PRIVACY POLICY

This Privacy Policy (the "Policy") explains how TESTTOTRAIN S.A.S., trading as Nexo Kinetics (the "Company", "we", "us" or "our"), collects, uses, shares and protects personal data when you visit our website, buy our hardware, or use our software (together, the "Services").

In short: we collect what we need to run an account, ship an order, issue an invoice and answer a message. We also measure how the site is used, with a tool that stores nothing in your browser — which is why this site shows you no cookie banner. See Cookies and similar technologies.

We never sell your personal data. We do not use it to make decisions about you by automated means alone.

You can ask us at any time what data we hold about you, and ask us to correct or delete it. Write to support@nexokinetics.com; see Your rights.

The data controller — the party that decides why and how your personal data is processed — is:

Data you give us

• Account data: name, email address and the password you set, stored only as a cryptographic hash and never in readable form.
• Contact data: the name, email address, phone number and message you send through our contact form, by email or over WhatsApp.
• Professional data: the profession, institution, sport or team you tell us about when you request a demo or a quote.

Data from a purchase

• Order data: the products bought, the amount, the currency and the order reference.
• Shipping data: recipient name, delivery address, phone number and, for international shipments, the tax or identity document number that customs authorities require.
• Billing data: the tax identification and billing address needed to issue the invoice that Argentine law requires us to issue.
• Payment data: we do not receive or store your full card number. Payments are entered directly with our payment providers, who tell us only the result, the payment method and the last digits of the card.

Data from using the software

• Subscription data: the plan, its status, its renewal date and the payment history of the subscription.
• Content you create: the athletes, groups, training plans, sessions and notes that you record in the application.
• Measurement data: the results your Nexo Jump platform or Nexo Interface produces — jump heights, contact and flight times, derived indices — together with the athlete they belong to. See Athlete and performance data.

Data collected automatically

• Technical data: IP address, browser and operating system, device type, language and the approximate city inferred from the IP address.
• Usage data: the pages you open, the buttons you press, the referring site or advertisement, and the date and time of each event.
• No identifier is kept in your browser: the analytics id exists only in the memory of the page you are on, and is gone when you close the tab. We do not record your session, and we set no advertising cookies.

A cookie is a small file a website stores in your browser. We set only the ones the site cannot work without, so there is nothing here for you to accept or refuse — and no banner asking you to.

Strictly necessary (the only ones we set)

• Session and authentication: keeps you signed in and protects the forms against cross-site request forgery. Deleted when your session ends or you sign out.
• Preferences: remembers your language so the site opens in it next time.
• Checkout: a short-lived note in your browser's own storage that carries your order across the payment provider and back, so the confirmation page can show you what you bought.

Analytics without cookies

• PostHog measures which pages are read and which buttons are pressed. Its identifier lives only in the memory of the open page: nothing is written to your browser, and nothing survives the tab being closed.
• We removed Google Analytics rather than ask you to accept it.
• We do not record or replay your session.
• We set no advertising cookies, and run no Meta Pixel or other third-party advertising tag. When you buy something we report the purchase to Meta from our own server, with your email address and phone number hashed into an irreversible form — see Who we share it with.

Your browser can block or delete cookies on its own. If you block the strictly necessary ones, signing in and completing a purchase will stop working.

We process personal data only where we have a lawful basis to do so under Argentine Law No. 25.326 on the Protection of Personal Data and, where they apply to you, the Brazilian LGPD, Chilean Law No. 21.719 and the other data protection laws of the countries we sell to.

• To provide the Services — create and maintain your account, run the software, process your order and deliver it. Basis: performance of the contract you entered into with us.
• To take payment and prevent fraud — process the payment, verify it and manage refunds and chargebacks. Basis: performance of the contract, and our legitimate interest in preventing fraud.
• To meet our legal obligations — issue and keep invoices, complete export and customs formalities, answer the tax and consumer authorities. Basis: compliance with a legal obligation.
• To support you — answer your messages by email or WhatsApp and keep a record of the conversation. Basis: performance of the contract, and our legitimate interest in answering enquiries.
• To send you commercial messages — news, offers and product announcements. Basis: your consent, which you may withdraw at any time through the unsubscribe link in every message.
• To measure and improve the Services — see which pages are read and where a purchase is abandoned, through analytics that store nothing in your browser and do not identify you individually. Basis: our legitimate interest in understanding how the Services are used.
• To defend our rights — establish, exercise or defend legal claims. Basis: our legitimate interest.

