Privacy Policy

1. Introduction

This Privacy Policy describes how Yisrael Gottlieb, an individual doing business as "Nexertise" ("we," "our," or "us"), collects, uses, and protects information when you use the Nexertise platform, including the nexertise.com website, the NexAds advertising product, and the NexFeed professional content platform (collectively, the "Platform").

Nexertise is a Verified-Engagement Advertising network connecting identity-verified professionals with advertisers who want their attention. By using the Platform, you agree to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, phone number (optional), and account preferences.
• Professional Profile: Industry, role, expertise areas, work history, and public-facing profile content.
• Identity Verification: Government-issued photo ID, a live selfie, and verification metadata, processed by Stripe Identity (see Section 4.2).
• Payment and Payout Information: Bank account details for payouts (collected and stored by Stripe Connect, not by us). For advertisers: card details and billing address (collected by Stripe Checkout).
• Biometric Authentication Credentials (passkeys): If you enroll a passkey or biometric sign-in (WebAuthn), your fingerprint, face, or other biometric data never leaves your device. We store only the public cryptographic credential returned by your device.
• Face Check Before Your First Withdrawal (biometric data): A short video selfie, processed by Amazon Web Services, and a face index derived from it. See Section 2.5.
• Campaign Content: For advertisers, the pitch content, images, quiz questions, and any other campaign materials you submit.
• NexFeed Content: Posts, comments, votes, and follows you create on NexFeed.
• Insights: Ratings, recommend/not-recommend flags, and written feedback you provide after engaging with a NexAd. Approved insights are published publicly on NexFeed and NexTrust under your verified professional identity — see Section 4.5.
• Support Communications: Messages you send us through support chat, email, or feedback forms.

2.2 Information Collected Automatically

• Usage Data: Pages visited, actions taken, campaigns engaged with, time spent on the Platform, and navigation patterns.
• Device Information: Browser type and version, operating system, device type, screen resolution, language, and timezone.
• IP Address and Network Data: Your IP address, approximate geolocation derived from it, and network information used for security and fraud prevention.
• Coarse Account Context: To detect accounts operated by someone other than the account holder, we keep a daily summary of the country, region, time zone, network type (for example mobile carrier or data center) and device type (phone, tablet or computer) your sessions came from, including the coarse region recorded when you complete the face check. We also compare the timing of your NexAd activity (when you start NexAds and which ones you start) with other accounts' to detect groups of accounts run together. The summary never contains your IP address and is deleted after 90 days. We process it on the basis of our legitimate interest in fraud prevention.
• Device Fingerprint: We generate a device fingerprint from non-identifying device characteristics (screen resolution, timezone, language, installed fonts, and similar signals). The fingerprint is stored exclusively as a one-way cryptographic hash and cannot be reversed to identify your device or you personally.
• Automated-Traffic Check: When you sign up, reset your password, submit a NexAd, or withdraw funds, our host Vercel runs an invisible check in your browser (Vercel BotID, powered by Kasada) that examines browser and device signals to tell people from automated scripts and bots. Nothing is shown to you, and we receive only the result.
• Cookies and Local Storage: We use essential cookies and browser storage for authentication, session management, and preferences. See Section 8.
• Campaign Attribution: If you arrive through a link carrying campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content or ref), we record those values, the page you landed on, the host of the referring site — never the full referring URL — and the Google Analytics client id already set by the analytics cookie described in Section 8. They are held in your browser's session storage for the current tab, and if you create an account they are stored on it, so we can tell which campaigns bring people to the Platform.

2.3 Proof-of-Attention Telemetry (NexAd Engagements)

When you engage with a NexAd, the Platform runs an anti-fraud system we call Proof-of-Attention. It is designed to detect automated engagement, AI impersonation, and attempts to game the comprehension-verification system. We collect:

