Privacy Policy

1. Who is responsible for your data?

NASHEX LTD is the data controller for the Nashex service. We are a company registered in England and Wales under company number 16497234. Our registered-office details are listed on the Company Information page.

For privacy questions, rights requests, or complaints, email nashexbusiness@gmail.com.

2. The information we use

• Account data: email address, display name, authentication status, account plan, discount requests, and your age band (13–15, 16–17, or 18+). Your full date of birth is used to calculate the band during the age check and is not stored. Users under 18 are asked to repeat the age check periodically so the band remains accurate.
• Profile and education data: optional profile photo, LinkedIn link, institutions, course, education stage, grades, targets, and study preferences.
• Learning activity: modules, lectures, questions, answers, scores, flashcard confidence, mock-exam performance, study time, progress, and generated notes.
• Your content: files, pasted text, slides, lecture notes, assignments, rubrics, prompts, tutor conversations, and feedback outputs.
• Payment data: Stripe customer and subscription identifiers, plan, payment status, invoice identifiers, and cancellation dates. For an under-18 Premium purchase, we also record the adult-purchase confirmation, age band, plan interval, and time. Nashex does not receive or store full card numbers.
• Technical and security data: IP address, browser/device information, session data, request logs, anti-bot results, and records needed to prevent misuse.
• Communications: support, privacy, refund, and account-related messages.
• Campus Chat: the university email and domain used for one-time eligibility verification, the university and course rooms you join, messages you choose to post, and private safety reports. Your university email is not shown to other students.
• Nashex Library: resources you deliberately choose to publish, their university and module metadata, version history, contributor name or pseudonym, optional public university, ratings, saves, downloads, imports, and private moderation reports. Your private source is not published automatically.

3. Why we use it and our lawful bases

• To perform our contract: create and secure your account; store your chosen learning material; deliver quizzes, tutors, notes, flashcards, feedback, progress tools, and paid features; operate the voluntary Nashex Library and create the private module copies you request; verify eligibility for Campus Chat; deliver university and course discussions you choose to join; and manage subscriptions.
• For our legitimate interests: provide support, understand feature reliability and cost, improve the service, stop fraud and abuse, investigate faults, and keep Nashex secure. We balance these interests against your rights.
• To meet legal obligations: retain tax and accounting records, respond to lawful requests, and protect consumer and data-protection rights.
• With consent where required: for optional uses that the law requires us to make genuinely optional. You may withdraw consent at any time without affecting earlier lawful processing.

Nashex does not currently use your information for third-party advertising or sell personal information.

4. AI processing and academic content

When you use an AI feature, Nashex sends the information reasonably needed to fulfil your request—such as your prompt, selected source extracts, assignment, rubric, or prior conversation—to its AI service provider. Do not upload confidential third-party information that you are not permitted to process.

For Assignment Feedback, the original uploaded file is removed after its text is privately extracted. Nashex keeps the extracted essay text, examiner report, marking settings, and linked revisions in your account so it can highlight passages and compare an improved draft with earlier feedback.

The Nashex AI Checker analyses sentence rhythm, paragraph structure, repetition, lexical variation, and formulaic language inside Nashex. It does not send the essay to an external detection company or add it to a shared essay database. Its experimental percentage is a writing-pattern indicator, not proof of who wrote the work.

Predicted grades, marks, explanations, and recommendations are automated educational support. They are not official university, school, examiner, or admissions decisions. Nashex does not make decisions that produce legal or similarly significant effects about you.

Nashex uses your answers and study activity to personalise revision and identify topics to practise. This learning personalisation is a core educational feature, not advertising. It is designed to support the learner's best interests and is not used to market products to children.

5. Who receives information?

We share only what is necessary with service providers acting for us or operating a feature you choose:

• Supabase: authentication, database, and private file storage.
• OpenAI: AI generation, embeddings, and web-enabled tutor requests where you select that mode.
• Stripe: checkout, subscriptions, invoices, payment methods, fraud prevention, and the billing portal.
• Cloudflare and OpenAI Sites: hosting, content delivery, security, and Cloudflare Turnstile anti-bot checks.
• Google/YouTube: video search and embedded video playback when you use Video Tutor. Google may receive device and network data when a video loads.
• Resend: transactional account and administrative email.

