Privacy Policy

Last updated 9 October 2026

1. Scope

This policy covers Nexxusbio at https://nexxus.bio, operated by Automate Horizon LLC. It explains what we collect, why, and what you can ask us to do about it. It applies both to creators with an account and to visitors viewing a creator's page.

2. What we collect

If you have a creator account: your email address and password (stored hashed, never in plain text), your chosen username, and the content you add to your page, such as links, biography text, images, and social handles.

If you are a visitor: nothing that identifies you, unless you choose to give it. We do not track you across the web, we run no advertising pixels, and we do not build a profile of you. If you follow a link we record the click, which is described below. If you submit your email to a creator's sign-up form, we store that address, your first name if you choose to give it, and which creator you gave it to, so they can contact you.

Technical data: when you submit a sign-up form we look at your IP address to apply a short rate limit and block automated abuse. If the sign-up goes through, we also store that IP address and the address of the page you signed up on, together with the time and, where the creator has set one, the consent wording you were shown. That is our record that you asked to hear from that creator, and it is kept with your sign-up. Our hosting providers keep their own standard server logs.

When you follow a link: we record that the click happened, so the creator can see how their page is doing. We store which link was followed, the time, the page you came from, and the browser identification string your browser sends. We do not store where the link took you, we do not store your IP address, and we set no cookie for it, so the click is not connected to you as a person. Clicks that look automated are filtered out before anything is recorded.

If a creator emails you through us: we keep a record of each email sent to your address. That covers whether it was accepted for delivery, whether it was delivered or bounced, and whether you unsubscribed or reported it as spam. We use these records to stop sending to addresses that bounce or report spam, so a creator's emails go only to people who can receive them and still want them. If you click a link in one of those emails, it may pass through our email delivery provider first, so we can record which link was clicked and when. Our email provider also uses a small image to tell us when an email is opened. We keep only the total number of opens for each email, not who opened it.

3. Cookies

We use a session cookie to keep you signed in to your creator account. That is a strictly necessary cookie. We do not use advertising or cross-site tracking cookies. Viewing a public creator page does not require you to accept anything.

4. Visits to our own marketing pages

On our own marketing pages, the ones describing and selling Nexxusbio, we count visits using Vercel Analytics. It sets no cookies and does not build a profile of you or follow you across other sites. We use it to see which pages people find useful. It does not run on creator pages, so visiting someone's Nexxusbio page is not counted this way.

5. Why we handle it

• To provide the service and publish your page, which is performance of our contract with you.
• To keep the service secure and prevent abuse, which is our legitimate interest.
• To take payment for Pro, which is performance of that contract.
• To send a creator's subscribers email, which rests on the consent you gave that creator.
• To keep that email working properly, for example by stopping email to addresses that bounce or report it as spam, which is our legitimate interest.

6. Subscriber lists belong to the creator

When you give your email to a creator through their page, that creator decides how it is used. They are responsible for their own list and for honouring your choices. We store it on their behalf. If you want to be removed, contact the creator directly, or contact us and we will pass the request on.

7. Who else processes it

We share personal data only with the providers we need to run the service, and only for that purpose. We do not sell personal data, and we do not share it with advertisers. Those providers currently handle hosting and content delivery, our database and authentication, payment processing for Pro subscriptions, email delivery, and the cookieless visit counting described in section 4. Each acts on our instructions under contract.

We may disclose data where the law requires it, or where it is necessary to investigate a serious breach of our terms.

8. Where it is held

Our providers operate internationally, so your data may be processed outside your country, including in the United States. Where data leaves the UK or EEA we rely on appropriate safeguards for that transfer.

9. How long we keep it

We keep your account data for as long as your account is open. If you close it, we delete or anonymise your personal data within a reasonable period, except where we must keep records longer, for example billing records for tax purposes. Subscriber addresses are kept until the creator removes them from their list in Horizon Studio, or the account is closed. If you want your address off a creator's list, ask the creator, or contact us and we will pass the request on.

10. Your rights

Depending on where you live, you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. If you are in California, you can ask what categories of personal information we have collected and request deletion; we do not sell or share personal information as those terms are defined there.

To exercise any of these, email info@automatehorizon.com. You also have the right to complain to your local data protection authority.

11. Security

Passwords are hashed. Traffic is encrypted in transit. Access to production data is restricted to the people who need it. Sensitive link destinations are resolved on our servers and are never written into a page's HTML. No system is perfectly secure, and we do not claim otherwise.

12. Children

The service is for adults. You must be 18 or over to hold an account. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes

If we change how we handle personal data we will update this page and change the date at the top. Where a change is significant we will tell account holders directly.

14. Contact

info@automatehorizon.com or +1 (865) 658 8656.