How we handle your information

1. Our two roles

Our customers are organizations, usually consulting firms. When a customer uses the application, the projects, files, reports, messages and other content its people put into its workspace ("Workspace Content") belong to that customer. We process Workspace Content on the customer’s behalf and on its instructions, as its processor and, under California and other US state laws, its service provider. The customer’s own privacy notice governs that information, and our handling of it is governed by our agreement with the customer, including our Data Processing Addendum. If you are a customer’s employee, or a client or other person named in a customer’s project, please send requests about Workspace Content to that customer; we will help it respond.

We decide how and why we use a smaller set of information for our own business: the accounts of the people who use the application, billing, support conversations, security and service records, and visits to our website. For that information we are the controller (or "business"), and this policy governs it directly.

2. Information we collect and where it comes from

From you or your organization, when you sign up, are invited or use the application:

• Account details: your name, email address, job title, role, profile photo, the signature image you choose to upload for reports, and the organization you belong to. Your password is stored only as a one-way hash; we cannot read it.
• Professional details your organization adds for reports, such as staff licence or certification numbers.
• Organization details: the organization’s name, logo, members, invitations, plan and settings.
• Workspace Content: site boundaries, centerlines and addresses; project and client details, including client contacts’ names, emails, phone numbers and professional profile links; uploaded documents, photographs and GIS files; field survey records and interview notes; report drafts, edits, comments and approvals; the chat messages, email messages and calendar items your team writes inside the application; and the replies your clients and others send to email sent from the application, which the application receives and files in your organization’s Mail.
• Billing details: the plan, subscription status, credit use, invoices, and the billing contact’s name and email. Card details, the billing address and any tax ID you give at checkout are collected by our payment processor, Stripe; we never receive or store your full card number.
• Messages you send us: emails to [email protected] and our other addresses, and what they contain. Email to [email protected] is received and stored by the application so our staff can answer it.
• Free site screening: if you ask for a free site screening before signing up, the site boundary you upload (we keep the boundary, not the file), your work email address, the screening’s results, and a one-way keyed code made from your network address so we can limit how many screenings one network asks for.

3. Information collected automatically

• Sign-in records: for each signed-in session and each browser you trust for two-step sign-in, the IP address, the browser it came from, and when it started and expires.
• Activity records: who created, changed, approved, exported or deleted what in a workspace, and when. Your organization can see these in each project’s history, and its owners and administrators can see each member’s activity: the reports they drafted, the gaps they filled, their comments, reviews and approvals, what is waiting on them, their recent activity and the days they used the application. Each person can see their own. Sign-in details (network addresses, browsers and sessions) are not part of it.
• Usage records: which reports were exported and how many credits they used, so we can bill correctly.
• Days of use: the dates on which each person used the application, and the organization they were working in, so we can understand how it is used and improve it, and so your organization’s owners and administrators can see how many days each of its members used it there and when they last did. Days recorded before November 2026 do not say which organization, and are shown to them as days in any organization. Only the date and the organization are kept, not what was viewed or done. We use no third-party analytics or advertising trackers, and no cookies for this.
• Error reports: when the application fails, technical details of the failure, which may include the signed-in person’s account identifier and organization identifier but not names, email addresses or files.
• Server logs: like any web service, our servers and network provider record each request’s IP address, browser and the address requested, for security and to keep the service running.

4. Information from other sources

• Google or Microsoft sign-in: if you choose it, your name, email address and the account identifier the provider gives us.
• Services you connect: if you connect Google Calendar, Gmail, Outlook, Google Drive, OneDrive, DocuSign, ArcGIS Online or another service, the access tokens it issues and the information described in sections 7 and 9. From DocuSign, the status of each document you send for signature and, once signed, the signed copy and its certificate of completion.
• Stripe: payment status, card brand and last four digits (shown to your owners, not stored by us), the billing address and tax ID given at checkout, and invoice records.
• Public records: to research a site, the application reads public government records, which can include the names of property owners shown in county parcel records. We use them only to describe the site in your organization’s project.

5. How we use information, and our legal bases

Where the law of your country requires a legal basis (for example the EU or UK GDPR), the basis for each use is given in brackets.