We may also disclose information to professional advisers, regulators, law enforcement, courts, or a successor to the business when lawfully necessary. We do not give universities or lecturers access to your account unless you ask us to or the law requires it.

If you use Campus Chat, your display name, optional profile image, message, and posting time are visible to other students verified for the same university. Course-room messages are visible only to verified students who join that room. Your university email is used for access control and is not displayed in the discussion.

6. Children and high-privacy defaults

Nashex is for users aged 13 and over. We apply protective defaults to everyone: profiles and uploaded work are private, there are no targeted adverts, we do not use precise geolocation, and we do not sell personal information. Private league sharing happens only when a user actively creates or joins a league using a code.

Campus Chat is optional. It separates communities by verified university email domain, keeps university email addresses private, makes course rooms opt-in, and provides message reporting. Chat messages are not private study records: they are intentionally shared with the verified community described before a user posts.

Users aged 13–17 receive a shorter Privacy for Young People explanation. An adult must authorise and complete a Premium purchase for an under-18 account. A parent or guardian does not automatically receive access to the learner's study content.

7. International transfers

Some providers may process information outside the United Kingdom. Where UK data-protection law requires it, we rely on an adequacy regulation or approved contractual safeguards, together with additional security measures where appropriate. Contact us for more information about the safeguard used for a particular transfer.

8. How long we keep information

• Account, profile, and study records: while your account is active. Active copies are deleted when you delete the relevant item or account, subject to the exceptions below.
• Uploaded learning material: until you delete the material, its module, or your account.
• Library publications: while you keep the listing active. Withdrawing a listing removes it from discovery and public contributor pages, but version and moderation records may be kept where reasonably needed for safety, copyright, dispute handling, or legal compliance. A separate copy already imported by another student remains in that student's private module with source provenance.
• Assignment Feedback drafts and reports: extracted essay text, marking settings, feedback, and revision comparisons are kept while your account is active. The temporary source file used for marking is removed after extraction.
• AI conversations and generated learning history: while your account is active or until the relevant feature lets you delete it.
• Campus Chat verification and messages: while your account is active. Safety reports and the message needed to review them may be kept for up to two years after the case is closed, or longer where needed to protect users or comply with law.
• Billing, transaction, tax, and accounting records: normally six years from the end of the relevant financial year, or longer when a legal claim or obligation requires it.
• Security and operational logs: normally up to 12 months, longer only when needed to investigate an incident, enforce rights, or comply with law.
• Support, refund, and rights correspondence: normally up to two years after the matter is closed, unless it forms part of a financial or legal record.

Deleted data may remain in isolated backups until overwritten on a provider's normal backup cycle. We do not use deleted backup data for ordinary product activity.

9. Security

Nashex uses access controls, private storage, encrypted network connections, row-level database controls, email verification, anti-bot checks, and restricted administrative access. No online service can promise absolute security. Use a unique password and contact us immediately if you believe your account has been compromised.

10. Your data-protection rights

Depending on the circumstances, UK data-protection law gives you rights to be informed; access your information; correct it; erase it; restrict or object to processing; receive portable data; and complain about automated decision-making. You may also withdraw consent where processing relies on consent.

Email nashexbusiness@gmail.com to exercise a right. We may need to verify your identity and normally respond within one month. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to resolve the issue first.

A young person can contact us and exercise their own rights. A parent or guardian may help, but we will consider the young person's privacy and verify authority before disclosing account information.

11. Cookies and similar storage

Nashex currently uses essential browser storage and cookies for authentication, security, preferences such as “keep me signed in,” and Turnstile anti-bot protection. These are needed to provide the service you request. We do not currently use advertising cookies. If this changes, we will update this policy and request consent where required.

12. Changes

We may update this policy when the product, providers, or law changes. Material changes will be highlighted in the service and may require renewed acceptance before you continue.