• Engagement signals: Whether the NexAd tab is active, focus and attention patterns, scroll behavior, and time spent reading. Used to enforce minimum-engagement rules and distinguish human reading from automated scraping.
• Interaction timing: Timing of how you answer comprehension questions and complete biometric prompts. Used to detect patterns inconsistent with genuine human attention.
• Submitted text: Your free-form feedback and structured-prompt responses are analyzed by automated tools, including a commercial AI-text detection service (listed in our sub-processor list), to identify submissions that appear AI-generated rather than authored by you. These results are never passed to the automated feedback review (Section 3.1); on their own they can only delay a release to a dated release or lower a tier, never reject a submission or issue a strike.
• Limited interaction telemetry: We also capture lightweight signals (e.g., paste events, right-click attempts, keystroke-timing distributions) and, for each NexAd session, a count of how many characters of your written responses arrived by each input method (typed, pasted, dropped in, entered through an input-method or dictation tool, autocorrected, or other). The counts never include the text itself. Automated checks compare the input source and timing of a session for consistency; an inconsistency can add a non-decisive signal to your account that never acts on its own and counts only alongside other, independent evidence of fraud. Dictation, voice typing, pasting, and assistive software are treated as neutral and never count against you. These signals are stored with your submission.
• Content-display record: When a NexAd's content is drawn on your screen, your browser sends a short notice, and we record for that session whether and when the content was displayed. It is used the same way as the input-source counts above (a non-decisive consistency signal) and is deleted after 90 days.
• Biometric passkey and attention challenges: Registering a WebAuthn passkey is required to activate paid NexAds, and some engagements present a presence challenge. You complete these with your device's built-in authenticator; no biometric data is transmitted to us — only the public cryptographic credential returned by your device.

Proof-of-Attention telemetry is used solely to detect fraud and determine whether a NexAd engagement qualifies for compensation. It is not shared with advertisers and is not used for advertising targeting. These signals never issue a strike, a ban or an earnings reversal on their own: they can delay a release (never past the 45-day limit) or count alongside other, independent evidence. A ban or reversal requires confirmed evidence, and you can contest it (Section 3.1 and Section 6.1).

Proof-of-Attention is part of the Iron Dome, the Nexertise 18-layer verification architecture that keeps the professional network authentic. A high-level overview of the layers is on our Security page; specific detection methods, thresholds, and vendor implementations are confidential operational detail.

2.4 Information from Third Parties

• Stripe Identity: Identity verification results (pass/fail), verified name, verified date of birth, verification metadata, and the country of the address on your ID when the verification provides one (used only for fraud prevention; see Section 5 for how long we keep it).
• Stripe and Stripe Connect: Payment and payout status, dispute/chargeback notifications, and Connect account status. We also read the name and date of birth on your Stripe payout account and compare them with your verified identity, to make sure payouts go to the person who verified the account (fraud prevention). We do not keep the payout account's name or date of birth in readable form. We keep the result of the comparison and keyed one-way codes derived from these details and from your verified identity, which cannot be turned back into the details.
• Email providers (Resend): Delivery status, bounce, and complaint data for transactional emails.

2.5 Biometric Data: The Face Check Before Your First Withdrawal

Before your first withdrawal we ask for a quick face check. It is the only feature in which Nexertise collects biometric data, and we only do it after you give written consent on the face check screen (a checkbox and your typed name, recorded with the date and the version of the consent text).

• What we collect: a short video selfie taken in your browser, and a face index (a numeric template of your face's geometry, not a photo) derived from it.
• Purpose: only to confirm that a live person is present, that you have only one Nexertise account, and that you are the person who completed identity verification, by comparing your face check with your ID verification photo (fraud prevention). We do not use it for advertising, profiling, or any other purpose.
• Comparing your face check with your ID verification photo: after a successful face check, we compare the face check frame with the selfie you took during Stripe Identity verification. The ID photo is retrieved from Stripe only for this comparison, processed in memory by AWS Rekognition, and discarded; we store only the resulting match score. If the photos do not match closely, the account goes into an automatic review before the next withdrawal: you can retry the face check or verify with your ID document, and otherwise withdrawals to your existing verified payout account resume on a set date, at most 45 days later.
• Processor: Amazon Web Services, Inc. (AWS Rekognition) processes the video and stores the face index for us, in the AWS region we operate in (currently the United States), in a collection used only by Nexertise. Nexertise does not keep the video or any photo of your face; the frame used for the check is processed in memory and discarded. We have opted out of AWS using this content to develop or improve its own services.
• Retention and deletion: the face index is permanently deleted when you close your account, or 12 months after your last payout (12 months after the check if you never withdraw), whichever comes first. If a face check sends your account to review, the review record keeps only the other account's identifier and a similarity score, never images. The match score from comparing your face check with your ID verification photo is deleted at the same time as the face index.
• No sale or disclosure: we never sell, lease, trade, or otherwise profit from your biometric data, and we do not disclose it to anyone other than AWS as our processor, except where required by law or a valid legal order.
• Consent record: your signed consent (typed name, date, consent text version; no face data) is kept for 5 years after your account is closed, as proof that we asked for and received your consent, and then deleted.
• Your choice: you may decline the face check and request a review instead. You can verify with your ID document (through Stripe Identity) instead of the face check; otherwise withdrawals to your existing verified payout account resume automatically on a set date, at most 45 days after you ask.
• Protection: biometric data is protected with the same or stronger safeguards we use for other sensitive information (see Section 7).

