What we collect,
and what we don't.

• Nexus, operated from Nairobi, Kenya, is the data controller for personal data processed on the platform.
• Privacy contact: privacy@getnexus.africa. We answer data requests within 48 hours.
• It applies to workers, clients, visitors, and anyone whose details appear in a job brief.
• It does not cover what a client or worker does with data after it leaves the platform — for that, they are the controller and their own policy applies.
• Where a client sends us their customers' data as part of a brief, that client is the controller and we process it on their instructions.

What you give us

• Name, email address and phone number
• Skills, bio, languages, portfolio and work experience
• Government ID documents — workers only, for verification
• Country of residence and preferred language
• Mobile money number or bank account for payouts, and the account holder name
• Job briefs, files, messages and work submissions
• Support, dispute and appeal correspondence

What we collect automatically

• IP address, device type and browser, from ordinary web requests
• Country inferred from your IP, to pick a display currency — the country only, never a precise location
• Pages visited and time on the platform, as aggregate analytics
• Task activity: claims, submissions, approvals, quality scores, earnings
• Message and notification timestamps, and delivery status of emails we send
• Security and fraud signals: sign-in attempts, duplicate-account markers, unusual payout patterns

What we get from others

• Payment and payout providers: transaction status, failure reasons, and their own compliance flags
• Geolocation providers: the country matching an IP address
• Referrals: when someone signs up with your code, we record the link between the two accounts

What we do not collect

• Card numbers or full bank credentials — payment providers handle those, we never see them
• Precise location, GPS or continuous device tracking
• The content of your communications outside the platform
• Special-category data — health, religion, politics, biometrics — beyond what appears on an ID document you upload for verification

To perform our contract with you

• Creating and running your account
• Matching briefs to workers and delivering work to clients
• Collecting client payments and sending worker payouts
• Detecting your country to display local prices
• Sending transactional notices: task assigned, work delivered, payment sent

To meet a legal obligation

• Verifying worker identity before paid work
• Anti-money-laundering, sanctions and fraud checks, ours and our providers'
• Keeping financial and tax records for the period the law requires
• Responding to lawful requests from courts, regulators and tax authorities in countries where we operate

For our legitimate interests

• Improving matching, quality scoring and language checks — using aggregated or de-identified platform data where practical
• Calculating reputation and reliability scores
• Preventing fraud, duplicate accounts, referral abuse and payment circumvention
• Measuring platform performance by region, and deciding which countries and corridors to build next
• Securing the platform and investigating incidents
• Defending legal claims and enforcing our Terms

With your consent

• Non-essential cookies and analytics, where consent is required in your country
• Reminder and marketing email, which you can switch off in Settings at any time
• Showing your work as a portfolio sample, which we ask for case by case
• You can withdraw consent at any time. Doing so does not affect processing that already happened, or anything we do on another basis above.

Where your country's law frames these differently — POPIA's conditions for lawful processing, or NDPA's lawful bases — we apply the local framing to your data. The activities above stay the same either way.

What AI sees

• Job briefs and work submissions, for matching, quality scoring and language review
• Skills and availability from a worker profile, for matching
• It does not see identity documents, payout details, phone numbers or email addresses

How we handle it

• Our AI provider processes this content to return a result. It is sent for that purpose only, under a commercial agreement that does not permit training their public models on it.
• Quality scores and match decisions influence what work you are offered and whether a submission is returned for revision.
• No decision with legal effect — payment, suspension, verification — is made by automated means alone. A person reviews those.
• You may ask for human review of any automated outcome that affects you materially, and we will provide it.
• We may use platform data to improve our own matching and quality models, aggregated or de-identified where practical. We do not publish, sell or expose client-confidential material to other users.

Between users

• Clients see a worker's first name, skills, ratings, country and the submitted work.
• Workers see the brief, attached files and the client's first name.
• Phone numbers, email addresses and ID documents are never shared between users.

With service providers

Each provider gets the minimum the job needs, under contract, and may not use it for their own purposes.

We never

• Sell your personal data, to anyone, for any price
• Share your phone number or email with another user
• Use verification documents for anything other than verification
• Publish your full name or contact details
• Run advertising trackers, third-party pixels or behavioural profiling — Nexus carries no ads

When we have to disclose

• A valid court order, warrant, regulator demand or tax authority request in a country where we operate
• Investigating fraud, sanctions matches, or a credible threat to someone's safety
• Enforcing our Terms or defending a legal claim
• A merger, financing or sale of the business — in which case the buyer is bound by this policy or you are told before anything changes
• Where the law lets us, we will tell you before disclosing your data in response to a request.

Nexus serves all 54 African countries from Nairobi, Kenya, on infrastructure that is not always in your country. That makes almost every job a cross-border transfer, and this is how we handle it.

Safeguards we apply

• Transfers rely on your consent, contractual necessity, or standard contractual clauses with the receiving provider.
• Where Kenyan law requires it, transfers out of Kenya meet the conditions in the Data Protection Act, 2019 and its transfer regulations.
• POPIA section 72, the NDPA transfer rules, and GDPR Chapter V are applied where a person is protected by them.
• Providers are chosen for their security posture and their willingness to sign data-processing terms, not only on price.
• Where two standards apply to the same data, we apply the stricter one.

