Compliance

Available documentation

• Terms of Service: account, subscription, acceptable-use, and service conditions.
• Privacy Policy: Nexly’s controller activities for accounts, the website, billing, and support.
• Data Policy: SDK identifiers, event collection, IP processing, retention, and deletion behavior.
• Data Processing Agreement: processor obligations for customer analytics data.
• Subprocessors: provider names, purposes, and known processing regions.
• Security: implemented authentication, authorization, infrastructure, and monitoring controls.

Privacy model

• Nexly uses pseudonymous visitor and session identifiers; it does not claim fully anonymous analytics.
• The SDK uses localStorage or equivalent device storage rather than analytics cookies. An optional privacy mode disables all device-storage access and relies on a daily-rotating server-side visit fingerprint instead.
• Raw IP addresses are processed at ingest but are not written to the analytics database.
• Customers control custom events and are responsible for notices, lawful basis, and consent.
• Customer analytics data is not sold or used for third-party advertising profiles.

Data location and providers

Nexly's primary backend deployment is hosted by Railway in the Netherlands. Resend provides email from Ireland, and object storage uses Cloudflare's Eastern Europe location hint with global edge delivery. Vercel, Polar, Sentry, and optional LLM providers may process limited service data in provider-controlled regions.

Certifications and independent assurance

Nexly does not currently claim SOC 2, ISO 27001, or another independent security certification. It also does not claim that every use of Nexly is automatically GDPR, ePrivacy, or CCPA compliant; compliance depends on customer configuration, notices, purposes, and jurisdiction.

Vendor reviews

For a security questionnaire, data protection review, or request for additional documentation, contact mail@nexly.to. Responses are provided on a reasonable-effort basis and may require clarification about the customer’s configuration and intended use.