Privacy Policy
Effective date: 14th October 2026
1. Who We Are
NDS Solutions Ltd ("we", "us", "Nexus") is the data controller for personal data collected through the Nexus Global Safety Platform. We are registered in England and Wales with our principal place of business in Liverpool, United Kingdom. Contact Us
2. What Data We Collect
2.1 Account Data
When you register, we collect your name, email address, password (hashed), country, and any optional profile information you choose to provide.
2.2 Location Data
With your permission, we collect precise GPS location to power SOS alerts, Safe Walk Home, the local safety mesh and missing person coordination.
Nexus does not track you in the background. Location is collected while you are using the app, and while an alert or a walk you started is running — which continues with your screen locked and the phone in your pocket, because that is the situation these features exist for. It stops when the alert
or the walk ends. Nexus does not ask for “all the time” location access and cannot locate you when nothing is running.
A venue emergency alert is filtered on your own phone: the handset works out for itself whether the alert is meant for it, and no location is sent to us to do that. When you raise an alert, your location is sent, because it is what allows help to find you — see Section 7.3 for who receives it.
2.3 Device and Technical Data
We collect your device type, operating system version, app version, Bluetooth signal data (anonymised), battery level (for SOS context), and crash/diagnostic data.
2.4 Alert and Case Data
If you submit an SOS alert, missing person report, or Rapid Alert, we collect the information you provide including descriptions, photographs, and location at time of submission.
2.5 Volunteer and Witness Data
If you register as a volunteer or witness, we collect your occupation, skills, and any contact information you provide for coordination purposes.
2.6 Communications
We may collect messages sent through the Platform's coordination features. We do not read private messages between users except where required for safety, legal compliance, or fraud investigation.
2.7 Audio Recording
Nexus records audio in two situations, and only these two:
• Silent Witness — during a silent alert you have raised yourself, Nexus can record short audio clips so that what happened is not only your word against someone else’s. The recording goes to you, and to nobody else. It is on unless you turn it off, you choose how long Nexus waits before sending it to you, and it is never attached to the loud emergency SOS. On a child’s account it is off unless an adult turns it on.
• Safe Walk Home — if your safety timer runs out and an alert is raised, Nexus records short audio clips and makes them available to the people you chose to watch your walk, so they can decide whether to call the police.
Recordings are deleted after 30 days, or immediately if you close your account or stand the alert down. Nexus is not listening at any other time. The microphone is not used for anything else, and never in the background without an alert you raised.
3. How We Use Your Data
We use your personal data to:
• Provide, operate, and improve the Platform and its safety features
• Send and relay SOS alerts and emergency notifications
• Coordinate missing person searches and Rapid Alert broadcasts
• Verify your identity and maintain account security
• Enable BLE mesh relay functionality (using anonymised signals only)
• Communicate with you about your account, alerts, and Platform updates
• Comply with legal obligations and cooperate with law enforcement where required
• Detect and prevent fraud, abuse, and misuse of the Platform
4. Legal Basis for Processing
4.1 United States (CCPA and State Privacy Laws)
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA. We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising. Your CCPA rights are described in Section 11.
We collect and use personal data as described in this Policy for the following business purposes: providing the Platform, safety coordination, fraud prevention, legal compliance, and improving our services.
4.2 United Kingdom and European Union (UK/EU GDPR)
For users in the UK or EU, we rely on the following legal bases under UK GDPR / EU GDPR:
• Contract — processing necessary to provide the Platform services you have signed up for
• Legitimate interests — improving the Platform, fraud prevention, and network security
• Legal obligation — complying with applicable law and cooperating with authorities
• Consent — for location access, microphone access and marketing communications (you may withdraw consent at any time)
• Vital interests — to pass your name and location to the venue you are in, and to vetted responder organisations, when you raise an alert, so that help can reach you
5. Location Data — Special Notice
Location data is central to the safety purpose of the Platform. We treat it with the highest level of care:
• Precise location is only shared with other users in the context of active SOS alerts or missing person coordination, and only to the extent necessary
• Historical location trails are retained for a limited period to support ongoing cases and are then deleted
• We do not sell your location data to advertisers or third-party data brokers
• You can disable location permissions at any time via your device settings, though this will significantly limit Platform functionality
6. Mesh Relay
Where you participate in the Platform's local safety network, your device may relay safety signals between nearby users to support emergency features. Any such relayed signals are encrypted and contain no personally identifiable information. Your device does not store the content of relayed signals.
7. Data Sharing
We do not sell your personal data. We share data only in the following circumstances:
7.1 Emergency and Law Enforcement
Where an active SOS alert or missing person case involves risk to life, we may share relevant data with law enforcement or emergency services without prior notice. We will cooperate fully with valid legal requests.
7.2 Service Providers
We use trusted third-party providers to operate the Platform, including:
• Amazon Web Services (AWS) — cloud infrastructure and data storage
• Amazon Cognito — identity and authentication
• Google Maps — mapping and location display
• UltraMsg — WhatsApp notification delivery
• OpenAI — AI-assisted coordination briefings (anonymised case data only)
• Resend — email delivery
• Sentry — crash and error diagnostics
• LocationIQ — address lookup
All providers are contractually bound to handle your data securely and only for the purposes we specify.
7.3 Who Is Told When You Raise An Alert
Raising an alert is a request for help, so Nexus passes your details to people who can give it. Who that is depends on which alert you raise, and the app tells you before you press.
Your emergency contacts. Always. They receive your name, a message saying you need help, and a link that lets them follow your location while the alert is running. You choose who these people are and you can change them at any time.
The venue you are in. If you raise a Silent alert inside premises that use Nexus — a pub, a club, a hotel — the people that venue has made responsible for emergencies are told your name and where you are, so somebody close by can help. This is limited in three ways:
• Only the venue you are actually inside. Nexus checks your position against that venue’s own boundary, and if we cannot place you inside one, no venue is told.
• Only the people the venue has nominated — its duty managers and administrators — not every member of staff.
• The app shows you which venue will be told before you raise the alert. If you would rather nobody at the venue knew, Silent Witness tells only the contacts you chose.
Vetted responder organisations. Search and rescue teams, and in time police and support services, may see alerts raised in the area they cover, on a secure monitor only they can reach. These organisations are checked by us before they are given access, are limited to their own area, and cannot grant themselves that access.
Silent Witness tells no venue and no responder organisation. It goes to the contacts you chose, and the recording goes to you alone.
We share your alert for one reason: so that help can reach you. We do not share it with anybody else, we do not sell it, and nobody receives it for marketing or analytics.
8. Where Your Data Is Held
Nexus UK is hosted entirely in the United Kingdom, in Amazon Web Services’ London region (eu-west-2). Your account, your alerts, your location data and any audio evidence are stored and processed there.
A small number of service providers listed in Section 7.2 operate outside the UK. Where that is the case, appropriate safeguards are in place, including standard contractual clauses where required under UK GDPR.
9. Data Retention
We keep as little as possible, for as short a time as possible.
• Alerts and the location trail attached to them — 30 days, then deleted automatically.
• Audio evidence (Silent Witness, Safe Walk) — 30 days, then deleted automatically, and sooner if you ask us. Email Contact Us with the reference on the recording and we will delete it and confirm.
• Live location trails during a walk or an alert — 7 days.
• What a venue or a responder organisation was told — the alert disappears from their Nexus screen when the 30 days are up, at the same time it disappears from ours. A message already sent to a duty manager’s phone is on their phone, in the same way a text message is, and we cannot reach into it to delete it. That is why we limit who is told in the first place, and why the app names the venue before you raise the alert.
• Account data — kept while your account is open. Closing your account deletes it immediately, along with your alerts, their location trails, your audio recordings and the contact details of anyone you asked to watch you walk home.
• Missing person reports — kept while the person is missing, and for a period afterwards. These are reports about another person and may form part of a live police investigation, so they are not deleted on request by the reporter alone.
• School safeguarding records — where a school uses Nexus, records of safeguarding concerns are held for the school under its own statutory retention duties, and are not ours to delete.
See Section 11 for how to delete your account and what happens when you do.
10. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
• JWT-based authentication on all API endpoints
• Encryption of data in transit (TLS) and at rest
• Automated backup and recovery across all databases
• Comprehensive audit logging across our infrastructure
• Regular security reviews and penetration testing
No system is completely secure. If you believe your account has been compromised, Contact Us immediately.
11. Your Privacy Rights
11.1 All Users
Regardless of your location, you may:
• Access and update your account information via the app settings
• Delete your account at any time via app settings or by contacting us
• Opt out of marketing communications at any time
• Disable location permissions via your device settings
11.2 California Residents (CCPA/CPRA)
As a California resident you have the right to:
• Know what personal information we collect, use, disclose, and sell (we do not sell)
• Delete your personal information (subject to legal retention requirements)
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell or share for advertising)
• Non-discrimination for exercising your privacy rights
To submit a CCPA request, Contact Us. We will respond within 45 days.
11.3 UK and EU Users (UK/EU GDPR)
You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. To exercise these rights Contact Us. We will respond within 30 days.
UK users may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. EU users may contact their local supervisory authority.
12. Children And Young People
Nexus is used by adults and by people aged 13 and over who create their own account. Anyone under 13 cannot register themselves: our sign-up asks for a date of birth and refuses accounts below that age.
Children under 13 use Nexus only where an adult responsible for them has set it up — a parent or carer from their own Nexus account, or a school for its pupils. In both cases the adult or the school holds the account and can end it at any time, and the child is never signed up from an app store.
Where a child uses Nexus:
• Their privacy settings start at the most private option. Silent Witness audio recording is off by default on a child’s account, where it is on by default for an adult.
• No parent, carer or school can turn on a child’s location from their own device. A parent can ask “where are you?” and the child decides whether to answer. Nothing is shared unless the child chooses to share it.
• A child can raise an alert, and can tell everyone they are safe, but cannot be tracked between alerts.
We do not use children’s data for advertising or profiling, and we do not sell it. If you believe a child under 13 has created an account themselves, please contact us and we will delete it.
13. Cookies and Tracking
The Nexus mobile application does not use advertising cookies or third-party tracking. The Nexus web console (nexus-global.ai) uses essential cookies only, required for authentication and session management. We do not use cookies for advertising or behavioural tracking.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The effective date at the top of this document indicates when the current version came into effect.
15. Contact Us
For any privacy-related queries or to exercise your rights:
NDS Solutions Ltd
Liverpool, United Kingdom
Contact Us