This section is our written retention and destruction policy for biometric data, including for the purposes of the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and similar laws.

3. How We Use Your Information

We use the information we collect to:

• Create and operate your account and keep you signed in.
• Verify your identity and maintain the trust tier of the professional network.
• Match you with NexAds relevant to your industry and tier.
• Process payments and payouts and calculate platform fees.
• Calculate your Reputation Score (RS), tier, and daily engagement limits.
• Detect and prevent fraud, abuse, Sybil accounts, AI impersonation, and attempts to game the comprehension system.
• Issue, appeal, and expire strikes against your account under our Strike System.
• Make automated decisions about your submissions, campaigns, employer requests, tier and the timing of releases, and handle contests and human reviews of those decisions (see the box below and Section 6.1).
• Provide advertisers with aggregated, anonymized engagement results (see Section 4.1).
• Publish approved Consultant insights as verified-author posts on NexFeed and as contributing reviews on NexTrust product/company listings (see Section 4.5).
• Send transactional emails (account, campaign, payout, security).
• Improve Platform reliability, performance, and safety.
• Comply with legal obligations, respond to law-enforcement requests, and enforce our Terms of Service.

3.1 Automated Decisions and AI Processing

What is processed. To decide whether NexAd feedback meets the published standard, we send your feedback and the question it answers, together with a short factual summary of the campaign's content, to AI models (currently Anthropic's Claude models) through the Vercel AI Gateway. A second, independent check sees only the question and your feedback. Advertiser campaign content, quiz questions and feedback prompts are processed the same way when a campaign is reviewed, and the campaign summary is built once per campaign version. We do not send your name, email address, identity documents, biometric data, payment details or account history to these models, and we use zero-data-retention settings where the gateway and model provider offer them. Content sent to these providers is not used to train their models under their API terms.

Decisions made automatically. Approval or rejection of NexAd submissions, approval of campaigns and campaign edits, employer-domain requests, tier changes, and the dates on which earnings are released are decided automatically. Rejections come with a one-sentence reason. The logic is described in our Terms of Service, Section 4.9. The consequence for you is limited to that decision: an automated decision about a submission never issues a strike on its own, and no automated review keeps matured earnings from being released more than 45 days after they became available, except during an open payment dispute or a confirmed-fraud hold.

Your options. You may contest a rejected submission from your Activity page; a separate automated check reviews it again within 14 days. If you are in the EU, EEA or UK you may then ask for a person to review the decision (see Section 6.1). We keep the decision, its reason, the model and rubric version, and the contest outcome with the submission for as long as the submission record is kept (Section 5), so that a contest or review can re-run the same configuration.

4. Information Sharing

4.1 With Advertisers

When you complete a NexAd engagement, the advertiser receives:

• Your insights (rating, recommend/not-recommend flag, and free-form feedback).
• Your tier (T1–T5) and the industry and role listed on your profile.
• Aggregated comprehension results across the campaign.

We never share your name, email address, phone number, physical address, IP address, government ID, biometric credentials, or Proof-of-Attention telemetry with advertisers.

4.2 With Service Providers

We share information with trusted third parties who operate parts of the Platform on our behalf:

• Supabase: Database, authentication, and file storage (hosted in the United States).
• Stripe, Stripe Connect, and Stripe Identity: Payment processing, payouts, and identity verification.
• Amazon Web Services (AWS Rekognition): The face check before your first withdrawal: liveness detection and the duplicate-account face index (see Section 2.5).
• Vercel: Website hosting and edge infrastructure.
• Resend: Transactional email delivery.
• Sentry: Application error monitoring and crash reporting. Sentry may receive partial request data (URL, user-agent, and error context) when an error occurs.
• Google Analytics 4: Aggregated website analytics. We use standard GA4 with IP anonymization; we do not enable advertising features or cross-site tracking. We also send GA4 a copy of our own conversion events (for example account created, email confirmed, identity verified, deposit made) from our servers, each carrying the campaign parameters above and an opaque account identifier. We never send your name, email address or any other contact detail, and advertising personalisation stays off on these events.
• AI-text detection service: A commercial third-party service evaluates your free-form feedback and structured-prompt responses for AI-generation signals as part of our fraud-prevention stack. The current provider is named in our sub-processor list; transfers are over TLS and the provider does not use submission content to train its models.
• AI model providers: AI model providers are used for automated feedback and campaign review (Section 3.1), internal moderation, content-quality review, and support tooling. Feedback and campaign review run on Anthropic's Claude models through the Vercel AI Gateway, with zero-data-retention settings where available. Current providers are listed in our sub-processor list; content sent to these providers is not used to train their public models under their API terms.

