Privacy Policy

This document is provided in English and Georgian. In case of discrepancy, the English version shall prevail.

Document: Privacy Policy
Version: 1.1
Effective Date: 15 October 2026
Last Updated: 15 October 2026
Operated by: Nixyum LLC · Reg. No. 400458045
Address: Tbilisi, 13 Nikoloz Janashia Street, Georgia
Governing Law: Georgia
Privacy Contact: [email protected]

1. Introduction

This Privacy Policy ("Policy") describes how Nixyum LLC ("Nixyum", "we", "us") collects, processes, uses, shares, and retains Personal Data in connection with the Nixyum platform ("Platform"), and explains the rights of Users as Data Subjects under the Georgian Data Protection Law.

Nixyum is the Data Controller for all Personal Data processed in connection with the Platform. This Policy is published in fulfilment of Nixyum's transparency obligations under the Georgian Data Protection Law, with which the Platform's data processing is designed to comply. Georgia's data protection framework is substantially harmonised with the GDPR.

This Policy forms part of the Nixyum Policy Suite and is incorporated by reference into the Terms of Service. Capitalised terms used but not defined in this Policy have the meanings assigned in the Master Definitions.

By registering an Account or using the Platform, Users acknowledge that they have read and understood this Policy. If a User does not agree with any part of this Policy, they must not use the Platform.

2. Data Controller

The Data Controller responsible for Personal Data processed through the Platform is:

Legal Entity: Nixyum LLC (შპს „ნიქსიუმი")
Reg. No.: 400458045
Address: Tbilisi, 13 Nikoloz Janashia Street, Georgia
Privacy Contact: [email protected]

Nixyum will appoint a Data Protection Officer (DPO) where required by the Law of Georgia on Personal Data Protection, including where the nature, scope, or purposes of Nixyum's processing constitute systematic and large-scale monitoring of Users' behaviour, or where any other statutory trigger applies. Pending the appointment of a formal DPO, all data protection enquiries are handled by the Privacy Contact at [email protected]. Where a DPO is appointed, Nixyum will notify the State Audit Office of Georgia within the period required by law and will publish the DPO contact in this Section.

3. At a Glance — Key Facts

The following summary provides an overview of Nixyum's core data practices. Full detail is provided in the sections that follow.

What we collect: Account and sign-in data; profile data for your Nex and your Nyx; Content; private messages; device, security and usage data; cookie and consent choices.
Why we collect it: To provide and secure the Platform; to run your two Personas, Nex and Nyx; to keep the Platform safe and enforce the Terms of Service; to comply with Georgian law.
Legal bases: Contract; Legitimate Interest (subject to a balancing assessment); Consent; Legal Obligation.
Who we share data with: Service providers that process data for us under data processing terms (listed on the help centre's Legal & Compliance page); law enforcement on a valid legal request. We do not sell personal data.
Where data is stored: In EU data centres. Our team in Georgia accesses it under SCCs. Some providers (push notifications, content delivery and bot protection) may process limited data outside the EU, including in the US, under SCCs or equivalent safeguards (Section 8).
How long we keep it: As set out in the Data Retention Schedule. Account data for the life of the Account; full IP addresses removed after 72 hours; most logs deleted after 90 days; Content you delete removed within 30 days; financial records for at least 5 years.
Feed ranking: The Platform orders each feed automatically using Engagement Signals. Each Persona's feed is ranked from that Persona's own activity. Legal bases: Contract and Legitimate Interest. DPIA-01 covers this processing.
Age verification: You give your date of birth at sign-up, and registration is refused under 18. Additional age verification may be introduced if the law or platform risk requires it. Verification data is kept for no more than 30 days.
Direct Marketing: Only with your opt-in consent. Never on soft opt-in or pre-ticked boxes.
Your rights: Access (including a self-service download of your data), rectification, erasure, restriction, objection, portability, withdrawal of consent, and a complaint to the Supervisory Authority.
Minors: The minimum age is 18. An Account found to belong to someone under 18 is blocked at once and deleted after a review (Section 12).
Nex and Nyx: Nixyum knows which Account your Nex and your Nyx belong to. Other Users cannot see that link, and Nixyum discloses it only in the cases listed in Section 6.3.

