Privacy Policy — Your Data, Your Rights
Overview
This policy explains what NexMedia collects, why, and what happens to it. NexMedia is operated by NexTecSol, Safari Valley, Bahria Town, Islamabad, Pakistan, which is the data controller for the personal data described here. The short version: the service is built to know as little about you as possible — guests convert files without an account, uploaded and converted files are deleted automatically, and analytics runs only with your consent.
Data we collect
Guests: the first conversion creates a guest identity cookie in your browser. It is an opaque identifier used only to associate your uploads, jobs and download links with you — no email address, name or payment details are collected.
Accounts: if you create an account, we store your email address, a hashed password and your sign-in sessions, plus the plan and credit balance needed to run billing and the conversion quota.
API keys: you can create scoped API keys for programmatic access. Each key has a visible prefix (the secret part is stored only as an Argon2id hash and is not recoverable) and is never logged. Keys can be revoked at any time from your account.
Cloud storage: if you connect Google Drive, Dropbox or OneDrive for import/export, an OAuth grant (scoped to file access) and a refresh token are stored encrypted at rest (AES-256-GCM). Tokens are revoked at the provider during account erasure where the provider supports it.
Contact form: submissions are not stored in our database — the form opens a prefilled email in your own mail app, and nothing is sent until you review and send it. If you include your email address, it travels only as the correspondent's address for the reply.
Payments: paid plans are processed by Stripe. Card details are entered on Stripe’s checkout and never reach our servers.
Analytics: only if you accept analytics cookies, Google Analytics records how the site is used — pages viewed, clicks and page-speed measurements — under a pseudonymous identifier.
Files you upload
Files you upload exist to be converted: they are scanned, processed and then deleted after 2 hours, and download links expire with them. We do not sell customer file data and we do not mine any data from it.
Cookies and tracking
Strictly necessary cookies are always set: the guest identity or session cookie and your theme preference. Analytics runs only if you accept it in the cookie banner: then Google Tag Manager and Google Analytics load and set their cookies to measure how the site is used. Nothing is loaded before you accept, no advertising trackers are used, and you can withdraw consent at any time under "Cookie settings" in the footer.
Third parties
We do not sell or share your personal data. Third-party processing is limited to what the service needs to run: Stripe for paid plans, Google (Google Tag Manager and Google Analytics) but only if you accept analytics cookies, and — when you choose to connect them — Google Drive, Dropbox and OneDrive for the cloud-storage import/export you explicitly initiate. Your files are never sold or mined; imports and exports transfer file content between your own provider account and our storage at your direction.
The full, up-to-date subprocessor list is published as a separate document, and notice is given before any new subprocessor is added.
Subprocessors and service providers
We do not sell or share your personal data. Processing by third parties is limited to what the service needs to run: Stripe for payments and subscriptions, the hosting provider and object-storage backend for this deployment, and — only if you accept analytics cookies — Google (Google Tag Manager and Google Analytics).
When you connect a cloud-storage account (Google Drive, Dropbox or OneDrive) for import/export, those providers act as your processors for the file content you move through them: tokens are stored encrypted at rest, the transfer happens at your explicit direction, and tokens are revoked during account erasure where the provider supports it.
The hosting provider, object storage and database all run on our own servers in the European Union, so those components are EU-resident. Stripe and the cloud-storage providers operate on their own infrastructure; Google Analytics is only enabled if you accept analytics cookies.
Malware scanning runs on self-hosted ClamAV; it processes content for safety checks but transmits nothing off-host.
A written Data Processing Agreement and the current subprocessor list are available on request at contact@NexMedia.online.
Google Analytics, where enabled, is configured for IP anonymisation and does not receive file content or account identifiers.
Data retention
Files you upload exist only to be converted: source blobs and converted outputs are deleted automatically after 2 hours, and download links expire with them. Export artifacts are single-use and expire after one hour.
Sessions last up to a month (or until revoked) and login-attempt records expire within the lockout window. Webhook delivery logs are kept for a month. Application logs are retained for 14 daily files when file logging is enabled.
Audit log entries are retained long-term — including across account erasure — because they record the fact that an erasure occurred and support security monitoring. The audit trail contains only IDs (admin:/account:/apikey:/system: + UUID), never email addresses.
Abuse reports and safety-escalation records (child-safety hash matches) are retained as long as needed for abuse handling and are not tied to the erased account's personal data.
Stripe retains your billing history as an independent controller; the platform keeps no shadow financial record after erasure. Infrastructure backups follow the provider's deletion semantics and are a documented residual risk until their rotation passes.
Where your data lives and international transfers
NexMedia is operated by NexTecSol, whose team is based in Islamabad, Pakistan. All files and databases live on our own self-hosted servers in the European Union: application servers, PostgreSQL and Redis on the compute host, and an S3-compatible object store. Uploaded files, converted outputs and database records are therefore stored in the EU.
