Privacy Policy

This Privacy Policy explains how Nexaji LTD ("Nexaji," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Rinko Hub website, early-access registration, and hosted dashboard (together, the "Service"). If you do not agree with this policy, please do not use the Service.

1. Who we are

Rinko Hub is a hosted platform built on top of a distributed, content-addressed version-control protocol. This policy covers the hosted web platform — registration, dashboard, and related services. It does not cover the underlying open protocol itself, which does not, by design, transmit your data to us unless you use our hosted Service.

The data controller responsible for the data described in this policy is:

Nexaji LTD
Contact: contact@nexaji.com

2. Scope

This policy applies to visitors to our marketing site, people who register interest in early access, invited users who access the dashboard using an invite code, and anyone else whose data we process in connection with operating the Service. It does not apply to source code, repository content, or version-control data exchanged peer-to-peer by users of the underlying Nexa protocol outside of our hosted infrastructure — that is out of scope for this early-access phase, since there is no live protocol wiring into the hosted web app yet.

3. Information we collect

3.1 Information you provide directly

• Registration / interest data — your email address and any other signup fields we ask for, collected when you register interest in early access. Registering itself is a data-collection event: submitting the form sends this information to us and to the backend providers described in Section 6, even if you're never issued an invite code.
• Account data — name, email, authentication identifiers, and password (or SSO identity attributes), collected when an invited user creates a dashboard account via our authentication provider.
• Invite code data — the one-time code issued to you and its redemption status.
• Communications — anything you send us directly (support requests, feedback, replies to our emails).
• Profile / organization data — profile details and organization/workspace information you add once you have dashboard access.

3.2 Information collected automatically

We use PostHog for product analytics — to understand how the Service is used, find and fix bugs, and improve the product. Through PostHog we collect usage data (pages and features viewed, actions taken, session duration), device and browser data (browser/OS, device type, screen size, language), log and network data (IP address, coarse IP-derived location at city/region level, timestamps, request metadata), and — on surfaces where session recording is enabled — a reconstruction of on-screen interactions, with input fields such as passwords masked by default.

This data is used only for analytics, debugging, and improving Rinko Hub. We do not sell it, and we do not disclose it to any third party other than the service providers named in this policy who help us run the Service.

3.3 Information from third parties

Our authentication provider, WorkOS, returns identity attributes after you sign in (e.g., verified email, name, and SSO/organization attributes if you authenticate via a connected identity provider). We do not purchase personal information from data brokers.

4. Cookies and local storage

Rinko Hub uses strictly necessary cookies (session/authentication and CSRF-protection — required for the Service to function), analytics cookies and local storage set by PostHog (to recognize your browser across visits, group events into sessions, and power session recordings where enabled), and local storage for application state (e.g., a remembered theme), which stays on your device and is never transmitted to us. Where required by law, we present a cookie/consent option before setting non-essential cookies. You can also control cookies through your browser settings; blocking essential cookies may prevent you from signing in.

5. How and why we use information

• Operate early-access registration and issue/track invite codes.
• Create and secure dashboard accounts, and authenticate you.
• Provide, maintain, and troubleshoot the Service.
• Product analytics — understand feature usage, find and diagnose issues, and improve the Service (via PostHog).
• Respond to support requests and other communications.
• Send service and administrative communications (e.g., invite code emails, security notices, policy updates).
• Detect, investigate, and prevent fraud, abuse, or security incidents.
• Comply with legal obligations and enforce our terms.

Where GDPR applies, our legal bases are: performance of a contract or steps taken at your request prior to entering one (Art. 6(1)(b)) for registration, accounts, and providing the Service; our legitimate interest in operating, securing, and improving the Service (Art. 6(1)(f)) for analytics, fraud prevention, and administrative communications; consent (Art. 6(1)(a)) where required by local law for non-essential analytics cookies, or for optional marketing communications; and legal obligation (Art. 6(1)(c)) where applicable. We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement.

