Privacy Policy

1. Introduction and Scope

Welcome to Sindria Nexus. Sindria Nexus (“we,” “us,” or “our”) refers to Sindria Nexus LLC, a limited liability company formed in the state of Georgia, which operates the Sindria Nexus brand, the Nexus Learning Academy (a free educational resource library), and The Trust Nexus (a newsletter on compliance, security, and the business of trust). Sindria Nexus LLC provides SOC 2 readiness and compliance advisory services to growing technology companies. This Privacy Policy (“Policy”) describes the types of information we collect through sindrianexus.com (the “Site”), how we use and disclose that information, the choices available to you, and how to contact us.

This Policy applies to all visitors to the Site, subscribers to our communications, requesters of Academy materials, and individuals who contact us through the Site. It does not apply to third-party websites or services that may link to or from the Site. Where you engage our professional services, the handling of engagement-related information is additionally governed by your engagement letter, which controls in the event of any conflict with this Policy.

By using the Site or providing information to us, you acknowledge the practices described in this Policy. If you do not agree, please do not use the Site or provide information to us.

2. Definitions

“Personal Information” means information that identifies, relates to, or is reasonably capable of being associated with a particular individual or household, directly or indirectly. It does not include publicly available information lawfully made available from government records, or de-identified or aggregated information that cannot reasonably be linked to you.

“Processing” means any operation performed on Personal Information, including collection, storage, use, disclosure, and deletion.

“Service Provider” means a company or individual we engage to process Personal Information on our behalf and under our instructions, subject to contractual obligations to protect it.

“Academy” means the Nexus Learning Academy educational resources made available through the Site, including written memos, videos, and related materials. “You” means the individual reading this Policy or using the Site.

3. Information We Collect

We limit collection to information that is reasonably necessary and proportionate to achieve the purposes described in Section 4.

3.1 Information you provide directly.

You may voluntarily provide Personal Information when you: submit our contact form (typically your name, email address, company name, and message); request Academy materials (your email address; a work email address for professional-track materials); subscribe to The Trust Nexus (your email address); or communicate with us by email. Contact-form submitters are not added to marketing lists. Please do not submit sensitive personal information — such as government identifiers, financial account numbers, or health information — through Site forms.

3.2 Client engagement information.

When an organization engages our professional services, we collect business contact details and business information reasonably needed to deliver the services. Engagement-related information is governed first and foremost by the engagement letter, and we do not use it for marketing.

3.3 Information collected automatically.

When you visit the Site, our hosting infrastructure automatically records technical information such as your IP address (which may reveal approximate location), browser type, device information, pages viewed, and dates and times of visits. This is used for security monitoring, troubleshooting, and understanding aggregate usage patterns. It is not used to build advertising profiles.

3.4 Information from other sources.

We may occasionally receive information about you from other sources — for example, if a colleague forwards you an Academy resource and you then contact us. We do not purchase marketing lists or acquire Personal Information from data brokers.

3.5 What we do not collect.

We do not intentionally collect sensitive personal information through the Site, such as social security numbers, financial account log-in credentials, precise geolocation, or health-related information. If you believe you submitted such information in error, contact us and we will delete it.

4. How We Use Your Information

We use the information described in Section 3 for the following purposes:

• Operating the Site and delivering resources — maintaining and securing the Site; processing Academy requests; managing access to gated resources, including professional-track eligibility.
• Communicating with you — responding to inquiries; sending The Trust Nexus and educational updates you consented to receive; sending transactional messages related to your requests or an active engagement; notifying you of material changes to this Policy. As a relationship-driven practice, we also use business contact information for ordinary professional follow-up (for example, after conferences or introductions) — occasional correspondence, not bulk marketing, and you may ask us to stop at any time.
• Providing professional services — performing the services in the engagement letter and improving our offerings based on aggregated, de-identified learnings (never by disclosing any client’s confidential information).
• Analytics and improvement — understanding aggregate Site usage to improve content and functionality, performed on aggregated or de-identified data where possible.
• Security, fraud prevention, and legal compliance — protecting the Site; detecting and preventing fraud and abuse; enforcing our Terms of Service; complying with legal obligations.
• With your consent — for any other purpose disclosed at collection, with your consent where required.

5. Legal Bases for Processing

In jurisdictions that require a “legal basis” for processing — such as the European Economic Area and the United Kingdom — we rely on: consent (e.g., newsletter subscriptions and Academy requests; withdrawable at any time); contract performance (providing requested services or resources); legitimate interests (operating and securing the Site, communicating with prospective clients, preventing fraud — balanced against your rights); and legal obligation (tax, accounting, and record-keeping duties, or lawful government requests).

6. Email Communications: Consent and Choices

6.1 Consent-based marketing.

We send marketing and educational emails — including The Trust Nexus and announcements about new Academy materials — only to addresses provided with consent, typically through our Academy access forms or newsletter signup. You represent that any address you provide belongs to you or that you are authorized to provide it.

