Xanadu Nexus

Privacy Policy

Last updated: September 24, 2026

Xanadu Nexus (“Xanadu Nexus”, “we”, “us”) provides a platform that photography, videography, and content-creation studios use to run their business: client management, scheduling, quotes, contracts, invoicing, and gallery delivery. This policy explains what information we collect through www.xanadunexus.com and the Xanadu Nexus application, how we use it, and the choices you have.

Information we collect

• Account information. Your name, email address, and profile details you choose to add. Passwords are handled by our authentication provider and are never visible to us in plain text.
• Studio content. The business records a studio creates in the service: client records, projects, quotes, contracts, invoices, schedules, questionnaires, messages, and uploaded media such as photos and videos.
• Payment information. Subscription billing and client payments are processed by Stripe. We store references to transactions (amounts, status, invoice numbers) but never full card numbers.
• Connected calendar data. If you connect a Google or Microsoft calendar, we access it as described in the next section.
• Technical data. Log data such as IP addresses, browser type, and timestamps, and cookies that keep you signed in. We do not use advertising or cross-site tracking cookies.

Connected calendars (Google and Microsoft)

Calendar sync is optional and off until you connect an account. When you connect, we use your calendar only to (a) create, update, and remove events for the work you are scheduled on in Xanadu Nexus, and (b) read the times of your other events so your availability is accurate. From events we did not create, we store only start and end times as anonymous “busy” blocks — never titles, descriptions, attendees, or locations. Access tokens are stored encrypted. Disconnecting removes the imported busy time and revokes our access; you can also choose to have the events we created removed from your calendar.

Xanadu Nexus’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use calendar data for advertising, do not sell it, and do not allow humans to read it except with your consent for support, for security purposes, or where required by law.

How we use information

• To provide, operate, and maintain the service.
• To send transactional messages such as invitations, notifications, and receipts.
• To respond to support requests.
• To protect the service and its users — for example detecting abuse and enforcing tenant isolation.
• To comply with legal obligations.

We do not sell personal information, and we do not use your content or your clients’ information for advertising.

Studios and their clients

Studios use Xanadu Nexus to manage information about their own clients. For that information, the studio decides what is collected and how it is used; we process it on the studio’s behalf to provide the service. If you are a client of a studio that uses Xanadu Nexus, please direct questions about your information to that studio.

How we share information

• Service providers. We use trusted providers to run the platform — Amazon Web Services for hosting and storage, Stripe for payments, and email delivery infrastructure for transactional mail. Each processes data only as needed to provide their service.
• At your direction. When you share a gallery link, send a quote, or connect a calendar, information goes where you send it.
• Legal. We may disclose information if required by law or to protect the rights, safety, or property of Xanadu Nexus or others.

Data retention and deletion

We retain information while your account is active and as needed to provide the service. Business records such as invoices may be retained as required for legal and accounting purposes. You can delete content within the service, disconnect calendar sync at any time, or contact us to request deletion of your account and associated personal information.

Security

Data is encrypted in transit and at rest. Every studio’s data is isolated at the database level, OAuth tokens are stored encrypted, and client-facing links are private and revocable. No system is perfectly secure, but protecting your data is a core design constraint of the platform.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to certain processing. You can exercise most of these directly in the app, or by contacting us at the address below. We will respond within the timeframe required by applicable law.

Children

Xanadu Nexus is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify account holders by email or through the service before the changes take effect.

Email we send

We send transactional email only: messages to one person about their own account or booking. That covers account email (verification, password resets, sign-in links, team invitations), email a studio sends to its own clients about their booking (inquiry replies, quotes, contracts, invoices, receipts, session reminders, gallery links), and notices to studio staff about their own work, which each person can switch off in their notification settings. We do not send marketing email from the platform and never buy or rent address lists. Every message says why it was sent and links this policy; staff notices and the daily summary carry a one-click unsubscribe. Addresses that bounce or report a message as spam are suppressed and not mailed again, and each studio has a daily limit on the email it sends to clients. To stop email you did not expect, write to support@xanadunexus.com.

Contact

Questions about this policy or your data can be sent to support@xanadunexus.com.