Privacy Policy

This policy explains how NEXORA SASU (“Nexora”, “we”) processes personal data in connection with the website stixflow.com and the StixFlow software. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act of 6 January 1978.

1. Who is responsible for your data

The controller is NEXORA SASU, RCS Bernay 102 944 022, 195 rue Pierre et Marie Curie, 27310 Bourg-Achard, France. For any question about your data or to exercise your rights, write to [email protected].

Nexora acts in two different capacities:

Capacity	Whose data	What it means
Controller	Site visitors, prospects, merchants’ users, legal representatives and beneficial owners	Nexora decides why and how the data is processed. This policy applies in full.
Processor	End customers of merchants (buyers)	Nexora processes the data on the merchant’s instructions. The merchant is the controller and its own privacy policy applies. See the Data Processing Agreement.
Controller, to a limited extent	End customers of merchants	Nexora processes technical and transaction data for its own purposes of platform security, fraud prevention and compliance with its legal obligations (section 3).

If you are a buyer, the merchant named on the payment page is your first contact for any request about your order or your data. The payment service provider that processes the payment is a separate controller for the payment data it handles.

2. Data we collect

Category	Data	Source
Account	Name, business email, password (stored hashed), language, account settings	You
Business verification	Company details, registration and tax numbers, website, activity, bank details; identity, date of birth, address, role and ownership of legal representatives and beneficial owners; supporting documents	You, your company, public registers, the payment service provider
Contract and signature	Signatory name and title, verified email, one-time code events, IP address, browser, timestamps, document fingerprint	You, automatically
Billing	Plan, invoices, platform fees, payment history	Your use of the service
Transactions	Order and payment data: amount, currency, status, payment method type, last four digits and brand of a card as returned by the payment service provider, refunds, disputes	The merchant, the payment service provider
End customer contact data	Name, email, billing or delivery address and any field the merchant chooses to collect	The buyer, the merchant
Technical and security	IP address, device and browser, logs, API request metadata, risk signals	Automatically
Communications	Messages sent through the contact sales form, emails and support requests	You

We do not store full card numbers or card security codes. They are entered in fields controlled by the payment service provider. We do not intentionally process special categories of data within the meaning of Article 9 GDPR.

Where data is requested through a form, mandatory fields are indicated. Without them we cannot open an account, verify a business, sign the contract or answer a request.

3. Purposes and legal bases

Purpose	Legal basis (Article 6 GDPR)
Creating and managing accounts, providing the software, the test environment and support	Performance of the contract, or steps taken at your request before a contract
Business verification, identification of representatives and beneficial owners, transmission to the payment service provider	Performance of the contract; legal obligations of the payment service provider and legitimate interest in knowing who uses the platform
Electronic signature of the Merchant Agreement and keeping evidence of it	Performance of the contract; legitimate interest in being able to prove the agreement
Invoicing, accounting and recovery	Performance of the contract; legal obligation
Security of the platform, logging, prevention and detection of fraud and abuse, including automated screening of payments	Legitimate interest in protecting the platform, merchants and buyers
Handling refunds, disputes and chargebacks	Performance of the contract; legitimate interest
Answering contact and sales requests	Steps taken at your request before a contract; legitimate interest in developing our business
Service emails: security, changes to terms, operational notices	Performance of the contract; legal obligation
Aggregated statistics and improvement of the service	Legitimate interest in improving the software
Responding to authorities, establishing and defending legal claims	Legal obligation; legitimate interest

Where we rely on legitimate interest, we have balanced it against your rights. You may object at any time (section 8). We do not sell personal data and do not use it for third-party advertising.

4. Automated fraud screening

When a merchant has turned on the Shield tool, each payment is screened automatically before it is authorized, from technical and transaction signals, with the payment service provider’s fraud detection. A payment may be approved, subjected to additional authentication or declined. This processing is carried out to prevent fraud. If a payment is refused, the buyer may contact the merchant, which can review the situation with human intervention, and may write to [email protected] to express their point of view.

5. Who receives your data

• Nexora staff who need the data for their duties, under a confidentiality obligation.
• Nexora group companies: Nexora Financial Technologies Limited (Ireland) and Nexora Financial Technologies, LLC (United States), for operating, supporting and administering the service.
• Payment service providers: Stripe, through the Stripe entity applicable to the merchant’s country, for business verification, payment processing, refunds and disputes. Stripe acts as a separate controller for part of this processing, under its own privacy policy.
• Card networks, banks and issuers, through the payment service provider, to execute payments and handle disputes.
• Hosting provider: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, which hosts the platform in the European Union.
• The merchant, for the data of its own buyers and transactions.
• Professional advisers and authorities, where the law requires it or to establish or defend legal claims.
• A successor, in the event of a merger, acquisition or transfer of business, subject to the same safeguards.

The sign-in pages and merchant storefronts load typefaces from Google Fonts. When they are displayed, your browser sends your IP address to Google Ireland Limited.

6. Transfers outside the European Economic Area

The platform is hosted in the European Union. Some recipients are located outside the European Economic Area, in particular in the United States (Nexora Financial Technologies, LLC, and entities of the payment service provider). These transfers rely on an adequacy decision of the European Commission where one applies, including the EU-U.S. Data Privacy Framework for certified recipients, or on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, with additional measures where necessary. You may obtain a copy of the safeguards by writing to [email protected].

7. How long we keep data

Data	Retention
Account data	For the life of the account, then five (5) years in archive for evidence purposes
Test-only accounts that are inactive	Deleted or anonymised after three (3) years without sign-in
Business verification data	For the business relationship, then five (5) years
Signed Merchant Agreement and its evidence file	For the term of the agreement, then ten (10) years
Invoices and accounting records	Ten (10) years from the end of the financial year
Transaction records	Five (5) years from the transaction, or longer while a dispute or investigation is pending
End customer data processed for a merchant	As instructed by the merchant and under the Data Processing Agreement
Contact and sales requests	Three (3) years from the last contact
Security and technical logs	Twelve (12) months

At the end of these periods the data is deleted or anonymised, unless a longer period is required by law or needed to establish or defend a legal claim.

8. Your rights

Under the conditions set by the GDPR, you have the right to:

• access your data and obtain a copy;
• have inaccurate or incomplete data rectified;
• have your data erased;
• have the processing restricted;
• object to processing based on legitimate interest, on grounds relating to your situation, and object at any time to commercial prospecting;
• receive the data you provided in a portable format, where the processing is based on contract or consent;
• withdraw consent at any time, where processing is based on it;
• give instructions on what happens to your data after your death.

To exercise these rights, write to [email protected]. We may ask for information needed to confirm your identity. We reply within one month, which may be extended by two months for complex requests.

If you are a buyer and your request concerns data processed on behalf of a merchant, we pass it on to that merchant, which is responsible for answering it.

You may also lodge a complaint with the supervisory authority of your country. In France this is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashing of passwords, restricted access, logging and separation of the test and production environments. They are described on the Security page. If a breach is likely to result in a high risk to your rights and freedoms, we inform you as the law requires.

10. Cookies

The site uses only cookies that are strictly necessary for it to work and for payments to be secure. They are listed in the Cookie Policy.

11. Minors

The software is intended for businesses. We do not knowingly collect data about minors. If you believe a minor has given us data, write to [email protected].

12. Changes to this policy

We may update this policy to reflect changes in our processing or in the law. The date of the current version is shown at the top of this page. Where a change is significant, we inform account holders by email or in the dashboard before it takes effect.