unsubscribe or ask us to remove you, we delete your sign-up within 7 days, except that we may keep your email address on a do-not-email list so we don't email you again. If we have not emailed you for 12 months, we delete it.

Security

We use commercially reasonable, industry-standard practices to protect personal data, including encryption in transit, access controls on our inboxes, and reliance on established providers for hosting and email infrastructure. We do not currently hold formal information-security certifications such as SOC 2 or ISO 27001, and we do not claim to. We continue to improve our practices over time.

Children

nexusdesk.io is directed at investors, prospective customers, business partners, journalists, and prospective hires. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will publish the revised version at this URL and update the "Last updated" date at the top. Material changes will be reflected prominently.

Governing Law

This policy is governed by the laws of Singapore, and the Personal Data Protection Act 2012 applies.