Privacy Policy

Nexum (nexum.fund) is operated by NEXUM ANALYTICS LTD, a company registered in England and Wales (company number 17440513), registered office 66 Paul Street, London, EC2A 4NA, United Kingdom ("Nexum", "the house", "we").

Effective date: 20 October 2026 · Last updated: 20 October 2026

This policy explains what personal data we collect when you use the Platform, why, on what legal basis, who we share it with, how long we keep it, and the rights you have. We are the data controller for the personal data described here. Questions and requests: [email protected].

1 · Who this applies to

• Founders — people who create an account, file a business for examination, and hold a register entry.
• Fellows and Members — people who apply for or hold a seat in the Founding Faculty of Nexum and read the register.
• Analysts and staff — the people who examine, sign findings, and administer the house (their names appear on examinations by design; see §6).
• Visitors — anyone reading the public site, writing to us, or joining the newsletter.

The Platform is for business use by adults. We do not knowingly collect data from anyone under 18.

2 · What we collect

2.1 Account data. Name, email address, password (stored only as a salted hash), phone number where you have provided one, role, seat status, and the timestamps and security events attached to your account.

2.2 Company and submission data. What you file for examination: company details (name, sector, segment, stage, region, website), your business model as filed, the reasoning and figures you supply, uploaded documents, and every self-reported update you later add to your entry. Some of this is business information rather than personal data; where it identifies a person — you as founder, named team members, named customers you mention — we treat it as personal data.

2.3 Examination records. The findings, keystone analysis, summaries, and signatures produced by the house about your business, the analysts' working notes, and the record of house events (examination delivered, milestones verified, re-examinations). The findings are about your business; we hold them under the confidentiality and publication settings you choose (§5).

2.4 Register and introduction data. Your entry's visibility settings (named, blind, or confidential), the openness intents you set, questions and answers placed on the record, introduction requests (including the requester's stated purpose, in their words), acceptances, closures, withdrawals, and — when an introduction is accepted — the contact details exchanged between the two parties.

2.5 Fellow profiles. If you hold a seat, what you write about yourself: a photograph if you choose to add one, your name as it should appear, a city, your background in your own words, the functions and domains you have worked in, what you want to hear about, what you are open to, the companies you declare an affiliation with, and a LinkedIn address if you give one. A photograph you upload is re-encoded before it is stored, which removes the EXIF and other metadata a camera or phone writes into an image file — including, in many cases, the GPS coordinates of where the picture was taken. We store the re-encoded image and never the original. Who sees a profile depends on what you have consented to: the public roster carries your photograph, name, one line and city, and only if you have consented to being listed; a founder you ask to meet sees the full profile, including your declared affiliations, and your LinkedIn address only if you have chosen to show it; the house sees all of it. Photographs are held in a private store and served only through a route that checks, on each request, whether the person asking may see them. You may change or remove any of this at any time. When a seat ends, the profile and photograph leave public view within a day, and we delete them on request.

2.6 Faculty applications. Name, email, domain of expertise, what you have operated, a link you choose to share, and what draws you to the house. These are read by people; they are not scored automatically.

2.7 Payment data. When payment is available, the payment itself is handled by a regulated third-party payment processor. We receive confirmation of payment, the amount, the date, and a processor reference — never your full card or bank details. The processor's identity and its own privacy notice are published on the fee page when active.

2.8 Correspondence and newsletter. Messages you send us, your newsletter subscription and its confirmation status, and the notifications we send you (including whether they were delivered).

2.9 Technical data. IP address, browser and device information, the pages you request, timestamps, and error logs — collected as server logs for security and to keep the service working. Cookies are described in the Cookie Notice.

Analytics. We measure use of the public pages of nexum.fund with PostHog, hosted in the European Union. This measurement stores nothing on your device — no cookies, no local storage. PostHog derives a short-lived identifier from a daily-rotating salt, your IP address, browser signature and our hostname; the IP address itself is discarded at ingestion. We use this to understand which pages are visited and which referrals reach us. Legal basis: legitimate interest in understanding how the site is used. Signed-in areas of the platform are not measured with PostHog; activity there is recorded by Nexum itself under the consent you give at registration. PostHog Inc. processes this data on our behalf under a data processing agreement.

Error reports from the site and the platform are sent to Sentry, hosted in the European Union, with email addresses, IP addresses and session cookies stripped before sending; signed-in errors are attributed to an account identifier only. Sentry processes this data on our behalf under a data processing agreement.

3 · Why, and on what legal basis

Where we rely on legitimate interests we have weighed them against your rights; you may ask us for that assessment.

4 · Automated analysis and AI

The examination uses machine-scale analysis — including large language models — to cross-examine what you file against evidence, under the judgment of a named analyst who signs the findings and a second reviewer who signs them. No decision with legal or similarly significant effect on you is made solely by automated means. Findings, standings, and any publication are decided by people.

