Last Updated: 24 August 2026
Version: 1.6
Governing law: Barbados, including the Data Protection Act, 2019-29

Data controller: Nexus Platform Ltd, a company incorporated under the Companies Act, Cap. 308 of the Laws of Barbados, based in Rowans ("Nexus," "we," "our," or "us").

Nexus operates the Nexus mobile application and the website at nexusbarbados.com (together, the "Service"), a marketplace connecting consumers with local service professionals in Barbados.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use our Service. It should be read with our Terms of Service (including the privacy, verification, KYC/AML, and Acceptable Use sections).

1. Information We Collect

Account and profile

When you register for an account, we collect:

Email address — account authentication and communication
Password — used to authenticate you; stored by our authentication provider in hashed form, not as plaintext
Phone number — booking confirmations, provider contact, and (if you use it) WhatsApp support
Name — identification on the platform
Profile photo (optional) — primarily for provider profiles
Account role — consumer or service provider
Referral attribution — if you sign up or book via a share link, we record which link brought you

Location information

Service addresses and parish — addresses and Barbados parish you enter for bookings, search, and provider service areas
We do not collect device GPS. The current app does not request location permission. You can use the Service with manually entered addresses. If we later add optional device location, we will request permission first and update this Policy.

Photos and other content you submit

Job and booking photos — documentation of the work (before/after, issue photos)
Reviews and ratings — text and star ratings you leave after a job
Problem descriptions — free-text you enter so we can match you to a service offering
Saved providers — providers you choose to save

Contacts (optional)

If you opt in to “people you know” / community trust, we read phone numbers from your device address book after you grant contacts permission. We store peppered hashes of those numbers so we can match people who already have a Nexus account. We do not store a copy of your address book, and we do not keep the raw phone numbers of people who are not Nexus users. You can decline permission and still use the Service.

Identity verification (service providers)

To verify providers we may collect:

Government ID — driver’s licence, national ID, or passport images
Selfie — for comparison with the ID
Certificates — including a police certificate of character where required (this is sensitive personal data under the Data Protection Act because it concerns a criminal record)
Trade or professional certifications you upload

Uploading those documents is how you consent to us processing them for verification, safety, and payout eligibility. You can refuse, in which case we cannot complete provider verification. If automated face matching is enabled, ID and selfie images may be processed by a face-matching service we operate or contract so staff can review a similarity score. We do not auto-approve verification from a score. We do not use verification images for advertising.

Device, usage, and diagnostics

Product analytics — first-party events such as app opened, searches, profile views, booking steps, reviews, and support opened (stored in our database, linked to your account when you are signed in)
Device information — device type / platform, operating system, and app version
Push notification tokens — so we can send booking and account notifications (when you enable push)
Notification preferences — whether you want push and/or email
Error and crash logs — to diagnose issues (including via Sentry when enabled for a given build; we configure Sentry not to send default PII or screenshots)
On-device biometrics — optional Face ID / fingerprint unlock stays on your device. We do not receive or store fingerprint or face templates. Enabling unlock may store an email hint in the device keychain so the login screen can show who is unlocking.

Website (nexusbarbados.com)

If you visit our marketing website, we may collect:

Server logs — such as IP address, user agent, and requested pages (via our website host)
Waitlist and interest forms — email, parish, trade or service interest, and survey answers you submit; when configured these are sent to a Google Sheet via Google Apps Script
Google Analytics, Google Ads, and Meta Pixel (Facebook/Instagram) — page views, approximate location derived from IP, and conversion events, where those tags are configured
Web fonts — the site loads fonts from Google Fonts, which may receive your IP address

Cookie or analytics controls depend on your browser settings.

Service provider business information

Providers additionally submit:

Business information — trading name, trade type, service areas (parishes), bio
Availability — weekly schedule and date overrides
Banking / payout details — bank name, branch, and account details needed to pay you (processed securely; full card numbers for consumer payments are not stored by Nexus)

Payment information

Transaction details — booking amounts, payment status, processor references
We do not store full credit card numbers; card data is handled by our PCI-DSS compliant payment processor, whose identity is disclosed at the point of payment

Messages and support content

In-app booking messages, in-app support chat, and (if you use them) WhatsApp support threads
Support emails we send you (booking confirmations, updates, and similar)

2. How We Use Your Information

We use personal data to:

Provide the Service — connect consumers with providers, process bookings, match problem descriptions to service offerings
Communicate — booking confirmations, updates, push/email notifications, and support (in-app, email, and WhatsApp)
Verify providers — identity, certifications, and safety checks where applicable
Show social proof — optional contact matching so you can see providers used by people you know
Improve the Service — first-party usage events, bug fixes, product development
Ensure safety and integrity — fraud prevention, enforcement of our Terms of Service and Acceptable Use rules
Process payments and payouts — to collect consumer payments for bookings on behalf of providers, and to settle providers
Market the Service — waitlist follow-up and, where website tags are configured, measure ads and conversions
Comply with law — tax, accounting, regulatory, and dispute obligations

Legal basis (Data Protection Act): we process account, booking, payment, and support data because it is necessary to perform our contract with you and to comply with law. We process police certificates and similar sensitive verification data with your consent. Optional features (contacts matching, marketing-site cookies/pixels, waitlist) run on consent or your choice to submit the form.

