Privacy Policy

Last updated: 19 September 2026

This policy explains what personal data nxip collects, why, and what rights you have over it. It covers nxip.dev and nx-ip.com, operated by Sonny Wigmore, trading as nxip, of Poole, Dorset, United Kingdom ("nxip", "we", "us"), the controller of the data described below.

1. What we collect

• Account data: the email address and organization name you sign up with.
• IPAM data: the pools, subnets, and allocations you create through the API or Terraform provider. This may include names or descriptions you choose to give them; it does not include any data about the actual hosts or traffic on your networks.
• API key material: we store a one-way cryptographic hash and a short prefix of each API key, never the raw key itself.
• Audit log: a record of each change made in your organization (to pools, subnets, addresses, API keys, invitations and organization links), with which fields changed, the key and user that made the change, and their IP address and user agent. It also records sign-ins, invitations being accepted and billing events, with the email address involved rather than a link to a user record. It does not record every request, and it does not record anything that happens before your organization exists, such as a signup request or a sign-in link requested for an address with no account, which appear only in the request logs below. It is currently kept for the life of your account, and deleted with it.
• Request logs: for every API request: the requesting IP address, user agent, endpoint, and outcome, written to our hosting provider Fly.io's logs for security, abuse prevention and debugging. These are kept for Fly.io's standard log retention period, and are not deleted when you close your account.

We do not directly collect or store payment card information. Payments for paid plans are handled entirely by our payment processor, Stripe (see Section 3); nxip receives your email address, your subscription status and Stripe's references for your customer record and subscription, never card details.

Cookies. The dashboard at app.nx-ip.com sets one cookie, nxip_session, to keep you signed in. It is essential to the Service: without it you cannot stay logged in. It is encrypted, so its contents can only be read by us; it is marked HttpOnly, so scripts running in the page cannot read it; it is marked Secure, so it is only ever sent over HTTPS; it isSameSite=Lax; and it lasts up to 7 days, matching the session it holds. We set no other cookies: no tracking, no analytics, no advertising, and no browser fingerprinting or advertising identifiers of any kind. The marketing site and docs at nx-ip.com set none of their own. Our infrastructure providers (see Section 3) may set minimal operational cookies of their own as part of running their networks (for example, security/DDoS protection at the edge); we do not control or read these.

2. Why we collect it, and our legal basis

"Soft opt-in" means: because your email was collected when you created your account, and this is us marketing our own product to an existing user rather than a cold contact, UK electronic-marketing rules (PECR) let us send these without a separate consent checkbox at signup, provided we say so clearly at that point (we do, on the signup page) and give a working opt-out on every email (we do, a one-click link that needs no login). Unsubscribing only stops product-update email; account and service email (like billing or security notices) continues regardless, since that's sent under a different legal basis (performance of a contract) that doesn't depend on this consent mechanism.

3. Who we share it with

We use a small number of infrastructure providers to run the Service. We don't sell data to anyone.

The full list of these providers (sub-processors), with what each one does, what data it sees, and where, is kept in one place, on our trust page. It includes Stripe, which processes payments for paid plans (see Stripe's own privacy policy for how they handle payment data directly), and Sentry, which records errors from the Service so we can fix them. Changes to the list are published there before they take effect.

Some of these providers process data outside the UK. Resend's and Cloudflare's data processing agreements (Resend's DPA, Cloudflare's DPA) incorporate the UK and EU Standard Contractual Clauses for this kind of transfer. Fly.io self-certifies under the EU-U.S. and UK-U.S. Data Privacy Frameworks. Stripe certifies under the EU-U.S. Data Privacy Framework and its UK Extension. Sentry is a US company that stores our error reports in its EU region, in Germany; its DPArelies on the Data Privacy Framework, including the UK Extension, with the Standard Contractual Clauses as amended by the UK Addendum as the fallback. Tigris, which stores our database backups, is a US company; itsDPAincorporates the UK Addendum to the Standard Contractual Clauses for transfers out of the UK; the backup storage itself is restricted to London and Amsterdam. Google Workspace, which hosts our mailbox, applies its data processing addendum, which incorporates the Standard Contractual Clauses with the UK Addendum, and Google LLC also certifies under the EU-U.S. Data Privacy Framework and its UK Extension. We have signed data processing agreements with Tigris, Resend and Cloudflare. We do not otherwise share your data with third parties, except where required by law.

If your organization requires its own signed Data Processing Agreement covering how nxip processes personal data on your behalf (for example, if a subnet or pool description you create happens to include someone's name), email hello@nx-ip.com and we'll provide one.

4. How long we keep it

Account and IPAM data is kept for as long as your account is active. The audit log is currently kept for the life of your account and deleted with it; request logs are kept for Fly.io's standard log retention period, as Section 1 says. If you delete your account (via hello@nx-ip.com), we delete the associated organization, pool, subnet, and allocation data; a residual record may be kept briefly where needed for security or legal purposes.

5. Free tier data note

The Free tier is an evaluation offering with no guaranteed data durability. See Section 5 of our Terms of Service for details. This is a service-level position, not a change to how we handle personal data under this policy: your account email is still processed as described above regardless of tier.

6. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request erasure of your data;
• Restrict or object to certain processing;
• Receive your data in a portable format.

To exercise any of these, email hello@nx-ip.com. If you're in the UK and unhappy with our response, you can complain to the Information Commissioner's Office.

7. Security

API keys are never stored in raw form, only a one-way SHA-256 hash of the key. A key is a long random value we generate, not a password you chose, so it cannot be guessed or brute-forced the way a password can, and the hash cannot be turned back into the key. Access to production infrastructure is limited to the people operating the Service. No method of transmission or storage is perfectly secure, so we can't guarantee absolute security.

8. Data breach notification

If we become aware of a security incident that puts your personal data at risk, we will notify affected users without undue delay, and notify the ICO where the law requires it, consistent with our obligations under UK GDPR.

9. Children

The Service is not directed at, and we do not knowingly collect data from, anyone under 16.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

Questions about this policy: hello@nx-ip.com.