4. Personal Data We Collect

4.1 Data You Provide Directly

Account Registration Data: your email address and password (stored as a salted hash, never in plain text); your first and last name, which become your Nex's display name until you change it and are used to greet you in our emails; your date of birth and gender; an invitation code, if you used one; and when you accepted the Terms of Service and this Policy. For sign-up with Google or Apple, see Section 4.3. Your name, date of birth and gender are stored with your Account and never shown on your Nyx.
Nex and Nyx Profile Data: for each Persona, a display name and handle, a profile photo or avatar, a bio and the interests you choose. On your Nex you may show optional details, such as your age, gender, location, website, phone number or relationship status, and choose who can see each one; your date of birth itself is never shown. Your Nyx never shows your age or gender. A new Nyx receives a generated nickname, which you can change.
Sparks Card: if you complete a Sparks card, the details you put on it, such as an introduction, your city, gender, languages and interests, and your answer to a prompt. Other Users can see the card when they discover people through Sparks. You can hide your card from Sparks at any time in the card editor.
User Content: all text, images, photographs, audio, video, links, code, files, posts, comments, reactions, and other material the User creates, uploads, posts, or transmits on or through the Platform, whether as their Nex or their Nyx, including through Act As.
Private Messages: message text, attachments and voice messages, send and read times, and recipients. Private messages are encrypted in transit and when stored, but they are not end-to-end encrypted (see Section 7.1).
Support Communications: the content of support tickets, emails and feedback you send us, and related account information you submit when asking for help.

4.2 Data Generated by Platform Use

Technical and Security Logs: your IP address when you sign in and use key features; device type, operating system and browser; session identifiers; sign-in and sign-out times; failed sign-in attempts; rate-limit events; and the approximate location (city and country) derived from your IP address, used to show your active sessions and to alert you to sign-ins from new devices. If you sign up with email, we also keep a pseudonymised record of the network and type of device you signed up from, for the life of the Account, to investigate abuse. Full IP addresses are removed after 72 hours, except in the record of a confirmed case of child sexual abuse material, which we must keep and report; after that we keep only a pseudonymised network identifier and the country (see Section 9 and the Data Retention Schedule).
Usage Data: app version; error reports, which are always on because the Platform needs them to work and which hold only what is needed to fix the error; and, only if you allow analytics in the cookie settings, page-speed measurements and records of how features are used (for example, that a post was created). Nixyum uses no third-party analytics service.
Cookie and Consent Data: cookies and similar browser storage, and the consent choices you make, as described in the Cookies Policy.
Persona Usage Data: internal records of which Persona (Nex or Nyx) you used for each piece of Content. They are used for safety and moderation only and are never shown to other Users. Switches between Personas are counted as daily totals that identify no one; if you allow analytics, a switch is also recorded as a feature use, with its direction but never the Persona you switched to.
Notification Data: if you allow push notifications, a token that our push notification provider uses to deliver them to your device. It is deleted when you sign out of that device, or after 90 days without use. A notification about a private message shows who wrote, never what they wrote.

4.2.1 Engagement Signals (Feed Composition)

To compose and personalise each User's Content feed, Nixyum processes Engagement Signals — signals derived from User interactions with Content on the Platform. Engagement Signals currently include: whether a User has viewed, dwelled on, reacted to, commented on, hidden, or followed Content or accounts. Records of what a User viewed and for how long are kept in identifiable form for 31 days; after that only per-post totals that name no viewer remain. Reactions, comments, hides and follows stay until the User undoes them or the Account is deleted. They are recorded per Persona, and each Persona's feed is ranked from that Persona's own activity. Nixyum does not use Engagement Signals to build advertising profiles or to infer Special Category Data.

4.3 Data Received from Third Parties

Google and Apple Sign-In: if you sign up or sign in with Google or Apple, we receive from that provider your email address and the identifier it assigns to your account, and, where the provider shares them, your name and profile picture. We never receive your Google or Apple password. You can unlink a provider in Settings if another way to sign in remains.
Support by bank transfer: the Platform takes no card payments, and Nixyum receives no payment card data. If you choose to support Nixyum by bank transfer to the account shown in the app, our bank gives us the details of the transfer: the sender's name and account number, the amount, the date and any message added. We keep them as financial records (Section 9) and do not link them to your Account unless you tell us the transfer was yours. The banks process the transfer as independent controllers under their own privacy policies. If paid features are introduced, the payment provider will be named in this Section before it is used, and Users will be notified.

4.4 Data Nixyum Does Not Collect

Nixyum does not proactively collect Special Category Data (data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data for identification purposes, genetic data, trade union membership, or data concerning sex life or sexual orientation). Users may voluntarily disclose Special Category Data in their Content or profile; any such disclosure is addressed in Section 11.

Nixyum does not knowingly collect data from anyone under 18. If Nixyum learns that an Account belongs to someone under 18, the Account is blocked at once and then deleted as described in Section 12.1.

5. Purposes and Legal Bases for Processing

Nixyum processes Personal Data under the following legal bases, as defined in the Master Definitions. All processing activities are set out in full detail, including recipients and retention periods, in the Data Map. Every processing activity based on Legitimate Interest is supported by a documented Legitimate Interests Assessment (LIA) maintained internally by Nixyum.

