1. Scope and roles
This Policy explains how Nexumo, a product operated by Algomatrix Enterprise in Selangor, Malaysia, handles personal information in its website, web application and mobile application. For account registration, billing, support and security, Nexumo decides why information is processed. For asset records and other information entered by an organization, that organization generally decides what to collect and who may use it; Nexumo processes it to provide the Service. If your organization has added information about you, contact its administrator for questions about that information.
This Policy applies to users wherever Nexumo is available. Algomatrix Enterprise is based in Malaysia; the privacy rules that apply to you may also depend on where you live and how your organization uses the Service.
2. Information we handle
- Account and organization: name, email, password authentication records, profile photo, role, organization name and account settings.
- Asset and activity: asset names, descriptions, serial numbers, categories, assigned locations, QR scan and access events, checkouts, check-ins, transfers, notes, photos, documents and audit history. These records may identify a person who handled an asset.
- Billing and support: plan and subscription details, billing contact, Stripe customer and payment references, invoices, and information you send through support or contact forms. Stripe processes card details during checkout.
- Technical data: IP address, device and browser details, session and security cookies, request logs, error information and information needed to detect abuse or maintain the Service.
- Mobile features: photos you select or capture, QR scan results, locally stored account details and drafts, and a device push token if notifications are enabled. Camera and photo library access are requested when you use those features. The app does not request continuous device location for asset tracking.
3. How we use information
We use information to create and secure accounts; provide organization workspaces, asset workflows and reports; process subscriptions; send service and optional push notifications; answer support requests; troubleshoot and improve reliability; prevent misuse; and meet legal obligations. An organization's administrators and authorized members can see information according to their roles. We do not sell personal information or use mobile advertising identifiers.
If you choose an AI analysis feature, relevant photos and asset details are sent from our server to OpenAI to generate suggestions. AI output may be inaccurate and should be checked before use. AI analysis is optional and may be unavailable depending on your plan or configuration.
4. Legal bases for processing
Where a law such as the EU or UK GDPR requires a legal basis, we rely on the basis that fits the purpose: performing a contract to provide accounts, workspaces and billing; legitimate interests to secure and maintain the Service, prevent abuse and answer support requests; compliance with legal obligations for records we must keep; and consent where we ask for it for an optional activity. You can withdraw consent for an optional activity without affecting processing that already occurred or processing needed on another lawful basis.
When an organization decides what personal information to include in its asset records, it is responsible for determining the applicable basis and giving any required notice to the people concerned. We process those records to provide the Service under the organization's instructions.
7. Retention and account deletion
We keep account and organization records while needed to provide the Service and for legitimate security, accounting or legal purposes. We do not currently promise a fixed deletion period for all backups, logs or organization records. When information is no longer needed, we delete or de-identify it in line with our operational and legal obligations.
You can request deletion of your individual account in the mobile app or at the account deletion page. This removes sign-in access, email, profile photo, push token and organization membership. Your name remains in organization asset and checkout history as a former member so the organization can identify who handled assets. Shared notes and photos may remain with the organization's records. Account deletion does not delete an organization or cancel its subscription. The last organization administrator must transfer that role before deleting their account. Some cleanup may complete after access is removed.
8. Security
We use access controls, tenant separation, authentication and transport encryption to protect information. No online service can guarantee absolute security. Please report suspected unauthorized access to support@nexumo.app.
9. Your choices and rights
You can update some profile information in the Service, manage permissions on your device and request account deletion as described above. Depending on applicable law, you may also request access to, correction of, or deletion of personal information, or object to or withdraw consent for certain processing. We may need to verify your identity and may be unable to remove records your organization must retain or records required by law. Contact your organization administrator for workspace data and email support@nexumo.app for requests to Nexumo.
10. International processing
Algomatrix Enterprise operates from Malaysia. Our providers may process information in other countries, including where their infrastructure or support teams are located. This means your information may be processed outside your country of residence. Where applicable law requires a transfer mechanism, we will use an appropriate mechanism before making the transfer. Email support@nexumo.app if you need information about the destinations or safeguards for your data.
11. Rights by region
European Economic Area and United Kingdom. If the EU or UK GDPR applies, you may request access, correction, deletion, restriction or portability of your personal data, object to certain processing, and withdraw consent where consent is the basis. You may also complain to the data protection authority in your country. We do not use solely automated decisions that produce legal or similarly significant effects about users; optional AI suggestions are reviewed by people before they are used in asset workflows.
United States. Depending on your state and how its law applies, you may have rights to know, access, correct or delete personal information, receive a portable copy, or appeal a denied request. We do not sell personal information or use it for cross-context behavioral advertising. Contact us to exercise a right; we may need to verify your identity or refer an organization-controlled record request to that organization.
Malaysia. Under Malaysia's Personal Data Protection Act 2010, you may request access to and correction of your personal data and ask questions about our processing. Account details needed to provide the Service are required when you register; photos, AI analysis and push notifications are optional. If you do not provide required account information, we cannot create or maintain your account. You can contact us about your choices and rights at the address below. We will handle requests according to applicable law and may refer requests about an organization's records to that organization.
Residents of other countries may have additional rights under local law. Email support@nexumo.app to make a request. We will assess it under the law that applies to you and explain any lawful limitation or available appeal process.
12. Children
The Service is intended for organizations and their authorized users, not children. If you believe a child has provided personal information without appropriate authorization, contact us so we can review and address it.
13. Changes and contact
We will post updates to this Policy with an effective date and provide additional notice for material changes where required. For privacy questions or requests, email support@nexumo.app. The operator's mailing address is Algomatrix Enterprise, No. 1, Section 13, Jalan PJU 3/29, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia. You may also contact your organization administrator about records maintained in its workspace.