Frameworks we align with

• African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention)
• EU / UK GDPR — where a client or worker is in the EU, EEA or United Kingdom
• Standard contractual clauses or equivalent safeguards for transfers out of your country

• When you open the site, your browser calls our own API route, which reads your IP from the request.
• That IP is sent to a geolocation provider — ipapi.co, with ip-api.com as a fallback — which returns a two-letter country code. Where our host supplies a country header, we use that instead and skip the lookup.
• We cache the country code against that IP in server memory for 10 minutes to avoid repeat lookups, then it is gone.
• Your IP is not written to our database, not attached to your profile, and not used to track you between visits.
• The country code decides which currency and payment methods to display. Nothing else.
• You can ignore the detected country — the binding amount for any job is the KES figure, as the Terms explain.

What you can do

• Access — get a copy of the data we hold about you
• Export — download your profile, tasks and earnings history from Settings
• Correct — fix anything inaccurate in your profile, yourself, at any time
• Delete — close your account and remove your data from Settings, subject to the records we must keep
• Object or restrict — tell us to stop a particular processing activity, and we will unless we have an overriding legal ground
• Withdraw consent — switch off reminder email and non-essential cookies whenever you like
• Human review — ask a person to look at an automated outcome that affects you
• Complain — to us first, and to your national regulator if we do not resolve it

How to exercise them

• Most of it is self-service in Settings. For anything else, email privacy@getnexus.africa from the address on your account.
• We respond within 48 hours and complete requests within 30 days, or tell you why we need longer.
• We may ask you to confirm your identity before releasing or deleting data — that check protects you, not us.
• There is no charge, unless a request is repetitive or excessive, in which case we will tell you before doing anything.
• A request does not pause work in progress or a payout you are owed.

Where to complain in your country

You can go to your national regulator directly — you do not need our permission, and you do not have to come to us first.

How we protect data

• Encrypted in transit with TLS, and at rest by our database provider
• Verification documents in private storage, not publicly addressable, deleted on schedule
• Row-level access rules in the database, so one account cannot read another's data
• Admin access limited to a named list, checked in code and in the database
• Payout credentials held by licensed providers, not by us
• Regular review of dependencies, access and permissions

If something goes wrong

• We investigate, contain, and record what happened.
• Where a breach is likely to risk your rights, we notify you and the relevant regulator within the time your law requires — 72 hours under KDPA and GDPR, and the equivalent under POPIA and NDPA.
• We tell you what happened, what data was involved, and what to do about it. We do not wait for certainty on every detail before warning you.

No platform is perfectly secure, and we do not claim to be. Use a strong, unique password, keep your email account secure, and tell us immediately if you think someone else has access to your account.

What we set

• A session cookie that keeps you signed in — essential, and you cannot opt out of it while using an account
• A local-storage entry recording your cookie choice, so we stop asking
• Anonymous analytics from our host, measuring page views without personal identifiers

What we do not set

• Advertising or retargeting cookies
• Third-party pixels or social trackers
• Cross-site behavioural profiling
• Cookies for country detection — that is a server-side IP lookup instead

You can clear or block cookies in your browser. Blocking the session cookie will sign you out and prevent an account from working.

• Account and profile data — while your account is open
• Verification documents — deleted 30 days after verification completes
• Task, submission and earnings records — 7 years, for tax and financial compliance
• Payment and payout records — as long as financial law in the relevant country requires
• Support, dispute and appeal correspondence — 3 years after the matter closes
• Deleted accounts — removed within 30 days, other than records under a legal hold or needed for tax and fraud prevention
• Fraud and abuse markers — kept as long as needed to stop a banned account returning
• Aggregated, de-identified analytics — kept indefinitely, because it is no longer personal data
• Server-side country cache — 10 minutes

• Nexus is for adults. You must be 18 or over to hold an account.
• We do not knowingly collect data from children. If we find an account belongs to someone under 18, we close it and delete the data.
• If you believe a child has given us data, email privacy@getnexus.africa and we will remove it.
• A brief that includes data about children is the client's responsibility to have lawful grounds for, and must be flagged to us before upload.

• Transactional email — task assigned, work delivered, payment sent, security alerts. These are part of the service and cannot be switched off while your account is open.
• Reminder email — deadline and pending-action nudges. Switch these off in Settings.
• Product and marketing email — only where you have opted in, and every message carries an unsubscribe link.
• WhatsApp — used only where you have given us the number for notifications, and Meta's own terms govern that channel.
• We do not sell or rent your address to anyone else's mailing list.

• We update this policy as the platform changes and as new countries come online.
• Material changes are notified by email and in-app before they take effect.
• The version number and date at the top of this page tell you which version applies.
• Where a change needs your consent, we will ask for it rather than assume it.

• Privacy and data requests: privacy@getnexus.africa
• Legal notices: legal@getnexus.africa
• WhatsApp: +254 753 538 594
• Response time: 48 hours, with requests completed inside 30 days
• For a deletion request, email us from the address on your account and say what you want removed
• Operated from Nairobi, Kenya, serving all 54 African countries
• Unhappy with our answer? Go to the regulator listed for your country above. We would rather fix it first, but that route is yours either way.