Each provider is bound by its own data protection obligations and is only authorized to use your information to perform services for us. Our current sub-processor list identifies the specific providers in each category and is updated when providers change.

4.3 For Legal and Safety Reasons

We may disclose your information when we reasonably believe disclosure is necessary to:

• Comply with applicable law, subpoena, court order, or government request.
• Enforce our Terms of Service, including fraud and abuse investigations.
• Protect the rights, property, or safety of Nexertise, our users, or the public.
• Detect, prevent, or address security, fraud, or technical issues.

4.4 Business Transfers

If Nexertise is acquired, merged, or sold — or if a successor entity is formed (for example, when the current sole-proprietorship incorporates) — your information may be transferred to the acquiring or successor entity subject to the same protections described in this policy.

4.5 Publicly on NexFeed and NexTrust

For Consultants. When a NexAd engagement is approved through our review process, the insight you submitted is also published publicly. Specifically:

• Your rating, recommend/not-recommend flag, and free-form feedback are published as a verified-author post on NexFeed, attributed to your public profile (display name, avatar, tier, and industry). NexFeed posts are visible to all Platform users and to logged-out visitors at nexertise.com, and may be indexed by search engines and other third-party crawlers.
• The same insight contributes to the campaign's associated NexTrust product or company listing, which displays a public, tier-weighted trust score along with the individual contributing reviews.

What is not published. We do not include your email address, phone number, physical address, IP address, government ID or verification metadata, biometric credentials, Proof-of-Attention telemetry, payout details, or any private support communications in NexFeed posts or NexTrust listings.

For Advertisers. When you fund a NexAd campaign, you are purchasing verified, public, attributed professional feedback — not private market research. Approved Consultant insights produced by your campaign are published on NexFeed and contribute to the public NexTrust score for your product or company listing under that Consultant's verified identity. Both favorable and unfavorable feedback is published; unfavorable feedback is not, in itself, grounds for removal or refund. See Section 5.8 of the Terms of Service for the full advertiser disclosure.

Removal requests. To request removal of a specific published insight, NexFeed post, or NexTrust review, email privacy@nexertise.com. We honor lawful removal requests (for example, where required by GDPR Article 17 or applicable U.S. law) and review good-faith requests on the merits, but Nexertise may retain insights that document Terms violations, fraud investigations, or other matters of legitimate public interest. Aggregated or anonymized signals derived before removal may continue to inform Reputation Score and NexTrust score calculations.

5. Data Retention and Account Deletion

We retain personal information for as long as your account is active or as needed to provide services. Financial records (payouts, invoices, tax reporting) are retained for a minimum of seven (7) years as required by tax regulations.

You may delete your account at any time from your account settings. Upon account deletion, any remaining balance in your wallet, including pending earnings and escrowed advertiser funds, is permanently forfeited and cannot be recovered. We recommend withdrawing all available funds before deleting your account.

Biometric data (the face check face index) is deleted when you delete your account, or 12 months after your last payout if that comes first; see Section 2.5. The country of the address on your verified ID follows the same rule: it is deleted when you delete your account, or 12 months after your last payout (or after your verification, if you never withdrew), whichever comes first. The coarse account context summary (Section 2.2) and the per-session content-display record (Section 2.3) are deleted after 90 days. Per-session input-source counts (Section 2.3) are kept with the submission they belong to, like the rest of its Proof-of-Attention telemetry. The signed face check consent record (no face data) is kept for 5 years after account deletion.

