Privacy Policy

Last updated: July 7, 2026

This policy explains what Comley Creative ("we," "us") collects when you use Nexus ("the Service") and what we do with it. The short version: we collect what's needed to run a website platform, we don't sell your data, and the analytics we give you about your sites are cookieless and don't identify your visitors.

1. What we collect from account holders

• Account information — name, email, and profile details, managed through our sign-in provider (Clerk).
• Workspace content — the pages, media, forms, and settings you create, stored so we can host and serve your sites (Supabase, Vercel).
• Billing information — handled by Stripe. We store your subscription status and plan; we never see or store card numbers.
• Usage and logs — standard technical logs (requests, errors) used to keep the Service secure and working.
• API keys you connect — if you connect your own AI provider keys, they're encrypted at rest and used only to make the requests you initiate.

2. What we collect about your sites' visitors

Published sites include our built-in analytics, which counts page views per page per day. It uses no cookies, no fingerprinting, and no visitor identifiers — we can tell you a page got 40 views yesterday, not who viewed it. If you add your own analytics snippets (e.g. Google Analytics) to your site, that's your integration and your responsibility to disclose to your visitors.

If your site collects form submissions, those submissions (e.g. a visitor's name, email, and message) are stored in your workspace's Forms inbox for you. You're the controller of that data; we process it on your behalf.

3. What we do with it

• Provide, secure, and improve the Service.
• Send transactional email (form notifications, billing receipts, invitations) via Resend.
• Process AI feature requests through the model provider (e.g. Anthropic) — only the content you submit to the feature, only to provide the feature.
• Comply with legal obligations.

We do not sell personal information, and we don't use your content or your visitors' data for advertising.

4. Who we share it with

Only the service providers needed to run the platform: Clerk (authentication), Stripe (payments), Supabase (database and storage), Vercel (hosting and CDN), Resend (email), and Anthropic (AI features). Each processes data only to provide their service to us. We may disclose information if required by law.

5. Retention and deletion

Workspace content is kept while your workspace is active. If you delete your workspace or account, we delete the associated content within a reasonable period, except minimal records we're legally required to keep (e.g. billing records). You can export your workspace data at any time.

6. Security

Data is encrypted in transit (TLS) and at rest at our providers; connected API keys get an additional layer of application-level encryption. No system is perfectly secure — if we learn of a breach affecting your data, we'll notify you promptly.

7. Your rights

Depending on where you live (e.g. EU/UK GDPR, California CPRA), you may have rights to access, correct, export, or delete your personal information. Email us and we'll honor them: hello@comleycreative.com.

8. Children

The Service isn't directed at children under 13 (or under 16 in the EU) and we don't knowingly collect their data.

9. Changes

We'll post updates here and note the date above; for material changes we'll notify account holders before they take effect.