Privacy Policy
Effective: 7 October 2026 · Last updated: 7 October 2026
This Privacy Policy explains what personal data OrgNexuz (at www.orgnexuz.com) collects, why we collect it, who we share it with, how long we keep it, and the choices you have. OrgNexuz is operated by JustServicesPro Management and Consulting Ltd. (RC: 7965265), JMCL Offices, Maitama Ext., Abuja, Nigeria. It covers our website, the OrgNexuz app and its suites (Core, People, PeopleOps, Flow, Docs, Veri-ID, Connect, Control and Intelligence), and the LeadFlo (CRM) and CertTrack (training) apps when you reach them through OrgNexuz.
Summary
- What we collect
- Account details (name, email, password), organization details, the people and HR records organizations store, files, messages, payment records, and basic usage data.
- Google and LinkedIn sign-in
- Only your name, email address and profile picture (scopes: openid, email, profile). Used solely to create and sign you in to your account.
- What we do not do
- We do not sell personal data, we do not show third-party ads, and we do not read your Gmail, contacts, files or any other Google or LinkedIn data.
- Who we share with
- Only the service providers that run OrgNexuz: Supabase, Vercel, Flutterwave and our email delivery provider.
- Your control
- You can ask to access, correct, export or delete your data at any time: support@orgnexuz.com. See our data deletion page.
1. Who is responsible for your data
OrgNexuz is used by organizations such as companies, churches, schools, associations, NGOs and alumni networks. For the people, staff, member, student, applicant and customer records an organization keeps in OrgNexuz, the organization is the data controller and we are its data processor, acting on its instructions. For account, sign-in, billing, security and support data, we are the data controller. If an organization holds your records, send privacy requests to that organization first. We will help it respond.
2. What we collect
We collect data in three ways: what you give us, what is created when you use the service, and what a sign-in provider sends us when you choose it.
You give us: your name, email address and password when you create an account; your organization’s name, type, size and country; the people, HR, document, message and CRM data you or your organization enter; payment details you submit for bank transfers; and anything you send to support.
Collected automatically: pages viewed, referrer and campaign tags, approximate location (country, region and city derived from your connection by our host), browser type, a random visitor ID stored in a cookie, and error and security logs. We do not store your full IP address in our analytics.
From sign-in providers: if you choose Google or LinkedIn, your name, email address and profile picture (see section 3).
| Category | What | Why | Shared with | Kept |
|---|---|---|---|---|
| Account | Full name, email address, password (stored only as a salted hash), profile photo, username, sign-in method | Create and secure your account, sign you in, contact you about the service | Supabase (authentication), email provider | Until you delete your account |
| Google / LinkedIn sign-in | Name, email address, profile picture, provider account ID | Create your account and sign you in. Nothing else. | Supabase (authentication) | Until you delete your account or disconnect |
| Organization | Organization name, type, size band, country, branding, structure (branches, departments, units), roles and permissions | Set up and run your organization space | Supabase, Vercel | Until the organization is deleted |
| Launch notification | Email address you enter on our front page to be told when OrgNexuz launches | Send one launch announcement email; nothing else | Supabase (storage), email provider | Until the launch email is sent, or until you ask us to remove it |
| People and HR records | Names, contact details, relationships (staff, member, student, applicant…), staff and member numbers, reporting lines, employment, leave, salary and increment records, letters, applications, guarantor details | Provide the People, PeopleOps, Flow and Docs suites on the organization’s instructions | Supabase, Vercel | As the organization decides; history is kept on purpose |
| Files and documents | CVs, certificates, identity and guarantor documents, contracts, logos, attachments | Store documents for the organization | Supabase Storage (private buckets) | Until deleted by the organization |
| ID and verification | ID card details, QR tokens, verification checks (time, result, approximate place) | Issue ID cards and show a safe public verification result | Supabase, Vercel | While the credential exists, then as the organization decides |
| Communications | Posts, comments, reactions, direct and group messages, announcements, directives and acknowledgements, event RSVPs | Provide the Connect suite | Supabase | Until deleted by the author or the organization |
| Billing | Plan, currency, billing period, amount, payment status and references; bank-transfer details and receipts you submit. Card numbers are handled by Flutterwave and never reach us. | Take payment, issue receipts, meet accounting duties | Flutterwave (payments), Supabase | As required for accounting and tax records |
| Usage and device | Pages viewed, referrer and campaign tags, approximate location (country, region, city from your connection), browser/user agent, a random visitor ID, error logs | Run, secure and improve the service; measure traffic | Supabase, Vercel | Rolling retention for analytics and security logs |
| Support | Messages you send to support@orgnexuz.com and their attachments | Answer your request and improve support | Email provider | While needed to resolve the request, then deleted or archived |
3. Google and LinkedIn user data
When you choose Continue with Google, OrgNexuz requests only the basic sign-in scopes openid, email and profile. Google gives us your name, email address, profile picture and a Google account identifier. When you choose Continue with LinkedIn, we request openid, profile and email and receive the same kinds of information.
- How we use it: only to create your OrgNexuz account, sign you in, show your name and photo to people in your organization, and send you account and service emails.
- What we do not do: we do not access your Gmail, Google Drive, Calendar, Contacts or any other Google or LinkedIn data. We do not use it for advertising, we do not sell it, and we do not transfer it to others except the service providers in section 7 who help us run OrgNexuz.
- Who can see it: our staff do not read it except where needed for security, to give you support you asked for, or to comply with the law.
- Google API Services User Data Policy: OrgNexuz’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Disconnect or delete: you can remove OrgNexuz’s access from your Google or LinkedIn account settings at any time, and ask us to delete your account and the data we hold (see section 9 and our data deletion page).
4. How we use data and why
We use personal data to: provide the suites you use; create and secure accounts; apply permissions and keep an audit trail; send service messages such as invitations, approvals, receipts and security alerts; take payment and prevent fraud; give support; measure and improve the product; and meet legal obligations. Under the Nigeria Data Protection Act 2023 (NDPA) our lawful bases are performing our contract with you or your organization, our legitimate interests in running and securing the service, your consent where we ask for it, and legal obligation. We do not sell personal data and we do not use your organization’s records to advertise to you.
5. Sensitive and HR data
Salary, disciplinary, identity-document and other confidential HR records are protected by stricter permissions than ordinary profile data. Access is limited to people an organization has authorized, important changes are written to an audit trail that cannot be edited, files are kept in private storage and opened through short-lived links, and access to restricted documents is logged. Organizations decide who holds these permissions; we recommend as few people as possible.
6. Public ID verification
When someone scans an OrgNexuz ID card, the verification page shows only the person’s name, photo, status (valid, expired, revoked or suspended) and organization. It never shows HR, salary, contact or document data. Each check is recorded with its time, result and approximate place.
7. Who we share data with
We share data only as needed to run OrgNexuz, with service providers that process it on our instructions:
- Supabase: database, authentication and file storage.
- Vercel: hosting and delivery of the website and app.
- Flutterwave: card and bank payment processing for subscriptions.
- Our email delivery provider: sending account and service emails from support@orgnexuz.com.
- Google and LinkedIn: only when you choose to sign in with them.
Every organization’s data is kept separate from every other organization’s, and members only see the organizations they belong to. We may disclose data to comply with law or a valid legal request, to enforce our terms, or to protect people and our service. If our business is reorganized or sold, data may transfer to the successor under this policy. We do not sell personal data.
8. International transfers
Our providers may store and process data outside Nigeria. Where they do, we rely on contractual and technical safeguards intended to give your data a level of protection consistent with applicable law, including the NDPA.
9. Retention, export and deletion
We keep data while an account or organization is active. Some records are kept as history on purpose (for example employment history, financial records and audit events) because organizations need an accurate record of what happened. Billing and accounting records are kept as long as the law requires. Security and analytics logs are kept on a rolling basis. When an account is closed, or when we receive a valid request, we delete or anonymize personal data, except what we must keep for legal, accounting or security reasons. Backups are overwritten on a rolling schedule. Organization owners can export their organization’s data on paid plans.
To delete your account and data, email support@orgnexuz.com from the address on your account, or follow the steps on our data deletion page.
10. Your rights and how to use them
Under the NDPA and other applicable law you may have the right to: be told how your data is used; access your data; correct it; ask for it to be deleted or restricted; object to certain processing; receive a portable copy; withdraw consent where processing relies on consent; and not be subject to decisions made only by automated means with significant effects. You may also complain to the Nigeria Data Protection Commission. To use these rights, contact your organization or email support@orgnexuz.com. We may need to verify your identity first and will respond within the time the law requires.
11. Security
We protect data with encryption in transit (HTTPS), private file storage, database-level isolation between organizations, role and permission checks on the server, rate limiting on sensitive actions, verified webhooks, password hashing, and audit logging. No system is completely secure. If a breach affects your data we will notify the organization and, where the law requires, the authorities and affected people.
12. Cookies and local storage
We use essential cookies to keep you signed in and protect your session, and a random visitor ID cookie for first-party traffic statistics. Your browser’s local storage remembers preferences such as your chosen currency and whether you dismissed the install prompt. We do not use third-party advertising or cross-site tracking cookies. You can clear cookies and local storage in your browser at any time; the site will still work, but you will be signed out.
13. Emails we send
We send service emails (confirmation links, invitations, receipts, security alerts and approvals). Organization owners and admins may also receive product update and performance emails about their organization. All email comes from, and replies go to, support@orgnexuz.com. To stop non-essential emails, reply with “unsubscribe”.
14. Children
OrgNexuz is not directed at children under 18 and individuals cannot create accounts for themselves below that age. Organizations such as schools that keep records about minors are responsible for having the right to do so, including any parental consent the law requires. If you believe a child has given us personal data, contact us and we will delete it.
15. Changes to this policy
We may update this policy. We will post the new version here with a new date and, for material changes, notify organization owners by email.
16. Contact
Privacy and data requests: support@orgnexuz.com
JustServicesPro Management and Consulting Ltd. (RC: 7965265)
JMCL Offices, Maitama Ext., Abuja, Nigeria