5.1 Contract Performance

Legal Basis: Performance of the Terms of Service agreement between Nixyum and the User. Processing for this purpose includes:

Creating and maintaining User Accounts, and letting you sign in, including with Google or Apple.
Operating your two Personas, Nex and Nyx, including switching between them and Act As.
Publishing and distributing User Content to other Users.
Composing and ordering the User's Content feed (feed ranking) using Engagement Signals.
Delivering private messages to their recipients.
Showing your Sparks card to other Users, if you complete one.
Providing customer support.
Sending service messages, such as account verification, password reset, security alerts and service notices, by email and, where you allow them, by push notification.

5.2 Legitimate Interests

Legal Basis: Legitimate interests of Nixyum or a third party, where those interests are not overridden by the fundamental rights and freedoms of the Data Subject. Each processing activity under this basis has been assessed through a documented LIA. Processing for this purpose includes:

Platform security: maintaining security logs; detecting and preventing unauthorised access, fraud and abuse; and alerting you to sign-ins from new devices.
Trust & Safety: moderation, including automated checks of Content and private messages for material that breaks the Community Guidelines (Section 15.2); maintaining the Persona-to-Account link for accountability; processing Reports.
Ban enforcement: keeping a one-way coded form of the email address of a terminated Account, so that it cannot be used to register again.
Feed ranking: composing and ordering each User's personalised Content feed on the basis of Engagement Signals, subject to a documented Legitimate Interests Assessment.
Improving Trust & Safety Models: using Content, in pseudonymised form, to evaluate and improve the Trust & Safety Models, under the rules in Section 15.5.
Platform improvement: internal operational metrics derived from data Nixyum already holds, to understand usage and improve features. Analytics beyond this runs only with your consent (Section 5.3).
Legal defence: retaining data necessary to defend against legal claims or enforce the Terms of Service.
Business continuity: maintaining encrypted backups for disaster recovery.

Legal Basis: Freely given, specific, informed, and unambiguous consent provided by the User. Consent may be withdrawn at any time without affecting the lawfulness of prior processing. Processing for this purpose includes:

Analytics: page-speed measurements and records of how features are used, only if you allow analytics in the cookie settings.
Direct Marketing communications, where applicable.
Any other processing activity for which Nixyum specifically requests consent.

5.4 Legal Obligation

Legal Basis: Compliance with a legal obligation to which Nixyum is subject under Georgian law. Processing for this purpose includes:

Retaining financial and tax records under the Georgian Tax Code.
Complying with valid court orders, law enforcement requests, and regulatory directions.
Preventing the dissemination of child sexual abuse material (CSAM), which is a crime under Georgian law (Section 15.3).
Data Breach notification to the Supervisory Authority.
Responding to Data Subject rights requests.

5.5 Vital Interests

Legal Basis: The vital interests of the User or of another person. Where Nixyum learns that a person's life or physical safety is in immediate danger, it may alert the emergency services and give them the information they need to help. This basis is used only in such an emergency, and only for that purpose.

Legal Basis: Freely given, specific, informed, and unambiguous affirmative opt-in consent.

Nixyum may send Direct Marketing communications (promotional messages about Platform features, new services, or Partner offers) only to Users who have provided affirmative opt-in consent specifically for that purpose. Nixyum does not rely on soft opt-in, pre-ticked consent boxes, or legitimate interest as a basis for Direct Marketing.

Users may withdraw consent to Direct Marketing at any time by using the unsubscribe mechanism in any marketing communication or by contacting [email protected].

Upon receipt of a valid opt-out request, Nixyum will cease all Direct Marketing communications within seven (7) working days.

Any User identified as a Minor (under 18) is excluded from all Direct Marketing, and their Account is handled as described in Section 12.1.

Opt-in consent for Direct Marketing is separate from and independent of consent to any other processing activity. Withdrawal of Direct Marketing consent does not affect the User's access to the Platform or any other service.

6. The Dual Persona System — Privacy Considerations

Each Account has two Personas: a Social Persona, which the Platform calls Nex and by which other Users know you, and an Anonymous Persona, which the Platform calls Nyx and which does not show other Users who you are. You can switch between them at any time, and Act As lets you post, comment or reply once as your other Persona without switching.

6.1 What Other Users See

Other Users on the Platform cannot see any connection between your Nex and your Nyx. Content posted as your Nyx is attributed to your Nyx only. Profile information, followers and Content are separate for the two Personas. Your Nyx never shows your age or gender.

