Privacy notice.

1. Scope and responsible organization

This notice concerns the public NexCog AI website and its contact, consultation, automation assessment, campaign, and project-enquiry features. It does not define the processing terms for a future client engagement, hosted business application, or customer system.

The website uses the NexCog AI brand. The owner has not supplied the responsible legal entity's registered details or a verified privacy contact. Those details must be added before launch; no address, telephone number, or contact email is implied by this draft.

2. Information an enquiry may contain

Relevant forms request a full name, business email, interested service, business challenge, and consent to process the enquiry. Depending on the form, you may optionally provide a company, phone, country, company size, existing technology, budget range, timeline, and additional message. Project context and the originating page may accompany the request.

Please avoid including credentials, payment details, sensitive personal information, confidential client material, or information about other people that is unnecessary for the enquiry. The campaign form collects fewer fields. An enquiry is not a request to join a marketing list.

3. Current delivery status and processing purpose

Enquiry delivery is currently unavailable in this environment. The site does not forward enquiries to a lead provider when delivery is disabled, and it must not show a delivery-success message.

When a provider is activated, the intended purpose is to receive, assess, route, and respond to your stated business request. The server validates and bounds the input, applies configured abuse controls, and forwards only accepted requests. Success is shown only after the configured provider acknowledges acceptance; this is not a promise that a consultation has been scheduled.

The owner must confirm the legal basis for each processing purpose and any additional communications before launch. Consent for enquiry processing and permission for optional website tracking are separate choices.

4. Technical information and campaign context

Website hosting and security services may process request metadata such as IP addresses, timestamps, browser information, and requested URLs to serve and protect the site. The application uses a submission identifier for duplicate protection and may process a bot-verification token when that protection is configured.

Recognized campaign parameters in the current page URL may be included with an enquiry to identify its business source. Submission does not depend on accepting optional analytics cookies. Form contents must not be sent as analytics events or placed in public application logs. The owner must verify the actual hosting and security logging configuration and retention.

5. Providers, recipients, and international processing

The implementation supports a private n8n webhook or an authenticated email/CRM webhook adapter. A configured workflow may route accepted enquiries into approved systems such as a CRM, Google Sheets, or an email notification service. These are available integration patterns; this draft does not assert that any particular downstream account is connected.

If enabled, Cloudflare Turnstile handles the configured bot-verification process. Optional analytics or advertising integrations remain subject to their configuration and the visitor's preference. The owner must publish the actual provider names, purposes, locations, contracts, and any required transfer safeguards before activating them. Access to enquiries should be limited to people who need it for the stated purpose.

6. Retention and security

A production retention schedule has not yet been supplied. The owner must define and publish periods or clear criteria for enquiry records, workflow execution history, emails, security logs, and backups. No deletion deadline or storage location is promised by this draft.

The application is designed to keep integration secrets server-side, validate requests, bound external calls, and avoid personal information in public error messages. Operational access controls, provider settings, backup handling, and deletion procedures also require owner verification. Technical safeguards do not establish a compliance certification or eliminate every security risk.

7. Preferences and privacy requests

You can manage optional tracking using the controls on the cookies and preferences page. Withdrawing a website preference prevents future optional tracking under that setting; it does not itself delete information already received by a provider.

Applicable law may provide rights concerning access, correction, deletion, restrictions, portability, objections, or withdrawal of consent. The owner must confirm the applicable rights, identity-verification process, response procedure, and complaint route. A verified privacy contact is a launch requirement; this draft does not offer an unconfigured form as a guaranteed rights-request channel.

8. Review and changes

Review this notice whenever forms, providers, processing purposes, tracking, retention, or the operating entity change. Publish an accurate effective date after approval and provide any additional notice required for the actual change. See also the website terms draft and cookies draft.