3. Information Sharing

We share personal data with:

Service providers (sub-processors / processors)

Platform and hosting

Supabase — database, authentication, file storage, and Edge Functions
Vercel — hosting for the marketing website (and related server logs)

Payments and communications

Payment processor — third-party PCI-DSS compliant processor for card transactions (identity disclosed at payment)
Resend — transactional email (confirmations, alerts, and similar)
Meta Platforms (WhatsApp Business Platform) — delivery of, and replies to, support and notification messages you exchange with us over WhatsApp
Google Firebase Cloud Messaging — push notification delivery
Apple / Google — app distribution and platform push notification services

OpenAI — default provider for AI-assisted customer support and for mapping problem descriptions to service offerings. Conversation content, booking summaries needed to answer you, and the problem text you type may be sent to generate a response
Anthropic — alternative AI provider for the same support and matching features when that model is selected

Diagnostics, marketing site, and waitlist

Sentry — crash and error reporting when enabled for the app build
Google Analytics, Google Ads, and Meta Pixel — marketing-site analytics and conversion measurement when configured
Google (Apps Script / Sheets) — waitlist and interest-form submissions when configured
Google Fonts — font delivery for the marketing site

Identity matching (optional)

A face-matching service (self-hosted or contracted) may process provider ID and selfie images if that feature is enabled. Otherwise staff review documents manually.

We do not currently offer Google or Apple social login in the app. If we add it, we will update this Policy.

Other users

Providers see consumer name, phone, service address, issue description, and any photos submitted for accepted bookings
Consumers see provider name, photo, ratings, reviews, and business information
Community trust may show that a provider was used by someone in your contacts (not a dump of your address book)

Your messages

In-app booking messages and support conversations are not end-to-end encrypted. Authorised Nexus staff and our AI support agent may access message content to operate the Service, provide support, and resolve disputes. Please do not share sensitive information (such as full card numbers or passwords) in messages.

Legal requirements

We may disclose information if required by law or to:

Comply with legal obligations
Protect our rights or safety
Investigate potential violations

We do not sell your personal information to third parties.

International transfers

Some processors handle data outside Barbados (for example in the United States). Barbados has not published an adequacy decision covering those countries. We transfer that data because it is necessary to perform the contract with you (hosting, authentication, payments, support, crash diagnostics, and push delivery), and where the Act requires it we rely on the other derogations in the Act (including your consent). We use reputable providers and contractual and technical safeguards. You can ask us for more detail on a specific processor via admin@nexusbarbados.com.

4. Data Security

We implement appropriate security measures including:

Encrypted data transmission (HTTPS/TLS)
Secure authentication
Access controls and monitoring
Private file storage with signed, time-limited access links
Database access restricted to server-side functions (backend-first; no direct client database access for app data)
Regular security assessments

However, no method of electronic transmission is 100% secure.

5. Data Retention

We retain your information:

Account data — until you delete your account (subject to the deletion rules below)
Transaction and tax records — as required for legal/tax purposes (typically up to 7 years), often in anonymized form after account deletion where the law requires retention
Hashed contact records — while community-trust matching is enabled, or until you disable it / delete your account
Usage and crash logs — typically up to 12 months, or shorter if the tool’s default retention is less
Waitlist form data — until you ask us to remove it or we no longer need it for launch communications

6. Your Rights (Data Protection Act, 2019-29)

Subject to the Act and applicable exceptions, you have the right to:

Access — request a copy of your personal data
Correction — update inaccurate information
Deletion / erasure — request deletion of your account and data (see Account Deletion)
Portability — receive a portable copy of data you provided, where applicable
Object or restrict processing in certain circumstances under the Act
Withdraw consent — where we rely on consent (for example police-certificate processing), without affecting processing already carried out
Complain — lodge a complaint with the Data Protection Commissioner of Barbados

How to exercise rights: email admin@nexusbarbados.com from the address on your account (or with enough detail for us to verify you). We will respond without undue delay and within one month of receiving a valid request. If we need up to two extra months because the request is complex, we will tell you within that first month.

Account deletion (self-service): Profile → Delete Account in the app (type DELETE to confirm), or see /delete-account. You cannot delete while you have active bookings; complete or cancel them first. Some transaction records may be retained in anonymized form for legal/tax requirements.

Data Protection Commissioner (complaints and breach notices):
Email: lisa.greaves@barbados.gov.bb
Post: Data Protection Commission, Ministry of Industry, Innovation, Science & Technology, 5th Floor, SSA Building, Vaucluse, St Thomas, Barbados

If we become aware of a personal-data breach that is likely to risk your rights and freedoms, we will notify the Commissioner within 72 hours as the Act requires, and we will tell affected users where the Act requires that too.

7. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect information from children.

8. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via the app or email. The “Last Updated” date and version at the top will change when we publish a new version. The hosted page at /privacy is the published version.

9. Contact Us

For privacy-related questions or requests:

Email: admin@nexusbarbados.com
Phone: (246) 237-6872
Controller: Nexus Platform Ltd
Address: Rowans
Data Protection Commissioner: lisa.greaves@barbados.gov.bb (complaints)

This Policy describes how we process personal data under Barbados law. Using the Service is how you enter the contract the Policy supports; it is not a substitute for any consent the Act requires for a specific processing activity (such as a police certificate).