6.2 What Nixyum Maintains Internally

Nixyum keeps a secure internal record of which Account each Nyx belongs to. Through it, Nixyum can tell which Nex and which Nyx belong to the same person. This record exists to enable:

Moderation and Trust & Safety: ensuring accountability for conduct as a Nyx and enabling enforcement of the Community Guidelines and Terms of Service across both Personas.
Legal compliance: providing a basis to identify the User behind a Nyx where required by an order of a Georgian court or by applicable Georgian law, in the cases listed in Section 6.3.
Ban enforcement: preventing banned Users from continuing to use the Platform under a different Persona.

The internal Persona-to-Account mapping is processed on the basis of Legitimate Interest (platform safety and integrity) and Legal Obligation (compliance with lawful orders). Access to it is limited to authorised staff who need it for these purposes, and every access by staff is logged. It is not shared with other Users and is not accessible through the Platform's public interface.

6.3 When the Link May Be Disclosed

The link between your Nyx and your Account will only be disclosed to third parties in the following enumerated circumstances, and in no others:

(a) In response to an order signed by a judge of a Georgian court of competent jurisdiction.
(b) Where Nixyum has a good faith and reasonable belief, based on specific and articulable facts, that disclosure is necessary to prevent an imminent threat to the life or physical safety of any identified person.
(c) As required by an applicable provision of Georgian law or a binding direction issued by the State Audit Office of Georgia or another competent regulatory authority.
(d) With the express, specific, written consent of the User whose Nyx is the subject of the disclosure request.

Nixyum will not disclose the Persona-to-Account mapping to other Users, advertisers, business partners, or any other third party outside the circumstances listed in (a)–(d) above, regardless of the reason asserted. In particular, a request from the police, a prosecutor or another authority without an order of a Georgian court is not enough: Nixyum refuses it and asks for a court order. Nixyum's own use of the link under Section 6.2 is not a disclosure.

Following permanent Account deletion, the internal Persona-to-Account mapping for the deleted Account is retained for 30 days to enable compliance with any pending disclosure obligation under (a)–(c) above, after which the link is permanently removed. Where such a request is still pending, or a legal hold applies, it is kept until the matter is resolved. A documented Data Protection Impact Assessment (DPIA-03) covers the Persona-to-Account Mapping.

6.4 Nyx Does Not Mean Absolute Anonymity

Your Nyx provides pseudonymity, separating your public identity from what you do as Nyx, but it does not make you anonymous to Nixyum. Nixyum keeps the link described in Section 6.2 and may act on it in the circumstances described in Section 6.3. Do not post anything as Nyx that you could not justify if the link were disclosed in those circumstances.

Push notifications are delivered by a push notification provider. Unless the receiving device uses encrypted notifications, which no iPhone or iPad does today, the provider can see what a notification says, which Persona it is for and who sent it, so when that device receives notifications for both your Nex and your Nyx, the provider can tell that both go to the same device.

Content posted as your Nex is visible to other Users in accordance with your privacy settings. Content posted as your Nyx is visible to other Users without showing who you are. Private messages are delivered to, and visible to, their recipients only. Profile information is displayed to other Users in accordance with your privacy settings and the nature of each Persona.

Private messages. Private messages are encrypted in transit and when stored, but they are not end-to-end encrypted, so Nixyum can read them. We do so only to deliver them, to include the messages you sent in your data download, to check them automatically for material that breaks the Community Guidelines (Section 15.2), and when an authorised member of staff reviews a reported conversation or a message held by those checks. Every staff review is logged.

7.2 Service Providers and Processors

Nixyum engages third-party Processors to operate and deliver the Platform. Processors access Personal Data only for the specific purpose for which they are engaged, under data processing terms (signed, or incorporated in the provider's terms of service) that impose data protection obligations consistent with the Georgian Data Protection Law and, by harmonisation, the GDPR. All Processors are contractually prohibited from using Personal Data for any purpose beyond Nixyum's documented instructions.

The categories of Processors engaged by Nixyum include:

Hosting, databases and background processing: the servers, databases, caches and job queues that run the Platform. EU.
Media storage and delivery: storage of photos, videos and other files in the EU, and a content delivery network that serves copies from locations close to the viewer.
Website hosting: delivery of the Platform's websites through a global network.
Email delivery: sending service emails. EU.
Push notifications: delivering notifications to your devices. Global.
Security and bot protection: protecting sign-up, sign-in and other forms against automated abuse. Global.
Computing capacity for Trust & Safety Models: the servers on which Nixyum runs its own Trust & Safety Models, in EU/EEA data centres. No third-party AI service receives User Content.
Checks against known child sexual abuse material: services that compare uploaded images with known CSAM; they receive only a code computed from an image, never the image itself. Outside the EU.

The current list of Processors, with each one's name, purpose and region, is published on the Legal & Compliance page of the Nixyum help centre (support.nixyum.com) and kept up to date.

