NexForum ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding it. By using our services, you agree to the practices described here.

1. Who We Are

NexForum is a forum hosting service operated at nexforum.net. We provide web hosting infrastructure for community forum software. For the purposes of data protection law, NexForum is the data controller for personal data collected through our main website and client portal. Forum owners (our customers) are independent data controllers for personal data collected within their own forums.

2. Data We Collect

Account Data

When you create a NexForum account, we collect:

• Name and email address
• Password (stored as a salted hash — we never store plaintext passwords)
• Account creation date and IP address
• Billing information (processed by Stripe — we do not store full card details)

Usage Data

When you use our services, we automatically collect:

• IP address and approximate location (country/region level)
• Browser type, operating system, and device type
• Pages visited, time on page, and referral URL
• Forum software installed and configuration choices
• Support ticket content when you contact us

Forum Content Data

For technical service delivery, our systems process (but do not monitor) the content hosted on your forum, including posts, user accounts, uploaded files, and database contents. This data belongs to you and your forum members.

Cookies

We use cookies and similar tracking technologies as described in Section 5 below.

3. How We Use Your Data

We use your personal data to:

• Provide the service — Create and manage your hosting account, install forum software, and keep your forum running
• Process payments — Handle billing, invoicing, and refund processing for paid plans
• Communicate with you — Send service notifications, security alerts, support responses, and (if opted in) product updates
• Improve our service — Analyse aggregate usage patterns to understand how our platform is used and where we can improve
• Ensure security and compliance — Detect abuse, prevent fraud, enforce our Terms of Service, and respond to legal requests
• Legal obligations — Comply with applicable laws and regulations

We do not sell your personal data to third parties. We do not use your data for targeted advertising.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, United Kingdom, and other jurisdictions with similar laws, we process your data under the following legal bases:

• Contract performance — Processing necessary to provide the hosting service you've signed up for
• Legitimate interests — Security monitoring, fraud prevention, and service improvement analytics
• Legal obligation — Compliance with applicable laws
• Consent — Marketing emails and non-essential cookies (where consent is required)

5. Cookies & Tracking

We use the following types of cookies on nexforum.net:

• Essential cookies — Required for the site and client portal to function (session management, login persistence). Cannot be disabled.
• Analytics cookies — We use privacy-respecting analytics to understand aggregate traffic patterns. These do not track you across other sites. You can decline these via our cookie banner.
• Preference cookies — Storing your dark/light mode preference. These contain no personal data.

We do not use third-party advertising cookies or cross-site tracking technologies. Your cookie preferences can be updated at any time by clearing your browser cookies and re-visiting our site.

6. Data Sharing & Third Parties

We share your data only with the following categories of third parties, and only as necessary to provide our service:

• Stripe — Payment processing. Stripe processes billing data under their own privacy policy. We never see full card numbers.
• Cloudflare — CDN, DDoS protection, and DNS. Cloudflare processes connection data (IP addresses) to deliver and protect our services.
• Hosting infrastructure providers — Server hosting in Montreal, Canada. Data is processed under contractual data processing agreements.
• Legal authorities — We may disclose data when required by law, court order, or to protect the rights and safety of our users or the public.

We do not sell, rent, or trade your personal data with any third parties for marketing purposes.

7. Data Retention

We retain your personal data for as long as your account is active, plus a reasonable period thereafter for legal compliance purposes (typically 12 months after account closure). Forum content data is deleted when you delete your forum or within 30 days of account termination. Backup copies may persist for up to 60 days.

You can request deletion of your data at any time (see Your Rights below).

8. Security

We take data security seriously and implement appropriate technical and organisational measures including:

• TLS/HTTPS encryption for all data in transit
• Encrypted storage for sensitive account data
• Bcrypt hashing for all passwords
• Access controls limiting staff access to personal data
• Regular security reviews of our platform

No method of electronic transmission or storage is 100% secure. In the event of a data breach affecting your rights, we will notify you and relevant authorities as required by law.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Rectification — Ask us to correct inaccurate or incomplete data
• Erasure — Request deletion of your personal data ("right to be forgotten")
• Portability — Receive your data in a machine-readable format
• Restriction — Ask us to limit how we use your data
• Objection — Object to processing based on legitimate interests
• Withdraw consent — Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us via our contact page. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

10. Children's Privacy

Our services are not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child under 13, please contact us immediately and we will delete it promptly.

Forum owners are responsible for ensuring their forum communities comply with applicable laws regarding minors, including COPPA (US) and similar regulations.

11. International Data Transfers

Our servers are located in Montreal, Canada. Canada is recognised by the European Commission as providing adequate data protection. If we transfer data outside of Canada or the EEA for any reason, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email and/or a notice on our website at least 14 days before changes take effect. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, data subject requests, or concerns, please contact us via our contact page using the subject "Privacy Request." We aim to respond within 5 business days.