6. Who we share information with

We share personal information with the following service providers, who process it on our behalf under contractual confidentiality and data-protection obligations:

• WorkOS — authentication (sign-in, identity verification, session management). Data involved: email, name, authentication identifiers, SSO/organization attributes.
• Convex — backend application data platform (stores account and dashboard data, powers real-time backend functions).
• Supabase (Postgres) — backend relational database hosting for account, dashboard, and registration data.
• PostHog — product analytics: usage events, device/browser metadata, coarse IP-derived location, and, where enabled, session recordings, used only for analytics, debugging, and improving the Service.

We do not sell personal information, and we do not disclose it to any other party beyond the providers listed above, except: with professional advisors (lawyers, auditors, accountants) under confidentiality obligations; with a successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality commitments; with law enforcement or regulators where required by law, to protect our rights, or to protect the safety of any person; or with your consent or at your direction. This subprocessor list reflects current vendors as of the "Last updated" date above and may change as the product evolves; material changes will be reflected here.

7. International data transfers

We and our service providers (WorkOS, Convex, Supabase, PostHog) may process and store information in the United States and other countries outside your own, including outside the European Economic Area (EEA) and United Kingdom. Where we transfer personal information from the EEA/UK to a country not deemed adequate by the European Commission or UK authorities, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), or another valid transfer mechanism required by GDPR Chapter V / UK GDPR. Contact us at contact@nexaji.com for more information about these safeguards.

8. Data retention

We retain personal information only as long as necessary for the purposes described in this policy: to provide the Service and maintain your account while it remains active; to maintain early-access registration records for individuals not yet (or never) invited, so we can manage the rollout and contact you when access opens; to comply with legal, tax, accounting, or security obligations; and to resolve disputes and enforce our agreements. Early-access registration data not converted to an account is retained until you ask us to delete it or the program concludes for your registration, whichever is earlier. Account data is retained for the life of your account plus a limited period afterward for recovery and audit purposes. Analytics/usage event data is retained per our PostHog configuration, with session recordings (where enabled) typically retained for a shorter period than aggregate event data. Backups and logs are retained for a limited operational period and then deleted or overwritten on a rolling basis. When information is no longer needed, we delete, anonymize, or aggregate it.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, access controls, and reliance on service providers (WorkOS, Convex, Supabase, PostHog) that maintain their own security programs. No method of transmission or storage is 100% secure. If we become aware of a security incident affecting your personal information, we will notify affected individuals and/or regulators as required by applicable law.

10. Your privacy rights (GDPR / UK GDPR)

If you are located in the EEA, UK, or another jurisdiction with similar protections, you have the right to access, rectify, and erase your personal information; restrict or object to certain processing (including processing based on legitimate interests and direct marketing); receive a copy of information you provided to us in a portable format; withdraw consent at any time where processing is based on consent; and lodge a complaint with your local data protection supervisory authority (or the ICO in the UK). To exercise any of these rights, contact us at contact@nexaji.com. We may need to verify your identity before fulfilling a request.

11. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know/access the categories and specific pieces of personal information we've collected, correct inaccurate information, delete information we collected from you, and opt out of "sale" or "sharing." We do not sell personal information and do not use analytics data for cross-context behavioral advertising, so there is currently nothing to opt out of in that respect; if this ever changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism as required by law. We do not intentionally collect sensitive categories of personal information (e.g., Social Security numbers, financial account credentials) through the Service. We will not discriminate against you for exercising your privacy rights. To exercise your California rights, contact us at contact@nexaji.com.

12. Other regional rights

Depending on where you live, you may have additional or similar rights under local law (for example, other U.S. state privacy laws, or Canada's PIPEDA). Contact us at contact@nexaji.com and we will address your request under the law applicable to you.

13. Children's privacy

The Service is not directed to, and we do not knowingly collect personal information from, children under 13 (or under 16 where a higher threshold applies under local law). If you believe a child has provided us with personal information, contact us at contact@nexaji.com and we will take appropriate steps to delete it.

14. Changes to this policy

Because Rinko Hub is in active early-access development, this policy will change as we add features, onboard new service providers, or as law requires. We will update the "Last updated" date above, and for material changes we will provide additional notice (such as an email to registered users or a notice on the dashboard) before the change takes effect.

15. Contact us

Questions, requests, or complaints about this policy or our data practices can be sent to Nexaji LTD at contact@nexaji.com.