Privacy Policy

• Account data: email address, user identifiers, core authentication data, and account preferences.
• User content: notes, snippets, text fragments, links, captured CSS selectors, settings, and other content the user chooses to save or sync.
• Usage data and statistics: number of text expansions, characters saved, links used, and other aggregated productivity metrics.
• Payment data: processed exclusively by Lemon Squeezy. NexoPad does not store full credit card numbers or full banking details.
• Support information: data that the user shares when contacting us for customer support.
• Technical information: browser type, extension version, error logs, and service operation data.

• Create an account or sign in.
• Save notes, snippets, links, or selectors inside the extension.
• Sync content across devices.
• Interact with our website or dashboard at dashboard.nexopad.app.
• Make a payment or subscribe to a plan.
• Contact us for support or inquiries.
• Generate technical logs required to operate the service.

• It may detect operating-system-level keystrokes solely to identify shortcuts configured by the user.
• It may temporarily access the clipboard to insert snippets and restore it locally after injection.
• It may capture the screen only when the user explicitly activates the corresponding shortcut or command.
• It may store captures, local history, settings, and diagnostics on the user's device.
• It may query the active process name and window title locally for compatibility, app-specific rules, and security.
• It does not transmit the full stream of keys typed by the user to our servers.
• It does not capture screens or visual content unless the user explicitly requests it.

• Colombia (Law 1581 of 2012): by registering or using NexoPad, you authorize the processing of your personal data for the purposes described in this policy.
• European Union / GDPR (Regulation (EU) 2016/679): processing may rely on contractual necessity, consent, legitimate interest, and legal obligation, depending on the situation.

• HTTPS/TLS encrypted communications in transit.
• Encryption at rest through infrastructure provided by AWS/Supabase.
• Row Level Security policies in the database.
• Authentication with JWT tokens and automatic refresh.
• Optional local PIN or encryption in the browser extension.
• Signature verification for payment webhooks.

• Notify affected users by email within a reasonable period and, where applicable, within 72 hours after detecting the incident.
• Notify the Colombian Superintendence of Industry and Commerce and any other competent authority when legally required.
• Describe the nature of the incident, the categories of data affected, the measures adopted, and recommendations for users to protect their information.
• Document the incident internally, including its effects and the corrective actions implemented.

• Active account: while the user keeps an active account and uses the service.
• Account deletion: after an account deletion request, personal data and user content are removed within a maximum of 30 calendar days, unless a legal retention obligation applies.
• Trash: notes moved to the trash are automatically deleted after 30 days.
• Audit logs (TEAMS): retained for 12 months from creation for security and traceability purposes.
• Backups: backup copies that may contain user data are deleted within 90 days after account deletion.
• Billing data: retained for the period required under applicable tax law.

Colombia (Law 1581 of 2012)

• Know, update, and correct your personal data.
• Request proof of the authorization granted.
• Be informed about how your data is used.
• Request deletion of your data when appropriate.
• Revoke authorization when legally possible.
• File complaints with the Superintendence of Industry and Commerce (SIC).

European Union / EEA (GDPR)

• Access: obtain confirmation and a copy of your processed personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data when it is no longer necessary.
• Restriction: restrict processing in certain circumstances.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, without affecting prior lawful processing.
• Complaint: file a complaint with the data protection authority in your country.

• Name and identification of the data subject.
• Email associated with the account, if applicable.
• A clear description of the request or complaint.
• Supporting documents, if any.

Users in Europe (GDPR)

• Access and portability: you may request an exportable copy of the data and notes we hold about you.
• Rectification: you may update or correct inaccurate data from your control panel.
• Erasure: you may request permanent deletion of your account, note vault, and associated data from our servers.
• Objection: you may object to the processing of your data for analytics or marketing purposes.

Users in California, U.S. (CCPA)

• Right to know and delete: you have the right to know what information we collect and to request its deletion.
• No sale of information: NexoPad does not sell, rent, or trade your personal data or note content to third parties.
• Non-discrimination: we will not deny service or change its quality because you exercise your privacy rights.