← Back to Dashboard
Privacy Policy
Effective Date: July 2025 • Last Updated: July 2025

NexusTRC ("we", "us", "our") operates the NexusTRC payment gateway platform and the DocFlow document generation service, both accessible at nexustrc.app. This Privacy Policy explains what data we collect, how we use it, and your rights.

1. Services Covered

This policy applies to:

  • NexusTRC — A TRC-20 (USDT) cryptocurrency payment gateway that enables merchants to accept USDT payments, manage wallets, configure webhooks, and access payment APIs.
  • DocFlow — A Google Workspace add-on that generates bulk PDF documents (invoices, receipts, certificates, contracts) from Google Sheets data. DocFlow runs entirely on Google's servers via Apps Script.

2. Data We Collect

2.1 NexusTRC Account Data

When you register for NexusTRC, we collect:

  • Email address — used as your account identifier and for login.
  • Password — stored as a bcrypt hash. We never see or store your plain-text password.
  • IP address — logged for rate limiting and security (failed login tracking). Not used for tracking or analytics.

2.2 Payment & Wallet Data

  • TRON wallet addresses — public blockchain addresses you add to receive payments. These are public by nature on the TRON blockchain.
  • Payment transactions — amounts, transaction IDs, status, timestamps, and buyer email (if provided at checkout).
  • Invoice records — subscription and plan purchase history.
  • Webhook configurations — URLs you configure to receive payment notifications (encrypted at rest).

2.3 API Keys

  • API key hashes — we store a SHA-256 hash of your API key, not the key itself. The plain-text key is shown once at creation and never stored.

2.4 DocFlow Data

DocFlow is a Google Workspace add-on that runs entirely on Google's servers via Apps Script:

  • We never see, access, or store your Google Sheets data, generated documents, or email content.
  • DocFlow only processes data within your own Google account. No spreadsheet data is transmitted to our servers.
  • For license validation, we store only your email address and license key (a randomly generated string).

2.5 Browser Data

  • Push notification subscriptions — if you opt in to browser push notifications, we store a browser subscription endpoint to deliver payment alerts. You can revoke this at any time via your browser settings.
  • Service worker cache — the browser service worker caches static assets (icons, scripts) for offline performance. This data stays on your device and is not sent to us.

3. How We Use Your Data

  • Service delivery — to operate the payment gateway, process payments, verify blockchain transactions, and deliver webhook notifications.
  • Account management — authentication, subscription management, and customer support.
  • Security — rate limiting, brute-force protection, and fraud prevention.
  • Legal compliance — if required by law (we currently have no analytics, advertising, or tracking integrations).

4. What We Do NOT Do

  • We do not sell, rent, or share your personal data with third parties for marketing purposes.
  • We do not use cookies for tracking or analytics. The only cookies used are for session authentication and CSRF protection.
  • We do not run third-party analytics (no Google Analytics, Mixpanel, etc.).
  • We do not use your data for advertising or profiling.
  • We do not access your Google Sheets, Drive, or Gmail data through DocFlow.

5. Third-Party Services

We interact with the following services to provide our functionality:

  • Tronscan / TronGrid — blockchain APIs used to verify TRON/USDT transactions. These are public blockchain lookups; no personal data is sent beyond wallet addresses (which are public on-chain).
  • Google reCAPTCHA — used on the registration page to prevent automated signups. Google's Privacy Policy applies to their service.
  • Cloudflare — if used as a reverse proxy, Cloudflare's Privacy Policy applies.

6. Data Storage & Security

  • Data is stored in a SQLite database on our server infrastructure.
  • Passwords are hashed with bcrypt. Webhook secrets are AES-encrypted at rest.
  • All connections are encrypted via TLS 1.2+ (HTTPS). HTTP requests are redirected to HTTPS.
  • API key plaintext is never stored — only a SHA-256 hash is retained.
  • We implement rate limiting, account lockout after failed attempts, and request ID tracking for audit purposes.

7. Data Retention

  • Account data — retained while your account is active. Deleted upon account deletion request.
  • Payment records — retained for 7 years for financial record-keeping (standard for payment services).
  • Webhook delivery logs — retained for 30 days, then automatically purged.
  • Audit logs — retained for 90 days for security purposes.
  • Rate-limit / security logs — IP addresses are rotated out within 24 hours.

8. Your Rights

You have the right to:

  • Access — request a copy of all personal data we hold about you.
  • Rectification — update or correct inaccurate data.
  • Deletion — request deletion of your account and personal data (subject to legal retention requirements for financial records).
  • Export — request your data in a machine-readable format.
  • Revoke push notifications — disable browser notifications at any time via browser settings.

To exercise these rights, contact us at support@nexustrc.app.

9. Children's Privacy

NexusTRC and DocFlow are not directed at individuals under 18. We do not knowingly collect data from minors.

10. International Data Transfers

NexusTRC is operated from servers that may be located outside your country of residence. By using our services, you consent to the transfer of your data to these locations. We apply the same security standards regardless of location.

11. Changes to This Policy

We may update this Privacy Policy from time to changes. Material changes will be communicated via email to registered users or announced on our website. The "Last Updated" date at the top reflects the most recent revision.

12. Contact

For questions about this Privacy Policy or your personal data, contact us at:

Email: support@nexustrc.app
Website: https://nexustrc.app