We do not sell personal data and we do not share it with anyone for their own marketing. We do share it with the providers that operate parts of the Services on our behalf, each of them bound to use it only on our instructions:

• Hosting and infrastructure: Vercel Inc. for the website, and Supabase Inc. for the database, the authentication and the file storage.
• Payments: dLocal Go, Mercado Pago and Payway/Decidir for card and local payment methods, and Polar for some international subscriptions.
• Shipping and customs: Envía.com and the carriers it contracts, which receive the recipient's name, address and phone number and, for international parcels, the customs declaration and document number.
• Invoicing: the Argentine tax authority (ARCA/AFIP), which receives the invoice data that the law requires us to report.
• Messaging and email: Meta Platforms for WhatsApp Business, and Resend for transactional and support email.
• Analytics and advertising: PostHog, which processes page and event data without storing anything in your browser; and Meta Platforms, which receives the fact of a purchase together with your email address and phone number in hashed, irreversible form.
• Professional advisers: our accountants and lawyers, and the authorities or courts entitled to require the data by law.

If the business is ever sold or reorganised, personal data may pass to the acquirer, which would remain bound by this Policy until it tells you otherwise.

We are based in Argentina and the Services are operated from there. Several of the providers listed above store data in the United States and in the European Union, so using the Services involves transferring your data outside your own country.

Where a transfer goes to a country that your law does not consider to provide adequate protection, we rely on the contractual safeguards signed with each provider, which oblige it to protect the data to the standard the law that applies to you demands.

We keep personal data only as long as we need it for the purpose it was collected for, and then for as long as the law requires us to keep it:

• Account and software content: for as long as the account exists, and up to thirty days after you ask us to delete it.
• Invoices, orders and tax records: ten years from the transaction, as Argentine commercial and tax law requires.
• Support conversations: up to two years after the last message.
• Analytics events: up to two years, in a form that does not identify you individually.

Our software is used by coaches, physiotherapists, gyms and institutions who record data about the athletes and patients they work with — the athlete's profile and the measurements the equipment produces. Depending on the country, some of that data may count as health data, which is given special protection.

For that data the professional or institution using the software is the controller and we act as their processor: we store and process it on their instructions and never for our own purposes. The professional or institution is responsible for having a lawful basis — normally the athlete's informed consent, or that of a parent or guardian if the athlete is a minor — before recording anyone's data in the software.

If you are an athlete or a patient and want to know what has been recorded about you, ask the professional who measures you first. If you cannot reach them, write to support@nexokinetics.com and we will help you identify the account and pass the request on.

Whichever country you are in, you may ask us to:

• Access the personal data we hold about you, and be told where it came from and who we shared it with.
• Correct data that is inaccurate, out of date or incomplete.
• Delete data we no longer have a reason or an obligation to keep.
• Withdraw a consent you gave us for commercial messages, without affecting what we did before you withdrew it.
• Object to, or ask us to restrict, a processing that relies on our legitimate interest.
• Receive a copy of the data you gave us, in a portable, machine-readable format.
• Anonymise or block the data, and be told with whom it has been shared, where the law that applies to you provides for it.

Write to support@nexokinetics.com from the address the account uses and tell us what you want. We answer access requests within ten calendar days, and correction or deletion requests within five business days, as Argentine law requires — sooner where the law that applies to you demands it. There is no charge.

If you believe we mishandled your data you may complain to the supervisory authority of your country: in Argentina, the Agencia de Acceso a la Información Pública; in Brazil, the ANPD; in Chile, the Agencia de Protección de Datos Personales. We would rather you told us first, at support@nexokinetics.com, so that we can put it right.

We protect personal data with encryption in transit on every page and every interface, encryption at rest in our database, access limited to the staff who need it, and passwords stored only as hashes. Card details never reach our systems.

No system is perfectly secure. If a breach ever affects your personal data and creates a significant risk to you, we will notify you and the competent authority as fast as the applicable law requires.

The Services are bought and operated by adults, and we do not knowingly create accounts for children. Athletes under the age of majority may be measured by a professional using the software, in which case that professional must hold the consent of the parent or guardian — see Athlete and performance data. If you believe a child's data reached us without that consent, write to support@nexokinetics.com and we will delete it.

We may update this Policy as the Services change or as the law does. The date at the top always shows the current version. If a change materially affects how we use your data, we will tell you by email or in the Services before it takes effect, and where the law requires it we will ask for your consent again.

For any question about this Policy, or to exercise the rights described above, contact us at: