1. Who we are
Nexus Studio ("we", "us", "our") is a website service based in the United Kingdom. We build websites for charities and social enterprises, and we run two free tools for the charity sector: the Website MOT and the Trustee Portal. We are the data controller for the personal data described in this policy.
For any privacy question or data request, contact us at hello@nexusstudio.io.
2. The data we collect
We only collect what we need to run our services. Depending on how you use the site, that may include:
- Enquiry and contact forms: your name, email address, and message, plus your organisation and phone number if you choose to share them.
- Website MOT requests: your website address and email, plus your name, organisation and any note if you provide them. We also record how many times your report is viewed.
- Free guide downloads: your name, organisation and email, so we can send you the guide.
- Trustee Portal accounts: your name, email and password (stored only as a secure hash), an optional profile photo, your charity's registration number and name, and your board role.
- Trustee Portal content: the documents you upload, the meeting transcripts and minutes you create, and the actions, deadlines and notes you add. Some of this content can include personal information about named individuals.
- Trustee invitations: the name and email of anyone you invite to join your board, so we can send them an invite.
- Testimonials: reviewer names, quotes and profile photos, published with permission or synced from our own public Google reviews.
- Charity outreach data: where we contact charities about a Website MOT, we use information from the public Charity Commission register and information published openly on charity websites, such as a public contact email.
3. How we use your data and our lawful basis
We use your personal data to:
- Respond to your enquiries and deliver the services you ask for.
- Send you the transactional emails our services depend on, such as your Website MOT report link, a guide download link, or Trustee Portal invites, reminders and notifications.
- Run the Trustee Portal and the Website MOT for you.
- Contact charities in our sector about a free Website MOT for their site.
Our lawful basis is contract where you are a client or an account holder, and legitimate interests for responding to enquiries and for charity sector outreach. Where we contact a charity about a Website MOT, the source is the public Charity Commission register and every message carries a one click way to opt out. We never sell your personal data.
4. AI features
Two features use OpenAI to process text on our behalf. In the Trustee Portal, a meeting transcript you upload is sent to OpenAI so it can draft your minutes. When we prepare a Website MOT outreach email, we use OpenAI to help draft it. OpenAI acts as our processor and works only on our instructions. Because a transcript can contain personal or sensitive information about named individuals, please only include what you need, and avoid uploading special category data unless it is necessary.
5. Email delivery and opting out
We send email through Resend, which records whether a message was delivered, opened or clicked so we can understand engagement. Every marketing email includes a one click unsubscribe. When you unsubscribe we add your address to a permanent suppression list, which is how we make sure we stop contacting you.
6. Who we share data with
We use a small set of trusted providers to run our service. They process personal data only on our instructions, under their own terms:
- Resend: sends our email and reports delivery, opens and clicks.
- OpenAI: drafts Trustee Portal minutes and outreach emails, as described above.
- Google: the PageSpeed Insights service checks website speed, the Places service syncs our own reviews, and Google Fonts serves the site fonts. Google Fonts receives your IP address when a page loads, which is a normal part of serving fonts.
- Charity Commission register: we look up public charity information, including for the Trustee Portal deadline calendar.
- Nominet: checks whether a suggested charity domain is available. No personal data is involved.
- Our database and hosting providers: store the site and its data securely.
We do not sell your personal data and we do not share it for anyone else to use for their own purposes.
7. How long we keep it
- Enquiries and leads: kept for as long as they are relevant to helping you, then removed.
- Trustee Portal data: kept while your account and your charity's portal are active. You can ask us to export or delete it at any time.
- Suppression list: kept permanently, because we need it to honour your choice to opt out.
8. Your rights under UK GDPR
You have the right to:
- Access a copy of the personal data we hold about you.
- Rectification of anything inaccurate or incomplete.
- Erasure of your data where there is no reason for us to keep it.
- Portability, to receive your data in a structured, machine readable format.
- Restriction of how we process your data in certain cases.
- Object to processing based on our legitimate interests.
Trustee Portal users can export or delete their data at any time by asking us. To exercise any right, email hello@nexusstudio.io and we will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
9. Cookies
We use a single strictly necessary cookie to keep you signed in to the Trustee Portal or the admin area. We do not use analytics, advertising or tracking cookies. You can read the detail in our Cookie Policy.
10. Security
Data is encrypted in transit, passwords are stored only as secure hashes, and each charity's Trustee Portal data is kept isolated from every other organisation. No online service can promise perfect security, but we take sensible steps to protect your information.
11. Children
Our services are intended for charity staff, trustees and other adults. They are not directed at children, and we do not knowingly collect data from children.
12. Changes and contact
We may update this policy from time to time. The current version will always be available at this URL. For any question about your data, contact us:
Nexus Studio
Email: hello@nexusstudio.io