• To provide the service: research public records for your sites, draft your reports, and store, show, share within your organization and export your projects (performing our contract with your organization, and our legitimate interest in providing a service its people can use).
• To run accounts: sign-in, two-step sign-in, invitations, roles, notifications, and support (contract; legitimate interests).
• To bill: start and renew subscriptions, count report credits and send invoices (contract; legal obligation for tax and accounting records).
• To keep the service secure and working: detecting and preventing abuse and unauthorized access, investigating errors, monitoring availability and restoring from backups (legitimate interests in a secure, reliable service; legal obligation where security is required by law).
• To provide support and administration: our staff can open a customer’s workspace to answer a support request, fix a problem or administer the account; each opening is recorded in that organization’s activity history (contract; legitimate interests).
• To improve the service: counting how features are used, in aggregate, to decide what to fix and build (legitimate interests). We do not use Workspace Content for this beyond counts and error reports.
• To send service emails: invitations, password resets, notifications and, if you turn it on, a weekly summary (contract; consent for the optional summary).
• To meet legal obligations and to establish, exercise or defend legal claims (legal obligation; legitimate interests).

6. What we do not do

• We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in California law. We have not done either in the past 12 months.
• We do not use Workspace Content for any purpose other than providing the service to the organization it belongs to, and we do not combine it with information from other customers.
• We do not send your content to artificial intelligence model providers, and we do not use it, or data from connected Google or Microsoft accounts, to train artificial intelligence or machine learning models. The application’s search runs on our own servers.
• We do not use advertising, analytics or tracking scripts on the website or in the application.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

7. Google and Microsoft account data

Connecting a Google or Microsoft account is optional. Each person connects their own account from Settings › Apps (or signs in with it), and can disconnect it there at any time. We ask only for the permissions each feature needs, when the feature is first used. This section describes exactly what we access, how we use, share, protect and keep it, and how it is deleted.

• Signing in with Google or Microsoft (Google permissions: openid, email, profile): we receive your name, email address and account identifier, and use them only to sign you in and link the account to your Environmental Nexus account.
• Your calendars, read only (Google permissions: calendar.calendarlist.readonly and calendar.events.readonly; Outlook calendars on Microsoft): we read the list of your calendars and the events on the calendars you choose to show, from 60 days ago to a year ahead, only to show your own events in the application’s Calendar. For each event we keep only its title, start and end time, whether it is all day, its location, its link and whether it is marked busy. We do not keep event descriptions, attendees or attachments, and we cannot change or delete your events. These events are shown only to you; nobody else in your organization, and none of our support staff using the application, can see them.
• The Environmental Nexus calendar (Google permission: calendar.app.created): if you turn it on, we create one calendar named "Environmental Nexus" in your account and write your project dates on it. That permission reaches only calendars the application created; we never edit or delete your other calendars or events.
• Sending email (Google permission: gmail.send; Mail.Send on Microsoft): if you connect a mailbox for sending, we use it only to send the emails you write and send from the application, such as a report or letter to your client, and, if your organization makes it its shared sending address, the application’s notifications to your team. The permission is send only: we never read, search or delete the email in your mailbox.
• Saving files (Google permission: drive.file; Files.ReadWrite.AppFolder on Microsoft OneDrive): if you connect a drive, we use it only to save the report and letter files you choose, into a folder named for the project. For both Google Drive and OneDrive, our access is limited to the files and folder the application creates; we cannot see, open, change or delete your other files.
• How we use it: only to provide the features above that you chose to use. Google user data is not used for advertising, is not sold, and is not used for any purpose other than those user-facing features.
• Who receives it: no one, except the service providers that host and back up the application for us (IONOS, in the United States) and the network that carries the application’s encrypted connections (Cloudflare), under contracts that limit them to providing that service, and as needed for security, to comply with the law, or as part of a merger or sale of our business with your prior consent. People at our company do not read it unless you ask us to for support, it is needed for security, or the law requires it.
• How we protect it: the access tokens Google and Microsoft issue are encrypted in our database with a key specific to your organization, sent only over encrypted connections, and never shown in the application; calendar events are shown only to the person who connected the account; and access to our systems is limited to named staff and recorded.
• How long we keep it and how it is deleted: calendar events are refreshed about every 10 minutes while the account is connected; an event you delete or move out of the window is removed at the next refresh or, at the latest, at the weekly full refresh. When you disconnect an account in Settings › Apps, we withdraw our access with Google, delete the stored tokens and every event we read from that account at once, and remove the Environmental Nexus calendar from it. When an owner deletes your account, your connected accounts are disconnected the same way at once. When your organization is deleted (30 days after its agreement or trial ends, or after it is closed), everything we hold from these accounts is deleted with it; backup copies expire within a further 30 days. Files you saved to your drive and emails you sent stay in your account, as yours. You can also remove our access at myaccount.google.com/permissions, or from your Microsoft account at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).
• We do not use Google user data to develop, improve, or train AI or machine-learning models, and we do not transfer it to third-party AI services.

8. Google API Services User Data Policy

Environmental Nexus’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

9. Who receives information

We disclose personal information only as described here. Our current subprocessors and service providers, with what each receives and where, are listed on our Subprocessors page (enexus.cc/subprocessors).