6.2 Every email lets you leave.

Each marketing or educational email contains a clear unsubscribe link, usually in the footer. You may also unsubscribe at any time by emailing contact@sindrianexus.com with the subject line “Unsubscribe.” We honor opt-out requests promptly and maintain suppression records so opted-out addresses are not re-added.

6.3 Transactional emails are different.

Unsubscribing from marketing does not stop transactional or relationship messages — for example, responses to your inquiries, confirmations of Academy access, or engagement-related communications for active clients.

6.4 Cadence and content.

The Trust Nexus is currently published on a weekly cadence, covering compliance-lens technology news, practical notes for founders and operators, and pointers to new Academy materials. We do not send marketing emails at unreasonable frequency, and we never share or sell the subscriber list.

7. When and How We Share Information

7.1 We do not sell your Personal Information.

We do not sell, rent, license, or trade your Personal Information to third parties for their own marketing or any other independent purposes, and we do not disclose it in exchange for monetary or other valuable consideration.

7.2 Service Providers.

We share information with trusted Service Providers who perform functions on our behalf and under our instructions. Our current providers are: Lovable (website hosting platform and aggregate visit analytics); Supabase (database hosting for form submissions); Resend (transactional email delivery); and Cloudflare (security and content delivery via the hosting infrastructure). Our contracts require providers to use Personal Information only as necessary to provide the contracted services, to protect it with appropriate safeguards, and not to use it for their own purposes.

7.3 Legal, safety, and rights protection.

We may disclose information when we believe in good faith it is necessary to: comply with applicable law, court order, subpoena, or lawful government request; enforce our Terms of Service or engagement letters; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Sindria Nexus, our clients, Site visitors, or the public. Where legally permitted, we will attempt to notify you of compulsory disclosures affecting your information, and we disclose only the minimum information required.

7.4 Business transfers.

If Sindria Nexus undergoes a merger, acquisition, or sale of assets, Personal Information may be transferred as part of that transaction, subject to confidentiality protections and notice as required by law.

7.5 With your direction or consent.

We share information when you direct us to — for example, asking us to introduce you to a referral partner — or otherwise with your consent.

7.6 Aggregated and de-identified information.

We may create and share aggregated or de-identified information that cannot reasonably identify you, for research, analytics, or other lawful purposes.

8. International Data Transfers

Sindria Nexus is based in the United States, and information we collect is processed and stored in the United States, where data protection laws may differ from those in your jurisdiction. If you access the Site from outside the United States, you acknowledge and consent to the transfer of your information to the United States as described in this Policy. Where required by law, we implement appropriate safeguards for cross-border transfers, such as standard contractual clauses, and will provide additional information upon request to contact@sindrianexus.com.

9. Data Retention

We retain Personal Information only as long as reasonably necessary to fulfill the purposes in this Policy, unless a longer period is required or permitted by law (for example, tax, accounting, or legal-hold purposes). In practice: contact inquiries are kept as long as needed to address the request plus a reasonable records period; Academy access records until you request deletion; newsletter subscriptions until you unsubscribe; client engagement records per the engagement letter and professional record-keeping duties; technical logs for a limited rolling window; and legal-hold material as long as the hold requires. When information is no longer needed and no legal basis for retention exists, we delete or de-identify it. Suppression records (such as unsubscribe lists) are retained in minimal form to honor your choices.

10. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction — including limiting access to personnel who need it, using reputable third-party platforms with established security programs, encrypted connections (HTTPS), and access controls on systems storing Personal Information. No method of transmission or storage is completely secure, and you provide information at your own risk. If we become aware of a data security incident affecting your Personal Information, we will notify you and relevant authorities as required by law and take reasonable steps to mitigate harm.

11. Your Privacy Rights and How to Exercise Them

Depending on where you live, applicable law may grant you some or all of the rights below. We extend the core rights — access, correction, and deletion — to all individuals regardless of location, except where limited by law.

• Right to know / access — request the categories and specific pieces of Personal Information we hold about you, the sources, purposes, and categories of third parties with whom we shared it.
• Right to portability — where applicable, receive a copy of your Personal Information in a portable format.
• Right to correction — request correction of inaccurate Personal Information.
• Right to deletion — request deletion, subject to legal exceptions (for example, information needed to complete a transaction, comply with legal obligations, or detect security incidents).
• Right to opt out of marketing — as described in Section 6.2.
• Right to withdraw consent / object — withdraw consent at any time; object to processing based on legitimate interests on grounds relating to your situation.
• Right to non-discrimination — we will not deny services, charge different prices, or provide different quality of service because you exercised a privacy right.

11.1 How to submit a request.

Email contact@sindrianexus.com with the subject line “Privacy Request” describing the right you wish to exercise. We will take reasonable steps to verify your identity and will respond within the timeframes required by applicable law (generally within 45 days). If we decline a request, we will explain why and inform you of any right to appeal. Where permitted by law, you may designate an authorized agent to act on your behalf.

11.2 What to expect.

We aim to acknowledge privacy requests within ten business days, verify your identity, and respond — with the requested data, a confirmation of correction or deletion, or a written explanation of any denial — generally within 45 days of a verifiable request. Requests that are manifestly unfounded or excessive (for example, repetitive requests for the same information within a short period) may be declined or subject to a reasonable fee as permitted by law; we will explain our reasoning if so.

