Log In

Privacy Policy

Version 2026-11-10. [LEGAL REVIEW REQUIRED]

1. Who we are and our role

NEXCON is a business software service operated by [CONFIGURE COMPANY_LEGAL_NAME], [CONFIGURE COMPANY_POSTAL_ADDRESS]. Organizations ("customers") use NEXCON to manage projects, workers, time, assets and finances.

For data that a customer enters about its business and its workers, the customer is the controller and NEXCON processes that data on the customer's behalf as a service provider/processor. For data about our customers' account administrators, platform security logs and our own communications, NEXCON is the controller. If you are a worker of one of our customers, please contact your employer first for requests about your data.

2. Data we collect

  • Account data: name, work email, job function, account status, last sign-in time.
  • Authentication data: password (stored only as a salted hash by our authentication provider; never visible to anyone), multi-factor enrollment for administrators, session tokens.
  • Work records entered by your organization: projects, clients, companies, subcontractors, assets, tasks, documents, notes and, when used, wages and financial records.
  • Employee records entered by your organization: when your employer chooses to record them, date of birth and Social Security Number or ITIN (for employment and payroll purposes). The tax ID is stored encrypted, only its last 4 digits are displayed, and revealing it is limited to authorized administrators and recorded in the audit log. [LEGAL REVIEW REQUIRED]
  • Time clock records: clock-in/out and break times (recorded by our server clock), the project when your organization uses project selection, IP address, device/browser information and time zone at each punch. Your device location is required to record a punch and is captured only at the moment you punch — never continuously. Corrections made by an administrator are recorded with their reason.
  • Technical logs: IP address, browser/user agent, request times and security events (e.g., failed sign-ins), used to secure the service.
  • Cookies: strictly necessary cookies (session, security, your consent choice) and a theme preference cookie when you change the theme. See the Cookie Policy.
  • Communications: emails we send for account security and service notifications, and support requests you send us.

We do not collect bank account details or biometric data, and we do not use analytics, advertising pixels or session recording.

3. Purposes and legal bases

  • Providing the service under our contract with your organization (performance of contract; for workers, your employer's legitimate interests or legal obligations).
  • Security, fraud and abuse prevention, including rate limiting and audit logs (legitimate interests; legal obligations).
  • Time and attendance and job costing as configured by your employer (employer's legal obligations and legitimate interests).
  • Transactional emails (performance of contract). We do not send marketing emails.
  • Compliance with law and responding to lawful requests (legal obligation).

[LEGAL REVIEW REQUIRED] Confirm legal bases per applicable law (U.S. state privacy laws; LGPD/GDPR where applicable).

4. Service providers (processors)

  • Vercel Inc. — application hosting.
  • Supabase Inc. — database, authentication, file storage and realtime messaging.
  • Cloudflare, Inc. — bot protection (Turnstile) on sign-in and password-reset forms.
  • Email delivery provider — transactional email. [LEGAL REVIEW REQUIRED] (name the provider once selected)

We do not sell personal information and we do not share it for cross-context behavioral advertising.

5. International transfers

Data is hosted in the United States. [LEGAL REVIEW REQUIRED] Describe transfer safeguards if customers or workers are located outside the U.S.

6. Retention

  • Time records and payroll-related labor data: at least 3 years after the record date.
  • Financial records and audit logs: at least 7 years.
  • Security logs: 1 year. Punch location coordinates: 1 year, after which coordinates are removed and only the time record remains.
  • After an organization closes its account, its data is deleted after the contractual retention period.

[LEGAL REVIEW REQUIRED]

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal data, and to object to or restrict certain processing. Workers should contact their employer (the controller). Customers and other individuals can contact us at [CONFIGURE PRIVACY_CONTACT_EMAIL]. We will not discriminate against you for exercising your rights.

8. Security

We use encryption in transit, strict per-organization data isolation enforced in the database, role-based permissions, multi-factor authentication for platform administrators, rate limiting and append-only audit logs. No system is perfectly secure; we will notify affected parties of incidents as required by law.

9. Children

NEXCON is a workplace tool and is not intended for anyone under 18. User accounts may only be created for people at least 18 years old.

10. Changes and contact

We will post updates here and ask signed-in users to acknowledge material changes. Questions: [CONFIGURE PRIVACY_CONTACT_EMAIL].