Private-beta policies. These pages describe the live beta and its safeguards; operator identity, jurisdiction, and final paid-service terms still require qualified legal review before public billing.
Legal center

Nexora Rank policy

Nexora Rank Privacy Policy

Version 0.3Last updated August 29, 2026Public beta

What Nexora processes, why it is needed, how automated eligibility works, and the choices available to users.

1. Scope

Effective August 28, 2026. This policy covers the Nexora private beta: website, sign-in, onboarding, dashboard, Discord bot, Roblox integration, API, status page, support, and workspaces. Nexora is not intended for children under 13. The legal operator and dedicated privacy contact will be added before public billing.

2. Data processed

  • Account data: Supabase user ID, contact email, name, avatar, session, and authentication metadata.
  • Beta applicant data: name, email address, age, review status, submission dates, Discord notification result, and a one-way hash of the private status-checking code. The readable code is shown to the applicant once.
  • Discord data: account ID, username, display name, avatar, connected server ID, authorized roles, membership, and integration status.
  • Roblox data: account ID, username, display name, avatar, communities visible to the connected account, the community selected during onboarding, public community membership and role, and authorized results.
  • Workspace data: permanent workspace ID, members, roles, plan, configuration, applications, activity, rank actions, automations, API key hash and prefix, API use, and audit records. The full API key is shown once and is not stored in readable form.
  • Eligibility data: membership in Roblox community 596263047, check times, grace dates, provider errors, and membership-policy suspension status.
  • Technical data: timestamps, request status, browser/device and approximate network information, security events, logs, and daily service-health snapshots.
  • Future billing data: customer, plan, invoice, renewal, and payment-status identifiers; Nexora does not intend to store full card details.

3. Sources

Data comes from you, authorized workspace users, Supabase Auth, Discord OAuth and APIs, Roblox OAuth and public or authorized APIs, connected game servers, Nexora security systems, and future billing providers. Roblox’s public membership endpoint may be checked without retaining a Roblox access token for that check.

4. Purposes and legal bases

Nexora processes data to create accounts and workspaces, provide integrations and automations, enforce limits and eligibility, secure and troubleshoot the service, prevent abuse, provide support, maintain auditability, and meet legal obligations. Depending on location and activity, the basis may be contract, legitimate interests, consent, or legal obligation.

5. Automated Free-plan eligibility

When enabled, Nexora compares the linked Roblox user ID of a Free workspace owner with public membership data for community 596263047. Confirmed absence starts a 48-hour grace period; a successful check after expiry can suspend the workspace. Provider errors do not start the timer or cause new suspension. Rejoining or becoming an eligible active paid or trial workspace restores a workspace suspended only for this rule. Owners may request human review.

6. Sharing

Data is shared only as needed with infrastructure, authentication, monitoring, support, and future billing providers; with Discord or Roblox for requested functions; when legally required; or to protect users and the service. Nexora does not sell personal data or use Discord or Roblox API data to train general-purpose AI models.

7. Retention

Account and workspace data is retained while needed for service. Eligibility results and grace dates remain while the workspace exists and may remain in audit records for security or disputes. OAuth data is refreshed or deleted when no longer needed under provider rules. Security records may be kept longer where necessary; deleted data can remain temporarily in encrypted backups.

8. Rights and choices

  • Disconnect or revoke Discord and Roblox access, understanding required features may stop.
  • Request access, correction, deletion, restriction, objection, or portability where applicable.
  • Withdraw consent where it is the basis, without affecting earlier lawful processing.
  • Request human review of an automated eligibility or suspension result.
  • Request workspace deletion subject to necessary security, legal, audit, and backup retention.
  • Complain to the relevant data-protection authority.

9. Security and transfers

Nexora uses scoped OAuth, encrypted transport, row-level database controls, isolated secrets, and audit records. No internet service is perfectly secure. Vercel and Supabase may process data in locations covered by their terms; appropriate transfer safeguards will be used where required.

10. Contact and changes

Use official Nexora support for beta privacy requests and avoid posting personal data publicly. A dedicated privacy contact and operator identity will be published before public billing. Material changes will be dated and communicated where required.

11. Discord support conversations

When you DM the separate Nexora Support bot, the message content, attachments, Discord account ID, display name, avatar, timestamps, and staff replies are relayed to a protected ticket channel in the private Nexora Staff server. Authorized support agents can view and answer the conversation. When a ticket closes, Nexora creates an HTML transcript in a restricted transcript archive before removing the live channel. Transcripts and limited security records are retained only as reasonably needed for support continuity, safety, disputes, and legal obligations.

12. Staff access records

Staff console access uses a one-time 25-character code generated by the Nexora bot and Discord authorization. Nexora stores only a cryptographic hash of the code, its creator, role, expiry, redemption time, and the authorized staff member's Discord ID, display name, avatar, access role, and session expiry. Codes expire quickly and cannot be reused.

13. International users

Nexora may be accessed from countries with different privacy laws. Where required, Nexora will use recognized contractual or legal transfer mechanisms and provide additional local disclosures. Users remain responsible for ensuring that their workspace use and collection of community data are lawful in their location.

14. Requests, verification, and appeals

Nexora may need to verify identity, account control, or workspace ownership before completing a privacy request. Requests may be limited or refused where the law permits, including to protect another person, preserve security, comply with legal obligations, or retain evidence of abuse. Where available, a user may appeal a refusal through official support.