12. U.S. State Privacy Rights

Residents of states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) have the rights described in Section 11, and in some cases additional opt-out rights for targeted advertising, sale of personal data, or certain profiling. To be clear: we do not sell personal data, we do not share personal data for cross-context behavioral advertising, and we do not profile individuals in furtherance of decisions producing legal or similarly significant effects. Exercise your rights by contacting contact@sindrianexus.com with your state of residence. Under California law specifically, we disclose the categories of personal information collected, used, and disclosed as described in Sections 3, 4, and 7; we have not sold or shared personal information as defined in the preceding 12 months; and we do not use or disclose sensitive personal information beyond purposes permitted by law.

13. Do Not Track and Global Privacy Control

Some browsers transmit “Do Not Track” (DNT) signals. There is no industry consensus on responding to DNT, and our Site does not alter its practices in response at this time. The Global Privacy Control (GPC) communicates opt-out preferences; where applicable law gives GPC legal effect, we honor it to the extent required. Because we do not sell or share personal information as defined (Sections 7.1 and 12), a GPC signal does not change our practices in most cases, but we process and record the signal as required.

14. Cookies and On-Device Storage

14.1 What these technologies are.

Cookies are small text files stored on your device by your browser. Similar on-device storage includes local storage and session storage. Our newsletter platform may also use pixels in emails to measure aggregate engagement. The table below lists what is actually present on the Site, verified against the Site’s code and hosting platform:

We do not use advertising or targeting cookies. No third-party trackers or tag managers are present on the Site, and the Site’s own code sets no analytics of its own.

14.2 Your controls.

Most browsers allow you to block, delete, or be notified about cookies through their settings (typically under Privacy or Security). Blocking strictly necessary storage may prevent parts of the Site — including forms — from working correctly. Email pixels used to measure newsletter engagement can be limited by disabling automatic image loading in your email client.

15. Children’s Privacy

The Site, Academy, and our services are directed to business professionals and adult learners and are not directed to children under 13. We do not knowingly collect Personal Information from children under 13. If you are a parent or guardian and believe your child has provided Personal Information to us, contact contact@sindrianexus.com and we will delete it promptly. Where applicable law sets a higher age threshold for consent, we apply the higher threshold.

16. Third-Party Links and Content

The Site may link to third-party websites, articles, tools, or resources for convenience and information only. We do not control, endorse, or assume responsibility for their content, privacy practices, or security; when you follow a link, you become subject to that site’s policies. Academy materials may embed third-party content (for example, a hosted video); embedded content behaves as if you visited the provider’s site directly and is governed by the provider’s policy. Where available we use privacy-enhanced embedding modes.

17. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, services, or legal requirements. We will post the revised Policy on this page and update the “Last Updated” date. Additional disclosures may apply in the future as our practices or legal obligations evolve, and this Policy will be updated to reflect them. For material changes — such as collecting a new category of Personal Information, using information for a materially new purpose, or sharing with a new category of third party — we will notify all affected parties (for example, through a Site notice or an email to subscribers) and, where required by law, obtain your consent before applying the change. Your continued use of the Site after the effective date constitutes acceptance as it applies to information collected going forward.

18. No Automated Decision-Making or Profiling

We do not use Personal Information for automated decision-making producing legal or similarly significant effects, and we do not build behavioral profiles for advertising, credit, employment, or insurance. Eligibility decisions (such as professional-track Academy access) are made by human review. Analytics are performed on aggregated or de-identified data to improve content and functionality.

19. Academy Learner Data

Student track. General materials are available to any valid email address, used solely to deliver requested materials and, with consent, related educational updates. We do not monitor, grade, or track study activity, and we do not share learner records with educational institutions or employers. Professional track. Materials with worked examples may require a business email address to verify professional context; eligibility information is used only to administer access. Academy content is written for adult learners, including college students; if you are under 18, please have a parent or guardian review this Policy with you. Our children’s privacy commitments in Section 15 apply in full.

20. Information for Job Applicants

If you apply for a role, internship, or contractor engagement, we collect the information you provide (contact details, resume, work history, and related communications) and use it solely to evaluate your candidacy and communicate with you. We do not use applicant information for marketing. If engaged, relevant information becomes part of your personnel file; if not, we retain it for up to 24 months for future opportunities unless you ask us to delete it sooner. Background checks or reference contacts occur only with your prior written consent and as permitted by law. We evaluate applicants without regard to protected characteristics, and all candidacy evaluations involve human review.

21. Contact Us

If you have questions, concerns, complaints, or requests regarding this Privacy Policy, our privacy practices, or your Personal Information, please contact us:

Sindria Nexus LLC

Email: contact@sindrianexus.com Website: sindrianexus.com

We aim to acknowledge privacy inquiries promptly and respond within the timeframes required by applicable law. If you feel your concern has not been addressed satisfactorily, you may have the right to lodge a complaint with your local data protection authority.