This Privacy Policy explains how Command Nexus, a company in formation ("Command Nexus," "we," "us") collects, uses, shares, and protects personal data when you use the Command Nexus website, applications, APIs, and the Nexus Admin software (the "Service"). It is written to reflect what the platform actually collects and do, not a generic template. Terms not defined here have the meaning given in our Terms of Service.
For your Command Nexus account itself, we are the data controller. When an organization uses Command Nexus to manage its members, the organization is the controller of its members' data and Command Nexus acts as a processor on that organization's behalf. This means an organization's administrators can see and manage the data of members in their organization. A Data Processing Addendum is available to organizations that need one.
SameSite=Lax, HttpOnly,
and Secure, are strictly necessary, and need no consent. We do not use
advertising or cross-site tracking cookies. See our
Cookie Policy for the full list and each
cookie's lifetime.If your organization runs the Nexus Admin server software, we process in-game administration and anti-cheat data, which may include your Steam/game UID, in-game name, session and connection events, positions, administrative actions, ban records, and anti-cheat flags. This data is used to provide server administration and anti-cheat features to the organization that operates the server.
| Purpose | Examples | Legal basis (EU/UK) |
|---|---|---|
| Provide the Service | Create your account, run organizations, ORBAT, operations, merit, certifications | Performance of a contract |
| Billing | Process subscriptions and purchases via PayPal, calculate tax, keep payment records | Contract; legal obligation (tax) |
| Security & anti-abuse | Login-attempt logging, brute-force lockout, anti-cheat, ban enforcement | Legitimate interests; legal obligation |
| Reliability | Error logging and diagnostics, backups | Legitimate interests |
| Communications | Service emails, and optional Discord notifications where linked | Contract; consent where applicable |
| Account linking | Discord and Steam linking you initiate | Consent |
We rely on a small number of service providers to run the platform:
We retain personal data only for as long as is necessary for the purposes set out in Section 3, and thereafter only where a statutory retention obligation, an applicable limitation period, or an overriding legitimate interest requires it. The periods in the table below are not aspirational: they are implemented as an automated erasure schedule inside the Service. Each period runs from the date the record was created, except for failed sign-in records, where it runs from the date of the most recent attempt.
| Category of data | Retention period | What happens when the period ends |
|---|---|---|
| Account, organization and community records (profile, membership, rank, ORBAT, operations, attendance, certifications, merit and medals) | For the lifetime of the account or organization | Deleted or anonymized when you or your organization request deletion, in accordance with Section 7. |
| Payment and invoicing records (subscription and transaction history, billing name, email and address, tax region) | No less than seven (7) years from the date of the transaction, except where erased earlier on account or organization deletion | Retained to satisfy tax, accounting and audit obligations. These records are not erased automatically at the end of that period. The billing contact details held against orders and invoices are blanked earlier than this, when the account or organization they belong to is deleted under Section 7; it is the transaction record itself that is kept for the full period. The maximum retention period for financial records is reserved for legal review. |
| Payment-processor event records (notifications received from PayPal) that are attributable to an organization or to a completed transaction | Seven (7) years, being 2,555 days, for the notification content | The notification content — including any payer name, email address or postal address it contains — is irreversibly overwritten. A minimal record of the event is retained indefinitely as evidence that the notification was received: its event identifier, event and resource type, the processor's reference for the transaction, the organization it relates to, its processing state, and the relevant timestamps. That record contains no directly identifying personal data such as a name, email address or postal address, though the processor's transaction reference remains linked to the transaction it describes. |
| Payment-processor event records attributable to neither an organization nor a completed transaction | One hundred and eighty (180) days for the notification content | Overwritten on the same basis as the row above, with the same minimal non-personal record retained. |
| Integration API request logs (which include IP address and user agent) | Thirty (30) days | Permanently deleted. |
| Error and diagnostic logs | Ninety (90) days | Permanently deleted. |
| Failed sign-in records (which include IP address) | Thirty (30) days from the most recent attempt | Permanently deleted. A record evidencing an active lockout or a standing block is exempt from this period and is retained until the lockout expires or the block is lifted, because deleting it would remove a live security control. |
| Ban and anti-cheat records generated through Nexus Admin | For as long as necessary for the ban and anti-cheat system to remain effective | Retained on the basis of legitimate interests, including after the associated account is deleted. |
| Backups | Until the backup is rotated | Deleted data may persist in encrypted backups for a limited period before those backups are overwritten in the ordinary rotation cycle. |
Erasure is carried out by an automated process rather than on a fixed calendar. That process is throttled and ordinarily runs not more than once in any twenty-four (24) hour period; we may also run it on demand, which only ever brings erasure forward and never delays it. Each pass works through a capped number of records in each category. A record is therefore held for a period after its retention period has ended — ordinarily a short one, and longer where a large accumulation is being worked through over successive passes. Where a longer period is required by law, or where records are subject to a legal hold in connection with an actual or anticipated claim, investigation or dispute, we retain the affected records until that requirement or hold ends. PayPal retains its own transaction records independently of these periods (see Section 5).
You can request deletion of your account from your member profile. When you do:
PayPal retains its own transaction records independently of this process.
Depending on where you live — and in particular if you are in the EU or UK — you have rights over your personal data, including to:
For data your organization controls, please also contact your organization's administrators; we will assist them as their processor. To exercise any right, email commandnexusproducts@gmail.com. Whether an EU representative is required for Command Nexus is flagged for legal review.
Command Nexus is operated from the United States. If you access the Service from outside the US, your data will be processed in the US and other countries where our providers operate, which may have different data-protection laws. Where required, we rely on appropriate safeguards for such transfers.
The Service is intended for users 16 and older. We do not knowingly collect personal data from anyone under 16. If we learn we have, we will delete it.
We protect data with measures including hashed passwords, encrypted transport (HTTPS), tenant isolation, hardened session cookies, upload re-encoding, and brute-force lockout. No system is perfectly secure. If a breach affects your personal data, we will notify affected users and, as a processor, the relevant organization controllers, and any regulators, as required by law and within applicable timeframes.
We may update this Policy. When a change is material, we publish the new version in our Legal Center with a new effective date and ask you to re-accept it the next time you sign in or check out.
Questions about this Policy or your data: email commandnexusproducts@gmail.com, our official channel of record. Once the company is formally established in the State of [U.S. STATE — set on LLC formation], its registered contact details will be added here.