7.3 Law Enforcement and Legal Compliance

Nixyum may disclose Personal Data to Georgian law enforcement authorities, courts, and regulatory bodies where required by applicable law, a valid court order, or a binding regulatory direction. Nixyum will authenticate all such requests before complying. Where permitted by the requesting authority and applicable law, Nixyum will notify the affected User of any disclosure. Nixyum does not disclose Personal Data to government authorities outside Georgia without a valid Georgian legal order or applicable international legal assistance mechanism.

7.4 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or part of Nixyum's assets, Personal Data may be transferred to a successor entity. Nixyum will ensure that any acquiring entity is contractually bound to process Personal Data in accordance with this Policy or a materially equivalent privacy policy. Users will be notified of any material change to the Privacy Policy arising from a business transfer in accordance with Section 17.

7.5 No Sale of Personal Data

Nixyum does not sell, rent, or otherwise transfer Personal Data to third parties for their independent commercial use, including for advertising profiling or marketing purposes. The Platform shows no advertising at present. If it does, Advertisers will receive reports on ad performance only in aggregated, anonymised form, and never individually identifiable User data.

7.6 Aggregated and Anonymised Data

Nixyum may share aggregated, anonymised data — from which individual Users cannot be identified — with business partners, in transparency reports, and for business analysis purposes. Anonymised data is not Personal Data and is not subject to data protection obligations.

8. International Data Transfers

8.1 Transfer Framework

Nixyum operates from Georgia. The Platform's servers and databases are located in the European Union, and Personal Data submitted by Users is stored and processed there. Some Processors process limited data outside the EU, as Section 8.4 describes.

8.2 Georgia to EU (User Data to Infrastructure)

Personal Data submitted by Georgian Users is transferred from Georgia to EU-based infrastructure Processors. This transfer is lawful under the Law of Georgia on Personal Data Protection on the basis that EU member states are recognised by the Georgian Supervisory Authority as providing appropriate data protection guarantees. As an additional safeguard, our EU-based Processors are bound by data processing terms that include Standard Contractual Clauses (SCCs) or equivalent clauses.

8.3 EU to Georgia (Staff Access)

Nixyum's team is based in Georgia and accesses data stored in the EU. Where the GDPR applies to this access, it is covered by Standard Contractual Clauses (SCCs) or equivalent clauses in our Processors' data processing terms. Additional safeguards include encryption of data in transit and at rest, access limited to staff who need it, and logging of staff access.

8.4 Third-Country Transfers

Some Processors process limited data outside the EU and Georgia, including in the United States: for push notifications, content delivery, security and bot protection, and checks against known child sexual abuse material. These transfers are protected by SCCs or equivalent safeguards in the Processor's data processing terms, or by another lawful transfer mechanism under the Georgian Data Protection Law. No Personal Data is transferred to any country without an identified lawful transfer mechanism. Nixyum prefers EU-based service providers and documents the transfer mechanism that applies to each Processor.

8.5 Copies of Transfer Mechanisms

Users may request a copy of the SCCs or other transfer mechanisms in place for specific transfers by contacting [email protected]. Commercial confidentiality provisions may require that certain commercially sensitive provisions of such agreements are redacted, but the data protection commitments will be disclosed.

9. Data Retention

Nixyum retains Personal Data only for as long as is necessary for the purpose for which it was collected, or as required by Georgian law. The specific retention period applicable to each category of Personal Data, together with the applicable legal basis, deletion method, and any extended retention triggers, is set out in the Data Retention Schedule.

In summary: account data is kept for the life of the Account. When you delete your Account, it is erased after 7 days, during which you can cancel; messages you sent stay with their recipients, shown as from a deleted user. Content you delete is removed within 30 days, unless it is under review, a Moderator removed it, or it is needed for a legal claim. Private messages are kept while the conversation exists; when you delete a message for everyone, its text is wiped at once and any photo, video or voice message attached to it is erased within 2 days, unless it is under review or a legal hold applies; and a conversation that every participant has deleted is removed within 30 days after the last of them deleted it, unless it has been reported or is under review, or a legal hold applies. Full IP addresses are removed after 72 hours (except in the record of a confirmed case of child sexual abuse material, see Section 4.2); security logs (except the sign-up record described in Section 4.2), sign-in history and usage records are deleted after 90 days; reports are deleted 12 months after the case closes, and the case file (Moderators' decisions and appeals) 2 years after the final decision, or later while an Enforcement Action from it is still in force; copies in backups are overwritten within 90 days; financial and tax records are kept for at least 5 years; and data breach records for 5 years. The full details are in the Data Retention Schedule.

The principles governing all retention decisions — including storage limitation, purpose limitation, and data minimisation — and the deletion standards applicable upon expiry of a retention period are set out in the Data Retention & Deletion Policy.