• People in your organization, according to the roles its owners and administrators assign. At your organization’s request, we can give people at another organization, such as a partner firm, access to its projects.
• Our staff, who can open an organization’s workspace to provide support and administer the service. Each such access is recorded in that organization’s activity history.
• Our service providers, under contracts that limit their use of the information to providing their service to us: hosting, storage and backups (IONOS, in the United States), this website (Hetzner, in Finland), the mailboxes for email sent to our enexus.cc addresses, including replies to email sent from the application (Hetzner, in Germany), network and encryption (Cloudflare), email delivery (MailBaby), error reports (Sentry, in the United States), signatures for organizations that connect DocuSign (DocuSign) and payments (Stripe).
• Public agency data services. To research a site, the application sends the site’s location (its boundary or coordinates, and for some searches its address or parcel number) to public services of federal, state and local agencies, such as FEMA, the U.S. Fish and Wildlife Service, the U.S. Census Bureau and the Florida Department of Environmental Protection. When you type an address or place name to find a site, the text you typed is sent first to the Census Bureau’s address service and, if it finds no match, to OpenStreetMap’s Nominatim and Komoot’s Photon address search services, which run on servers in Europe. Map backgrounds are loaded by your browser from the U.S. Geological Survey. None of these receive your name, your client’s name or your documents.
• Password checks: when you choose a password, we send the first five characters of a one-way hash of it to the Have I Been Pwned service to check it against known breaches. The password itself never leaves our servers.
• Services you or your organization connect, such as Google (including Google Drive), Microsoft (including OneDrive), DocuSign, ArcGIS Online, Slack, or a webhook address your organization sets up, only to the extent you use the connection. When you send a document for signature through DocuSign, the document and the signers’ names and email addresses go to DocuSign.
• Authorities and others when the law requires it, or when needed to protect the rights, property or safety of our customers, the public or us.
• A buyer or successor if our business is sold or merged, under commitments at least as protective as this policy.

10. How long we keep information

• Workspace Content: for as long as the customer’s subscription lasts. A project an authorized person deletes stays in Recently deleted for 30 days, where the organization can restore it, and is then permanently removed from the live service; backup copies expire within a further 30 days. Projects bought report by report are kept for at least 90 days after purchase.
• After a customer’s agreement ends, or after an owner closes the organization in the application: the organization is read-only for 30 days, during which its owners can download a full copy of its data; we then delete its content from the live service, and backup copies expire within a further 30 days.
• Account details: while you are a member of an organization. When an owner deletes your account, your sign-in access, memberships, Google or Microsoft sign-in link, two-step sign-in records, profile photo, signature image, job title and email address are removed, your connected calendars, mailbox and drive are disconnected, and your name is replaced with "Former member" in the messages and activity history your organization keeps.
• Data from connected Google and Microsoft accounts: as section 7 describes.
• Free trials: when a trial ends without a paid plan, the workspace becomes read-only and its content is deleted 30 days after the trial ends; backup copies expire within a further 30 days.
• Free site screenings: the site boundary, the email address it was sent to and the screening’s results are deleted 30 days after the screening was asked for; backup copies expire within a further 30 days. If you start a free trial from a screening and choose to bring its site into your workspace, the site becomes Workspace Content of your organization.
• Requests to delete: when an organization or a person asks us to delete their information, we delete it from the live service within 30 days, and backup copies expire within a further 30 days, except records we must keep as described here.
• Sign-in records (signed-in sessions, trusted browsers, sign-in codes, failed sign-in counts and the sign-in entries in activity history) and days of use: deleted 12 months after they end.
• Activity records: for as long as the workspace exists, because they show who approved and exported each report; sign-in entries are deleted after 12 months.
• Billing records: 7 years, as tax and accounting law requires, including after an organization is deleted. What is kept then is amounts, dates and our payment processor’s references, with no names or contact details.
• Support conversations and help requests, including email to [email protected]: deleted 12 months after the conversation was last active, together with the copies in our support mailbox.
• Replies to email sent from the application: a reply is filed in your organization’s Mail and kept there as Workspace Content. The copies in our replies mailbox are deleted after 12 months, and a reply we cannot match to an organization is deleted after 90 days.
• Error reports: kept by our error-tracking provider only for the limited period its retention settings allow, then deleted.
• Server logs: no more than 90 days.
• Backups: nightly encrypted copies of the database and stored files, each kept for up to 30 days.

