Legal
Privacy Policy
Effective 2026-07-04. This policy explains what personal data nexacoreos.com collects, why, how long it is kept, and how to exercise your rights under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Data controller status. Matteo Sala, the project's founder, is the data controller for the personal data described in this policy. If the project later establishes a legal entity that assumes this role, this policy will be updated accordingly — see “Changes to this policy” below.
1. Who is responsible for your data
Data controller: Matteo Sala
Contact: [email protected]
There is no separate Data Protection Officer at this stage. All privacy requests are handled directly by the data controller at the contact address above.
2. What data we collect
We only collect personal data you actively provide through a form on this site, plus minimal, cookieless usage statistics. We do not use tracking cookies, and we do not collect personal data passively beyond what is described below.
| Source | Data collected | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Contribute form | Name, email address, area of interest, message | To respond to your interest in contributing to the project | Consent (submitting the form is an affirmative action) |
| Careers / application form | Name, email address, position, message, CV file (PDF/DOC/DOCX) | To evaluate your job application | Consent; steps prior to entering a contract |
| Anti-spam verification | IP address, browser signals (processed by Cloudflare Turnstile) | To prevent automated/spam submissions | Legitimate interest (keeping the forms usable and abuse-free) |
| Site analytics | Aggregated, cookieless page-visit statistics (Plausible Analytics, self-hosted on our own infrastructure — no cookies, no persistent identifier, no cross-site tracking) | To understand which pages are useful and fix problems | Legitimate interest |
| Newsletter subscription | Email address (and name, if you provide one) | To send the devlog / product updates you subscribed to | Consent (confirmed via double opt-in) |
We never ask for, and you should never submit, sensitive personal data (health, religion, political opinions, government ID numbers, financial account numbers) through these forms.
3. How long we keep it
Contribute and careers submissions, including any CV attachment, are retained for up to 24 months from submission, after which they are deleted, unless you ask us to delete them sooner or a longer period is needed to respond to an ongoing conversation with you. Aggregated analytics data contains no personal identifiers and is stored on our own self-hosted Plausible instance, under our direct control. Newsletter subscribers' email addresses are kept until you unsubscribe (there is an unsubscribe link in every email) or ask us to remove them.
4. Who we share it with
We do not sell personal data, and we do not share it for cross-context behavioral advertising. Submissions are processed by a small number of infrastructure providers acting as our data processors, strictly to deliver the functionality described above:
- Mailcow (self-hosted email, samacyber.io) — form submissions are relayed by email to the data controller's inbox.
- Cloudflare — provides Turnstile (anti-spam verification) and the network/CDN layer nexacoreos.com runs on. Cloudflare may process data on infrastructure located outside the European Economic Area; Cloudflare's Data Processing Addendum incorporates the EU Standard Contractual Clauses for such transfers.
- Plausible Analytics (self-hosted) — cookieless, aggregated usage statistics run on our own infrastructure; no analytics data is shared with a third party.
- Listmonk (self-hosted newsletter) — if you subscribe, stores your email address to deliver the updates you asked for; runs on our own infrastructure, no third party involved. Every email includes a one-click unsubscribe link.
We do not use any other third-party processor for the data described in this policy.
5. Your rights under GDPR
If you are located in the European Economic Area or United Kingdom, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict or object to processing.
- Port your data to another service in a structured format.
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
- Lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, email [email protected]. We will respond within one month, as required by GDPR Art. 12.
6. Your rights under the CCPA (California residents)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose.
- Delete personal information we hold about you, subject to certain exceptions.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of personal information — we do not sell or share personal information as defined by the CCPA, so there is nothing to opt out of.
- Non-discrimination for exercising any of these rights.
To exercise any of these rights, email [email protected] with "CCPA request" in the subject line.
7. Cookies
This site does not use tracking or advertising cookies. A small number of technologies may set strictly necessary or functional storage (never used for advertising or cross-site tracking) — see the Cookie Policy for the full list and how to manage your preference.
8. Children's privacy
This site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has submitted personal data to us, contact [email protected] and we will delete it.
9. Changes to this policy
We will update this page if what we collect, why, or who we share it with changes — including if a legal entity is established and assumes the data controller role described in section 1. The effective date at the top of this page reflects the latest revision.
10. Contact
Questions about this policy or your data: [email protected]