Privacy Policy

Last updated: 28 September 2026

This privacy policy explains how nexsource ("we", "us") collects, uses, stores and protects personal data when you visit getnexsource.com and use the nexsource application at app.getnexsource.com. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data controller

Maximilian Budziat
Grüner Brink 14
37603 Holzminden, Germany
Email: info@getnexsource.com

2. What we collect

Account data

When you create an account we store your email address, a securely hashed password (using a modern password hashing function), your organization name and the date of registration. We never store your password in plain text.

Application data

Within nexsource you store data about your suppliers — contacts, addresses, contracts, certificates, materials, documents and notes. This data belongs to you. It is scoped to your organization and is not used by us for any purpose other than providing the service.

Payment data

Subscriptions are processed by Stripe Payments Europe, Ltd. (Ireland). We never see or store your full payment card details. We only store the Stripe customer ID, subscription status and plan tier required to operate the billing.

Checks on supplier data

To check your suppliers we compare their names with the public sanctions lists of the EU, the United Nations and the US Treasury (OFAC), and validate stored VAT identification numbers through the European Commission's VIES system, which means the VAT ID is transmitted to the European Commission. The legal basis is the performance of our contract (Art. 6 para. 1 lit. b GDPR).

Signup source and emails during the trial

If the link you sign up through contains campaign parameters (e.g. utm_source), we store them with your organization to understand which channels bring interested companies to us. No cookies are set for this. The legal basis is our legitimate interest in evaluating our marketing channels (Art. 6 para. 1 lit. f GDPR). During the free trial we send you a few emails with tips on using the product and on the end of the trial (Art. 6 para. 1 lit. b GDPR). If you do not want to receive them, a short reply to one of these emails is enough.

Free sanctions check on the website

When you use the free sanctions check on our website, we transmit the name you enter to our server, compare it with the public sanctions lists and show you the result. The name you enter is not stored. To prevent abuse, use is limited to five checks per day; for this we store a non-reversible hash derived from your IP address together with a counter and delete it after two days at the latest. The legal basis is our legitimate interest in an abuse-protected service (Art. 6 para. 1 lit. f GDPR).

Technical data

When you visit our website or use the application we automatically receive technical information that is necessary to deliver the service: IP address, browser type, request timestamps and basic error logs. This data is processed on the basis of our legitimate interest in operating a secure, functional service (Art. 6 para. 1 lit. f GDPR).

3. Cookies and session storage

The application uses a strictly necessary session cookie (HttpOnly, Secure) to keep you signed in. We do not use third-party analytics or advertising cookies on the marketing site.

4. Processors and infrastructure

nexsource relies on the following processors to deliver the service:

• Cloudflare, Inc. — application hosting, database (D1) and file storage (R2), within the EU where available.
• Stripe Payments Europe, Ltd. — subscription billing and payment processing.
• Amazon Web Services, Inc. (SES) — transactional email delivery (verification, password reset, receipts).

Data processing agreements (Art. 28 GDPR) are in place with each processor.

5. International transfers

Where personal data is transferred outside the EU/EEA — in particular to providers based in the United States — such transfers are based on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

6. Retention

We retain your account data and content for as long as your account is active. Upon account deletion, content is removed within 30 days, except where we are required to retain certain data for legal or accounting reasons (typically up to 10 years for invoices).

7. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• request rectification (Art. 16) or erasure (Art. 17);
• request restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing (Art. 21);
• lodge a complaint with a supervisory authority.

To exercise these rights, contact us at info@getnexsource.com.

8. Security

All connections are encrypted via TLS. Passwords are hashed using a modern key-derivation function. Files are stored in a private bucket and delivered only via short-lived, signed URLs scoped to your organization.

9. Changes

We may update this policy. The current version is always available at /privacy.html. Material changes will be communicated through the application or via email.