10. Security

Nixyum implements appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. These measures include:

Encryption of data in transit and when stored, including private messages.
Passwords stored only as a salted hash, never in plain text.
Optional two-step verification, and an alert when your Account is signed in on a new device, unless you turn it off.
Access controls that limit staff access to Personal Data to the minimum each role needs.
Logging of staff access to Personal Data.
Regular security assessments and internal access reviews.
A responsible security disclosure process at [email protected].

No technical security measure can guarantee absolute protection against all threats. In the event of a Data Breach, Nixyum will follow the notification procedure set out in the Data Retention & Deletion Policy, including notifying the Supervisory Authority within 72 hours and notifying affected Data Subjects where the breach poses a high risk to their rights and freedoms.

11. Special Category Data

Nixyum does not proactively collect Special Category Data (as defined in the Master Definitions). However, Users may voluntarily disclose Special Category Data in their Content or profile fields — for example, by posting about their health, religious beliefs, political opinions, or sexual orientation.

Where a User voluntarily publishes Special Category Data, the legal basis for Nixyum's processing of that data (to display the Content in which it appears) is that the Data Subject has manifestly made the data public by their voluntary act of publication on the Platform, in accordance with the Georgian Data Protection Law. The User may remove Special Category Data from their Content or profile at any time.

Nixyum does not use Special Category Data for advertising targeting, Profiling, or any purpose other than displaying the Content in which it appears and — where reported — moderating that Content in accordance with the Community Guidelines.

Where a Moderator accesses Content containing Special Category Data in the course of moderation activity, they do so under strict confidentiality obligations. Special Category Data appearing in Content is handled with heightened care and is not disclosed beyond what is necessary for the moderation decision.

12. Minor Users

12.1 Minimum Age and Treatment of Minor Users

The minimum age to register an Account and use the Platform is 18 years. By registering, Users represent and warrant that they are at least 18 years of age. The Platform is restricted to adults and is not intended for or directed at anyone under 18.

Nixyum does not knowingly collect, process, or retain the Personal Data of anyone under 18. If a User tells us they are under 18, or a Moderator concludes from evidence that they are, the Account is blocked at once: its sessions end and its Content is hidden from other Users, but nothing is deleted yet. We email the account holder to explain what happened. If they tell us within 30 days that it is a mistake (for example, a wrong date of birth, or someone else having used the Account), a member of staff weighs what they say against what led to the block, and decides. We never ask for an identity document; if one is sent to us anyway, it is used only for that decision and then deleted. If there is no reply, or the review confirms the person is under 18, the Account is deleted under the Data Retention & Deletion Policy. We keep only a one-way coded form of the email address, to prevent re-registration, and any data we are required by law to keep. An automated signal alone never leads to deletion.

If you are a parent or guardian and believe that a person under 18 in your care has registered an Account, contact [email protected] immediately and Nixyum will act promptly, as described above.

12.2 Age Verification Mechanism

At registration, Nixyum requires the User to provide their date of birth and refuses registration where the declared date of birth indicates the User is under 18 years of age. Nixyum does not ask for identity documents and does not use outside age-check providers. If applicable Georgian law or a regulator ever requires a further age check, Nixyum will describe it in an updated version of this Policy, with at least 30 days' notice, before using it.

Verification data collected under any enhanced mechanism will be retained only for as long as is necessary for the purpose of verification (and in any event no longer than 30 days from the date of the verification decision), after which it will be securely deleted. The age-verification and Minor-removal processing is documented internally as part of Nixyum's DPIA programme.

13. Cookies and Similar Technologies

Nixyum uses cookies and similar browser storage on the Platform as described in the Cookies Policy. In summary: strictly necessary cookies, which keep you signed in and protect the Platform, are used without consent (Legal Basis: Contract / Legitimate Interest); analytics (page-speed measurements and records of how features are used) runs only if you allow it; the Platform uses no advertising cookies.

You can change or withdraw your cookie consent at any time under "Cookie settings": among the links at the bottom of the app's menu (the left-hand column on a computer, the side menu on a phone), and at the foot of the Nixyum home page. The Cookies Policy lists every cookie we use, with its purpose, duration and legal basis.

14. User Rights

Under the Georgian Data Protection Law, Data Subjects have the following rights in relation to their Personal Data. These rights apply to processing activities based on all legal bases, subject to the limitations described below.

14.1 Right of Access

Users have the right to obtain confirmation of whether Nixyum processes their Personal Data and, if so, to receive a copy of that data together with information about: the purposes of processing; the categories of data processed; the recipients or categories of recipients; the retention period; and the existence of other data subject rights. You can download a copy of your data at any time in Settings → "Download Account Data": we prepare a file and email you a link to it, valid for 48 hours. For information the file does not contain, write to [email protected].

