Privacy notice
Updated: 2 November 2026 · Operator: NexArah Sdn. Bhd., Malaysia · Company number: 202601017294 (1679391-M) · Contact: contact@nexarah.com
This notice covers the website, pathway surveys, email signup and purchase-library services. The shop is currently a preview with free interest lists. Paid checkout is not open. Purchase and library information below explains processing for an existing licence or when those services become available. It does not mean that you can place an order now. Public Seeker and Guide accounts are not part of this shop preview.
Information you provide
Email signup. We store your email address, signup source, consent time and subscription status to deliver the checklist, five-email welcome series, launch reminders and occasional new-pack emails described beside the form. Email records include queued messages, delivery attempts and provider message identifiers. Unsubscribing stops marketing; submitting the form again does not silently undo that choice. Contact us if you need the checklist or help opting in again.
Pathway surveys. The guide survey asks for education and pathway information, including study route, institution, country, course, funding, approximate costs and optional advice. It does not ask for your name or contact details. The seeker survey asks about study plans and allows an optional email for updates. Avoid identifying information in free-text answers. Responses help us understand pathways and present aggregate insights. Submitting a survey does not produce a live AI recommendation or apply for admission.
Support. If you email us, we receive your address and the information you include, which we use to answer your request. For order help, provide your purchase email and order reference; do not send passwords, full card details or licence keys.
Purchases and the library
For a purchase or existing licence, we store the purchase email, product or bundle, payment-provider/order reference, amount and currency, licence status and timestamps. Hosted payment providers handle payment details in their checkout; the library does not need your full card number or security code. Buying does not automatically subscribe you to marketing.
Access uses a licence key or emailed single-use link. We store hashes of licence keys and sign-in tokens; a temporary encrypted key copy supports the limited checkout reveal. Device records include a hashed random device identifier, a coarse browser/device label, registration and last-use times, and removal status.
To enforce access and investigate sharing, the library records file or reader access, download counts, hosting-provided country information and keyed hashes of IP addresses and user-agent information. Its access records do not store raw IP addresses or full raw user agents. Hosting and diagnostic providers may separately process connection information when serving requests.
PDFs, supported kit contents and reader pages may carry the buyer's email and licence ID. Sharing a marked file can disclose those details to its recipient. Watermarks and device checks discourage sharing; they cannot prevent copying. Unusual access can temporarily lock a licence, including after a genuine network change. An emailed sign-in link or support can help resolve an incorrect lock. Refunds and disputes may affect access to the associated purchase.
Cookies, preferences and protection
Essential cookies support stakeholder access, checkout confirmation, library sign-in, device identification and email-confirmed early access where used. Library sign-in cookies last up to 30 days, device cookies up to 400 days, temporary device-management cookies 15 minutes and checkout cookies two hours. Early-access cookies expire with their offer. Expiry of a cookie or link does not delete its database record.
Browser storage remembers your motion preference. Text and choices entered into the operator demonstration update the example locally on the page; the demonstration does not submit them to an AI provider or deploy a project.
Request information is used to rate-limit submissions and protect sign-in and downloads. Shop rate-limit keys are hashed before storage. The current site does not include advertising pixels or session replay. Error and sampled performance reporting is separate from advertising.
Providers
The providers involved depend on the feature and deployment configuration. Listing a payment route here does not mean it is open.
| Provider | Purpose |
|---|---|
| Vercel | Hosting, request delivery and scheduled tasks |
| Neon | Application database, including survey, subscriber and library records |
| Resend | Requested emails, sign-in links and opted-in marketing; optional audience synchronization |
| Upstash, where configured | Shared rate limiting; the shop otherwise uses a database-backed limiter in production |
| Supabase | Private product-file storage and delivery |
| Stripe, when offered | Hosted payments, order confirmation, refunds and disputes |
| Gumroad, when offered | Hosted purchases and purchase/licence verification |
| Sentry, where configured | Error diagnostics and sampled performance information |
Providers may process information outside your country. Actual locations depend on the service configuration and its subprocessors; we do not promise that all records stay in a particular region. Contact us about the services relevant to your request. NexArah is independent of MASCA and other student associations; this notice does not authorize sharing identifiable survey responses with them.
Retention and your choices
Subscriber records remain until handled through a deletion process; unsubscribe suppression is retained to respect your preference. Unsubscribing cancels pending marketing but does not itself erase past message or delivery records. Library licences, payment references, access logs and expired or used token records are not automatically deleted when an access window expires. Survey records are retained for the pathway project. We review deletion requests against the purpose of the record, purchase/support needs and applicable obligations; no fixed automatic deletion period is promised here.
Use the unsubscribe link in a marketing email to stop marketing without signing in. Essential purchase or account messages are separate. Contact contact@nexarah.com about access, correction, deletion or use of your information. We may need to verify that a request concerns your information. Anonymous survey answers may not be identifiable from an email address. We will explain any information needed and any limits on deletion.
Do not submit sensitive information or another person's identifying details in a survey or demonstration. If you are under 18, ask a parent or guardian before providing personal information or using a paid third-party service.
Security and changes
We use access controls and technical safeguards, including signed sessions, one-use expiring links and private delivery where applicable. No website or sharing control can promise absolute security. Contact us promptly if you believe your information or licence has been misused.
We will update this notice when services or processing change. New public accounts, new data uses and paid sales require a scope review before release. This notice describes the implementation and service choices; it is not a certification of legal compliance.