11. How we protect information

We protect information with encrypted connections, hashed passwords, encrypted storage of access tokens and other secrets, optional two-step sign-in with authenticator apps or passkeys, role-based access, separation of each organization’s data, encrypted nightly backups and monitoring. Our Security page (enexus.cc/security) describes these measures. No system is perfectly secure. If we learn of a breach that affects your information, we will notify the affected customer and, where the law requires, you and the authorities, without undue delay.

12. Where information is stored and transferred

We are based in the United States. Customer data in the application, including its backups, is stored and processed in the United States. Copies of emails sent to our enexus.cc addresses, including replies to email sent from the application, are kept by our email provider in Germany for the periods in section 10, the website is hosted in Finland, and some of our service providers, such as Cloudflare, process information in transit in many countries. If you use the service from outside the United States, your information is transferred to the United States and the other countries described here. Where the EU or UK GDPR applies, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) in our Data Processing Addendum and with our service providers, or another lawful transfer mechanism.

13. Your rights and choices

You can view and correct your account details in the application at any time, turn optional emails on or off in Settings, and disconnect connected accounts in Settings › Apps. For anything else, email [email protected]. We answer within 30 days (45 days where California law allows, with notice) and will not treat you differently for asking. If your request concerns Workspace Content, we will pass it to the customer that controls it.

14. California residents

This section supplements the policy for California residents under the California Consumer Privacy Act, as amended ("CCPA"). In the past 12 months we collected these categories of personal information, from the sources and for the business purposes in sections 2 to 5, and disclosed each for a business purpose to the recipients in section 9:

• Identifiers: name, email address, account identifier, IP address.
• Customer records: name, telephone number of client contacts, signature image, billing details (not full card numbers).
• Commercial information: plan, purchases, credit use and invoices.
• Internet or other electronic network activity: sign-in records, activity records, usage records and error reports.
• Audio or visual information: profile photos and site photographs uploaded to projects.
• Professional or employment information: job title, organization, licence or certification numbers.
• Sensitive personal information: account sign-in credentials. We use it only to sign you in and keep your account secure, which the CCPA permits without a right to limit.
• We do not sell or share personal information, have no actual knowledge of selling or sharing the information of anyone under 16, and treat a Global Privacy Control signal as a request to opt out in any case.
• Your rights: to know what we collect, use and disclose; to receive a copy; to correct it; to delete it; to opt out of sale or sharing (which we do not do); to limit use of sensitive information (which we use only as permitted); and not to be discriminated against for exercising these rights.
• Making a request: email us. We will verify your request by confirming control of the email address on your account, and may ask for more information where needed. You may use an authorized agent, who must show your signed permission; we may still ask you to confirm your identity.
• Retention: see section 10.

15. Residents of other US states

Residents of states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia, Texas, Oregon and others, have similar rights to access, correct, delete and obtain a copy of their personal information, and to opt out of targeted advertising, sale and certain profiling, which we do not do. Make requests as described in section 13. If we decline your request, you may appeal by replying to our answer with the word "Appeal"; we will respond within the time your state’s law sets, and if you are not satisfied you may contact your state attorney general.

16. People in the European Economic Area, the United Kingdom and Switzerland

Where the GDPR or a similar law applies to information we control, you have the right to access, correct, delete, restrict or object to our processing of it, to receive it in a portable form, and, where we rely on consent, to withdraw consent at any time. You may also complain to your data protection authority. For Workspace Content, the customer is the controller and you should contact it first.

17. Cookies and similar technologies

enexus.cc sets no cookies. The application uses only cookies that are strictly necessary: one sign-in cookie that keeps you signed in (a session ends after 7 days without use and after 30 days at most), a cookie that remembers a browser you chose to trust for two-step sign-in (30 days), and short-lived cookies that protect sign-in and app connections while they are in progress. These cookies cannot be read by scripts on the page and are sent only over encrypted connections. The application also stores display preferences, such as your theme, in your browser. We use no advertising or analytics cookies, so there is nothing to opt out of.

18. Email from us

We send service emails that are part of using the application, such as invitations, password resets, notifications and billing notices; you cannot opt out of essential ones while you have an account. The email digest and some notifications are optional and can be turned off in Settings or with the unsubscribe link. We do not currently send marketing email. If we start, we will send it only to business contacts, identify it as ours, include our postal address and an unsubscribe link in every message, and honor unsubscribe requests within 10 business days.

19. Children

The service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children; if we learn we have, we will delete it.

20. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use information we already hold, we will tell organization owners by email or in the application at least 30 days before it takes effect, and where the law requires consent we will ask for it.

21. Contact

Questions and requests about privacy go to Environmental Nexus LLC, 7901 4th Street North, Suite 300, St. Petersburg, FL 33702, or [email protected]. For help using the service, email [email protected].