14.2 Right to Rectification

Users have the right to request correction of inaccurate Personal Data. Many profile data points can be corrected directly through Account Settings. Where direct correction is not possible, submit a request to [email protected].

14.3 Right to Erasure

Users have the right to request deletion of their Personal Data in the circumstances set out in the Data Retention & Deletion Policy. You can delete your Account in Settings ("Delete Entire Account") or by writing to [email protected]. Deletion takes effect after 7 days; until then you can cancel it in Settings or with the link in the email we send you. That email lists the data we must keep and why, and we email you again when the deletion is complete. Erasure requests may be refused in part where retention is required by Georgian law, for legal claims, or for ban enforcement, as described in the Data Retention & Deletion Policy.

14.4 Right to Restriction of Processing

Users have the right to request that Nixyum restrict processing of their Personal Data to storage only, pending resolution of a dispute about its accuracy or the User's objection to its processing. A restriction request must be submitted to [email protected].

14.5 Right to Object

Users have the right to object to processing of their Personal Data based on Legitimate Interest at any time. Upon receipt of a valid objection, Nixyum will cease that processing unless Nixyum can demonstrate compelling legitimate grounds that override the User's interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims. To object to the use of your Content to improve the Trust & Safety Models, see Section 15.5.

If you have consented to Direct Marketing, you can withdraw your consent at any time without giving reasons, and Nixyum will stop within seven (7) working days of receiving your request.

14.6 Right to Data Portability

In relation to Personal Data processed on the basis of Contract or Consent, and by automated means, Users have the right to receive that data in a structured, commonly used, and machine-readable format, and to transmit it to another controller. Portable data typically includes: profile information; Content the User has posted; and private messages sent by the User. The "Download Account Data" file (Section 14.1) is provided in a structured, machine-readable format (JSON) and serves this right; you can also write to [email protected].

Where processing is based on consent, the User may withdraw that consent at any time through the relevant in-Platform control (e.g., cookie consent manager for cookie-based processing) or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

14.8 Right to Information About Automated Processing

Under the Georgian Data Protection Law, Data Subjects have the right to receive meaningful information about the logic involved in any automated processing that significantly affects them, including Profiling. This right applies to:

The feed-ranking algorithm (Section 15.1), including information about the categories of Engagement Signals used and the general logic by which Content is ranked.
Automated content moderation (Section 15.2), including information about the types of automated checks applied to User Content.

To exercise this right, submit a request to [email protected]. Nixyum will provide information at the level of generality that is proportionate to the nature of the request and is consistent with protecting Nixyum's proprietary systems and security measures.

14.9 Right to Lodge a Complaint with the Supervisory Authority

If a User believes that Nixyum has processed their Personal Data in a manner that infringes the Georgian Data Protection Law, they have the right to lodge a complaint with the State Audit Office of Georgia (SAO) — the supervisory authority for personal data protection in Georgia — through its dedicated personal data protection portal at pdp.sao.ge. Nixyum requests that Users first contact [email protected] to allow Nixyum to address the concern directly before escalating to the Supervisory Authority.

14.10 How to Exercise Your Rights

All Data Subject rights requests must be submitted to [email protected]. Nixyum will verify the identity of the requesting party before processing any request affecting Personal Data. Nixyum will respond to all valid requests within ten (10) working days of receipt, in accordance with the response timelines set out in the Georgian Data Protection Law. For complex requests, this period may be extended once by up to a further ten (10) working days, with written notice to the User stating the reason for the extension provided within the original 10-working-day response period. Nixyum will not charge a fee for Data Subject rights requests except where requests are manifestly unfounded or excessive, in which case a reasonable fee may be charged or the request refused.

15. Automated Processing — Feed Ranking, Content Moderation, Profiling

15.1 Feed Composition and Ranking

Nixyum uses automated processing to compose and order each User's Content feed. The feed-ranking system processes Engagement Signals to determine which Content is shown to a User and in what order. Each Persona's feed is ranked from that Persona's own activity. This processing is conducted on the basis of Contract (as feed ranking is an inherent component of the Platform service as described in the Terms of Service) and Legitimate Interest (improving User engagement and Platform quality). Feed ranking does not produce legal effects and does not significantly affect Users in a manner comparable to legal or similarly significant effects. Users may object to feed-ranking processing on the basis of Legitimate Interest by contacting [email protected]. A documented Data Protection Impact Assessment (DPIA-01) covering this processing is maintained under the DPIA Framework & Register.

