What data we collect

• Usage data (pageviews, timestamps) via Google Analytics — only with your explicit consent.
• Account and authentication details, such as your name, email address, profile information, and sign-in metadata.
• Project content and files you choose to submit, publish, or manage through NexCore.
• Form and support information you voluntarily submit, such as your name, email, message, and support history.
• If paid orders reopen, order, invoice, policy-consent, and payment-status metadata. NexCore does not store full card credentials.
• Technical logs related to hosting and service operation (server logs).

Why we collect data

We use data to provide accounts and project features, respond to requests, operate and secure the platform, prevent misuse, keep required service and consent records, and improve performance and accessibility. We do not sell personal data.

Legal basis

We process personal data under the laws applicable in the Sultanate of Oman, including the Personal Data Protection Law and its Executive Regulation. Depending on the activity, processing may be based on your explicit consent, your request for a service, performance of an agreement, a legal obligation, or a legitimate operational need where permitted by law. International privacy requirements, including GDPR, are followed only when they legally apply to the relevant processing.

Third-party processors

• Google LLC — Google Analytics 4 (Measurement ID: G-PYZB5L2R8W). GA is only loaded if you accept analytics cookies. We enable IP anonymization and disable ad personalization.
• Hosting provider (Vercel / static CDN) — for serving site content. Hosting logs may contain technical information (IP address, request timestamps) which are processed for security and availability.
• Supabase — for authentication, database, and file-storage functions used by the platform.
• Email and communication providers — to deliver service messages and respond to support requests.
• Payment providers, including PayPal, only if paid orders reopen and you choose that method. Their own privacy terms also apply.

Some providers may process data outside Oman. Where cross-border processing occurs, we use the provider only after considering the safeguards and requirements that apply to the transfer.

How long we keep data

We keep personal data only for a purpose-specific and proportionate period:

• Account and project data: while the account or project is active, followed by a limited period needed to complete closure, backup rotation, recovery, or a lawful request.
• Order and consent records: for the period required to meet accounting, tax, dispute, and legal-record obligations.
• Support messages: while the request is open and for a limited follow-up period.
• Security and technical logs: for the period reasonably needed to investigate incidents, maintain availability, and prevent misuse.

When data is no longer required, we delete it or anonymize it. A legal obligation, active dispute, security investigation, or backup cycle may require limited retention after an account or service ends.

Your privacy rights

• Access: Request a copy of any personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure or restriction: Request deletion or restriction where we do not have another lawful reason to retain or process the data.
• Portability: Request your data in a usable format where this right applies.
• Withdraw consent: You can withdraw consent for analytics at any time using the cookie banner or by visiting this page and using the button below.

If you wish to exercise a right or make a privacy complaint, contact our privacy contact at nexcorelabs@outlook.com. Please provide enough information to verify the request without sending unnecessary sensitive data. You may also complain to the competent Omani authority where the law gives you that right.