Requests to the site pass through Cloudflare, which provides DNS, CDN and security services, including Turnstile bot-protection checks on protected endpoints. Your IP address and TLS-protected connection metadata are processed by that infrastructure to deliver and secure the site. All traffic is TLS-encrypted and nothing is served before Cloudflare.
No file is uploaded to any third-party AI service, translation API or cloud model provider. Conversions run entirely on our own EU servers using locally installed open-source engines (FFmpeg, libvips, Calibre and others). Converted outputs are deduplicated by content hash: an identical file converted twice returns the same stored output, and outputs expire on schedule regardless of what you do.
Per-account region selection is not supported: all storage is in the EU, so no choice is needed. A small number of processors operate on their own infrastructure outside our control (Stripe for payments; Google Analytics only if you accept analytics cookies; the cloud-storage providers Google, Dropbox and Microsoft when you connect an account; Cloudflare for delivery and protection). Anything we do not control is listed in the subprocessor section with its own data-transfer terms, and transfers to NexTecSol staff (for example, a support request) rely on appropriate safeguards such as standard contractual clauses.
Cookies and browser storage
Strictly necessary browser storage keeps the site working. Before analytics consent, none of the analytics cookies listed below come into existence.
| Storage key | What it does | How long | Category | |---|---|---|---| | the site's identity cookie (NexMedia with a _guest suffix, HTTP-only) | Your guest identity or signed-in session token. Links your uploads, jobs and download links to you. Contains no email, name or payment data. | a month (session cookie), then expires | Necessary | | NexMedia theme key (localStorage) | Remembers your light/dark theme choice so the site reopens in the same mode. | Until you clear your browser storage | Preference | | NexMedia language key (localStorage) | Remembers the interface language you selected. | Until you clear your browser storage | Preference | | NexMedia consent key (localStorage, versioned) | Remembers which cookie categories you accepted and when, so the consent notice does not reappear on every visit. | 1 year | Necessary | | _ga, _ga_* (cookies) | Google Analytics 4 property and campaign cookies, measuring which pages and tools are used. Set by Google only after you accept analytics cookies. | 2 years | Analytics | | _gid (cookie) | Google Analytics 4 freshness cookie, distinguishing visits within a short window. Set by Google only after consent. | a day | Analytics |
We set no advertising cookies. If analytics consent is refused, the Google Analytics rows in this table never come into existence. You can change your choice at any time via "Cookie settings" in the footer.
Abuse and safety
Abuse reports contain text the reporter submits (which may name a target) and, optionally, reporter contact details. They are retained as long as needed for abuse handling and are not deleted automatically — retention is a policy decision reviewed by the operators.
Safety-escalation records contain only technical identifiers (a blob id and a job id) and a matched hash-list id. They carry no file content, no account id and no email address, and they are retained as the record of a safety check. Deleting an account does not remove safety-escalation rows, but they contain no data attributable to the erased subject.
The platform scans uploads for malware on a self-hosted ClamAV engine before any conversion runs — fail-closed, so a detection refuses the file rather than converting it.
Your rights and your data
Under the GDPR you have the right to be informed, to access your data, to rectification, to erasure, to restrict processing, to data portability, to object, and not to be subject to automated decision-making. Signed-in accounts have self-service access to two of these directly: data export (portability) and account erasure (deletion) from the account privacy page at any time.
Both require your current password to start — export assembles your data into a machine-readable JSON file with a single-use, time-limited download; erasure permanently and verifiably deletes your account and files, cascading through the database and object storage.
Guests have no account data: the guest identity cookie carries no name, email or payment information, and clearing your browser cookies removes it. If you have a question about any other right, the contact page is the place to ask — and the right to lodge a complaint with your supervisory authority is always available.
How we protect your data
TLS 1.2 or higher is enforced on every connection. Passwords are never stored in plain text: they are hashed with Argon2id using a unique random salt per password, and verification runs in constant time.
Download links are signed and expire shortly after they are issued. Session and refresh tokens are HMAC-protected and short-lived: access tokens rotate every 15 minutes and refresh tokens last up to two weeks. Login attempts are rate-limited with a lockout window.
Rate limits, Cloudflare Turnstile bot protection and validated uploads enforce per-tier size and page ceilings. Access to data inside the platform is minimal and least-privilege for both services and staff. We never sell your personal data.
Security
Files are uploaded over encrypted connections and processed on isolated workers. Sign-in sessions are server-side and can be revoked individually. The security page describes the measures in more detail.
Children's privacy
The service is not directed at children under 13 (or the local digital-age threshold, whichever is higher), and we do not knowingly collect personal data from children. If you believe that a child has submitted personal data through this service, tell us and we will delete it without delay.
Changes to this policy
If this policy changes materially, the updated version is published on this page with a new “last updated” date. Continued use of the service after a change takes effect means you accept the updated policy.
Questions
If anything in this policy is unclear, or you have a privacy question this page does not answer, reach the maintainers through the contact page.