15.2 Automated Content Moderation

Nixyum uses automated tools to help moderate Content. They check public Content and private messages, including photos, videos and voice messages, for material that may break the Community Guidelines, and they help detect spam and abuse. The tools run on Nixyum's own Trust & Safety Models; no User Content is sent to third-party AI services. Content the tools flag may be held from other Users until a person reviews it; its author can still see it. Decisions that affect your Account's standing (suspension or termination) are always taken by a Moderator after review. Detection of known child sexual abuse material (CSAM) is carried out under Legal Obligation and does not require consent; the other checks rely on Legitimate Interest (platform safety). A documented Data Protection Impact Assessment (DPIA-02) covers this processing.

15.3 Automated Decisions with Legal or Significant Effect — Limited to Legal-Obligation Exception

Save for the limited exception described in this Section 15.3, Nixyum does not subject Users to decisions based solely on automated processing — including Profiling — that produce legal effects or similarly significant effects on them. All Enforcement Actions that affect User Account standing are reviewed and decided by a human Moderator, and Users may appeal under the procedure described in the Content Moderation & Takedown Policy.

The sole exception is known child sexual abuse material (CSAM). Content identified as known CSAM is blocked automatically and is never published. This is a decision based solely on automated processing with legal effect, made under the legal-obligation exception on the following bases: (a) Nixyum's legal obligation under Georgian criminal law to prevent the dissemination of child sexual abuse material; (b) the substantial public interest in the protection of children from sexual exploitation; and (c) compliance with applicable CSAM-reporting law in respect of reports to NCMEC (see REPORT Act in the Master Definitions). The material is preserved as sealed evidence, to which access is strictly restricted, for the period set out in the Data Retention Schedule, and is reported to NCMEC and, where required, to the competent authorities. A User affected by a CSAM-related decision may appeal under the Content Moderation & Takedown Policy; the appeal is decided by a person, without viewing the material itself. The underlying processing is the subject of DPIA-02, registered in the DPIA Framework & Register.

15.4 Profiling

Nixyum carries out limited Profiling for feed ranking (Section 15.1). The Platform shows no advertising at present. If advertising is introduced, Profiling for advertising will take place only with your consent and under the restrictions in the Advertising Policy, and will never combine signals from your Nex and your Nyx. Any User identified as a Minor (under 18) is excluded from all advertising Profiling, and their Account is handled as described in Section 12.1. Nixyum does not carry out Profiling that infers Special Category Data from User behaviour or Engagement Signals.

15.5 Improving Trust & Safety Models

Nixyum may use Content, in pseudonymised form, to evaluate and improve its Trust & Safety Models (as defined in the Master Definitions), on the Legal Basis of Legitimate Interest supported by a documented LIA. Nixyum runs these models itself, and Content used for this purpose is never sold or licensed to anyone. The following rules apply:

Content that a Moderator has confirmed breaks the Policies, including private messages, may be used even if you object, because protecting other Users from such Content is a compelling legitimate ground.
Private messages that break no rule are never used.
Examples of Content that breaks no rule are taken from public Content only.
You can object to that use at any time with the setting "Don't use my posts to improve safety tools" in Settings → Privacy & Safety, or by writing to [email protected]. Your objection applies from the moment you make it.

16. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, or services. Nixyum is not responsible for the privacy practices of those third parties. Users who access third-party sites via links on the Platform do so at their own risk and are subject to those third parties' own privacy policies. Nixyum recommends that Users review the privacy policies of any third-party service they access.

17. Changes to This Policy

Nixyum may update this Privacy Policy from time to time to reflect changes in its data processing practices, applicable law, or the Platform's features. Material changes — including changes to the purposes for which Personal Data is processed, the legal bases relied upon, or the categories of recipients — will be communicated to Users at least thirty (30) days before the change takes effect, via a notice on the Platform or by email to the registered address. A shorter notice period may apply where a change is required by law or necessary for security or regulatory compliance. A correction or clarification that does not change Users' rights or how their Personal Data is processed is not a material change and takes effect when it is published.

Where a change requires fresh consent (for example, where Nixyum proposes to use Personal Data for a new purpose that requires consent), Nixyum will seek that consent before the new processing begins, regardless of any previously granted consent.

The "Last Updated" date at the top of this document reflects the most recent revision. The current version of this Policy is always accessible on the Platform. Continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy. Users who do not accept the revised Policy must cease using the Platform and may delete their Account.

18. Contact and Data Controller

Privacy & Data Protection: [email protected]
DPO: Not yet appointed. Write to [email protected] (see Section 2).
Support: [email protected]
Legal: [email protected]
Advertising: [email protected]
Security Disclosures: [email protected]
Data Controller: Nixyum LLC · Reg. No. 400458045 · Tbilisi, 13 Nikoloz Janashia Street, Georgia
Supervisory Authority: State Audit Office of Georgia (SAO) · pdp.sao.ge