To perform that analysis we send the content you file to AI model providers acting as our processors, under contracts that prohibit them from using your data to train their models and require deletion after processing. The providers in use are listed in §7. You may ask us which provider processed your file.

5 · Confidentiality, blind entries, and publication

What you file is confidential to you and the house by default. You decide separately:

• Whether your examination is published, in whole or in part, to the register.
• Whether your entry is named or blind. A blind entry publishes the substance — findings, keystone, standing, record — under an analyst-written descriptor, and withholds your identity. Our systems enforce this: blind entries are served from a field allowlist that excludes name, links, and founder identity, and the enforcement is checked automatically.
• Whether and to whom your identity is revealed. On a blind entry, your identity reaches a Fellow only when you accept their introduction request, and only that Fellow.

You may change these settings at any time; changes apply going forward. Something already published or already revealed to a specific person cannot be unpublished from that person's memory, but we will remove it from the Platform.

6 · Names on the record

Examinations are signed by named analysts; questions and answers on the register are attributed to the Fellow who asked and the founder who answered; an introduction request names the Fellow to the founder. This attribution is part of the service — accountability is the house's standard — and by using those features you agree to it. Analysts and staff are informed that their names appear on the work they sign.

7 · Who we share data with

We do not sell personal data and we do not share it with advertisers.

• Counterparties, by your action. A founder sees a Fellow's name, standing, stated purpose and Fellow profile — including the Fellow's declared affiliations — when the Fellow requests an introduction. A Fellow sees a founder's identity and contact details only on acceptance. Named register entries are visible to seat-holders; public register entries, where a founder has chosen that, are visible to anyone; a Fellow's roster listing is visible to anyone, and only where the Fellow has consented to it.
• Processors acting for us, under written contracts: hosting (Hetzner Online GmbH, Germany), content delivery and security (Cloudflare, Inc.), transactional email (Resend, Inc.), AI model providers for examination analysis (named here when in use), and payment processing (named on the fee page when active). We also use a self-hosted search index; it does not leave our infrastructure.
• Professional advisers and authorities where the law requires or permits — accountants, lawyers, regulators, courts.
• A successor if the house is sold or reorganised, under the same commitments.

8 · International transfers

We are based in the United Kingdom. Our primary hosting is in the European Economic Area, which the UK recognises as providing adequate protection. Some processors (content delivery, email, AI providers) process data in the United States; for those transfers we rely on the UK International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses, and on the UK extension to the EU–US Data Privacy Framework where the provider is certified.

9 · How long we keep it

• Account data — for the life of the account and 12 months after closure, then deleted (security logs anonymised earlier).
• Company, submission, and examination records — for as long as your entry is on the register and 6 years after it is removed, because examinations are dated records that later work refers back to, and because accounting records must be kept for that period. You may ask for earlier deletion; we will delete what we are not legally required to keep.
• The house-event record (dates and types of verified events) — kept indefinitely in de-identified form, because it is the register's history.
• Introduction data — for the life of both accounts and 12 months after, so that recusal (a Fellow may never evaluate a founder they were introduced to) can be enforced.
• Fellow profiles and photographs — for as long as the seat is held. When a seat ends the profile and photograph leave public view within a day; we delete them on request, and otherwise hold them for 12 months in case the seat is reinstated.
• Faculty applications — 24 months from receipt if no seat is taken.
• Payment records — 6 years, as UK law requires.
• Server logs — 90 days.

10 · Your rights

Under UK GDPR you may ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to processing based on legitimate interests; receive the data you gave us in a portable format; and withdraw consent at any time (without affecting what was done before withdrawal). Write to [email protected]; we respond within one month and may ask you to verify your identity.

You have the right to complain to the Information Commissioner's Office (ico.org.uk, +44 303 123 1113). We would welcome the chance to address a concern first.

11 · California residents

If you live in California, the CCPA as amended by the CPRA gives you rights over your personal information: to know what we collect and why, to access it, to correct it, to delete it, and to be free of discrimination for exercising any of these. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. To exercise a right, write to [email protected] with the subject "California privacy request"; we verify the request against your account and respond within the statutory period. An authorised agent may act for you with written permission.

12 · Security

Passwords are hashed; sessions use short-lived access tokens and HttpOnly, Secure cookies; data is encrypted in transit; access to examination records is restricted by role; blind-entry enforcement and other invariants are checked automatically. No system is perfectly secure. If a breach affects your rights we will tell you and, where required, the ICO.

13 · Changes

We will post changes here with a new "last updated" date and, for material changes, notify account holders by email before they take effect.

14 · Contact

NEXUM ANALYTICS LTD · 66 Paul Street, London, EC2A 4NA, United Kingdom · [email protected] · general: [email protected]