After deletion, we retain a one-way cryptographic hash of your email address and IP address for fraud prevention. These hashes cannot be reversed to recover the original values. Retention periods:

6. Your Rights

6.1 Rights Under GDPR (EU / EEA / UK Residents)

If you are located in the European Union, European Economic Area, or United Kingdom, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your personal data (subject to legal retention obligations).
• Portability: receive your data in a structured, machine-readable format.
• Restriction: restrict processing in certain circumstances.
• Object: object to processing based on legitimate interests.
• Withdraw consent: withdraw consent at any time for processing based on consent.
• Human review of automated decisions: where a decision about you is based solely on automated processing (Section 3.1), obtain human intervention, express your point of view and contest the decision. After the automatic contest of a rejected submission has finished, use “Ask a person to review” on your Activity page (once every 30 days), or email us. A request never holds or delays your earnings.
• Lodge a complaint: with your local data protection authority.

Our lawful bases for processing are (a) contract performance, (b) legitimate interests in fraud prevention and Platform integrity, (c) your consent for optional features, and (d) compliance with legal obligations. To exercise these rights, email privacy@nexertise.com.

6.2 Rights Under CCPA / CPRA (California Residents)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and (if applicable) sell or share about you.
• Delete personal information we have collected, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt-out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA.
• Limit use of sensitive personal information.
• Non-discrimination for exercising your rights.

We do not offer financial incentives for personal information. To exercise your rights, email privacy@nexertise.com. We will verify your identity before fulfilling your request.

6.3 Data Processing Agreement

Advertisers who transfer personal data of EU/EEA/UK data subjects through the Platform may request a Data Processing Agreement by emailing privacy@nexertise.com.

7. Data Security and Breach Notification

7.1 Security Measures

We implement commercially reasonable technical and organizational measures to protect your personal information, including:

• Encryption in transit (HTTPS / TLS 1.2+).
• Encryption at rest for sensitive data stored in Supabase.
• One-way cryptographic hashing of identifiers in deletion records.
• Row-level security (RLS) policies enforcing per-user access in the database.
• Access controls and least-privilege principles for internal tooling.
• Audit logging of administrative actions.

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7.2 Data Breach Notification

If we become aware of a security incident that has resulted in, or is reasonably likely to result in, unauthorized access to or disclosure of your personal information, we will:

• Investigate and contain the incident as quickly as practicable.
• Notify affected users without undue delay, by email to the address associated with your account and, where appropriate, by prominent notice within the Platform.
• For incidents affecting EU / EEA / UK residents, notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Articles 33 and 34.
• For incidents affecting New Jersey and other U.S. state residents, provide notification in the manner and within the timeframes required by applicable state breach-notification laws (including N.J.S.A. 56:8-163).
• Include in our notice, where known: a description of the incident, the categories of information affected, the likely consequences, steps we are taking in response, and steps you can take to protect yourself.

We will not delay notification to investigate or evaluate liability. If a law enforcement agency determines that notification would impede an active criminal investigation, we may delay notification only to the extent and for the period they require in writing.

To report a suspected security issue or vulnerability, email security@nexertise.com.

8. Cookies and Similar Technologies

We use the following categories of cookies and local storage:

• Essential: authentication tokens, session state, and CSRF protection. These cannot be disabled while using the Platform.
• Preference: UI preferences (theme, layout, dismissed banners).
• Analytics: Google Analytics 4 cookies for aggregate usage analytics. We also count visits to our public pages ourselves: your browser keeps a random id in its local storage so repeat visits count once. It is not linked to your account, we store no IP address with it, and clearing your browser's site data removes it. Separately, a session-storage entry holds the campaign parameters your visit arrived with (see Section 2.2). The entry itself is first-party and is cleared when you close the tab; the campaign parameters it holds are sent to Google Analytics with the conversion events described in Section 4.2, and to no other third party.
• Fraud prevention: Stripe sets fraud-prevention cookies on payment pages.

We do not use advertising or cross-site tracking cookies. You can disable non-essential cookies through your browser settings; the Platform will continue to function.

9. Children's Privacy

The Platform is intended only for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a user under 18, we will delete it promptly.

10. International Transfers

Your information may be stored and processed in the United States and in other countries where our service providers operate. For transfers of personal data out of the EU/EEA/UK, we rely on Standard Contractual Clauses or equivalent safeguards.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or a prominent notice on the Platform at least seven (7) days before the change takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

12. Contact

For questions about this Privacy Policy or to exercise your privacy rights, contact:

A mailing address for legal notices will be added when a registered business address is available; until then, email notice to legal@nexertise.com is sufficient.