OG Nexus — Free. Private. Yours.

Last updated: 18 September 2026

OG Nexus Ltd (“OG Nexus”, “we”, “us” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit og-nexus.com (the “Site”), create an account, purchase a product or subscription, use our software licences, or otherwise interact with us.

This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using the Site, you acknowledge the practices described in this policy.

1. Who we are

The data controller responsible for your personal data is:

OG Nexus Ltd
Company number: 16892796 (registered in England and Wales)
Registered office: 8, 40 Dyke Road, Brighton, United Kingdom, BN1 3JB
Website: https://og-nexus.com
Email: privacy@og-nexus.com

We do not have a dedicated Data Protection Officer. All privacy and data protection queries and requests are handled directly by OG Nexus Ltd at the contact details above.

2. Personal data we collect

We collect different categories of personal data depending on how you interact with us:

2.1 Account and order data

When you register an account, place an order, or purchase a subscription or software licence, we collect: your name, email address, billing and (where applicable) shipping address, telephone number, company name (if provided), order history, product and licence details, and account login credentials.

2.2 Payment data

Payments are processed securely by our payment processor, Stripe. We do not store your full card details on our servers. Stripe collects your payment card information directly and shares with us only the data needed to process and reconcile your order (e.g. transaction ID, last 4 digits of your card, payment status). Stripe’s use of your data is governed by Stripe’s Privacy Policy.

2.3 Subscription and membership data

If you purchase a subscription or membership product, we collect and process data relating to your subscription status, renewal dates, billing cycle, payment history, and membership/plan level, in order to manage recurring billing, renewals, upgrades, downgrades and cancellations.

2.4 Software licence data

Where you purchase a software product, we generate and store licence key data associated with your account and order, and may collect activation/deactivation information (such as site URL or installation identifier) to enforce licence terms and provide support and updates.

2.5 Communications and support

If you contact us by email, contact form, or support ticket, we collect your name, email address, and the content of your message, in order to respond to you and keep a record of the correspondence.

2.6 AI chatbot / virtual assistant

The Site may offer an AI-powered chat assistant. If you choose to use it, the messages you type are sent to our AI provider, Anthropic (Claude), in order to generate a response. This may include any personal data you choose to include in your messages. We recommend you do not share sensitive personal data (such as full payment details, passwords, or special category data) in chatbot conversations. Anthropic’s processing of this data is governed by Anthropic’s Privacy Policy. Chat data may be transferred to and processed in the United States (see Section 7, “International data transfers”).

2.7 Technical and usage data

We automatically collect certain technical data when you visit the Site, including your IP address, browser type and version, device type, operating system, referral source, pages visited, and the date/time of your visit. This is collected via server logs, cookies, and Google Analytics (see Sections 3 and 4).

3. Cookies and consent

Cookies are small text files placed on your device when you visit a website. When you first visit the Site, a cookie consent banner will ask you to accept or reject non-essential cookies. You can change your cookie preferences at any time using the consent settings link available on the Site.

We use the following categories of cookies:

  • Necessary/functional cookies — required for core site functionality, such as maintaining your shopping cart/basket (WooCommerce), remembering items in checkout, keeping you securely logged in, and remembering your cookie consent choice. These are placed without requiring consent, as the Site cannot function properly without them.
  • Statistics (analytics) cookies — set by Google Analytics to help us understand how visitors use the Site (see Section 4). These are only placed with your consent, IP addresses are blocked/anonymised, and data is used for anonymous statistics only — not for advertising.
  • Marketing/tracking cookies — we do not currently use any cookies for advertising, retargeting, or cross-site tracking, and we do not use social media cookies.

For a full, itemised list of the specific cookies placed on the Site, their provider, purpose and expiry, please see our dedicated Cookie Policy, which is generated and kept up to date automatically as the Site’s cookie usage changes.

You can also control and delete cookies through your own browser settings at any time. Blocking non-essential cookies will not prevent you from using the core functions of the Site, but blocking strictly necessary cookies may prevent features such as the shopping cart and checkout from working correctly.

4. Analytics

We use Google Analytics, with consent, to understand how visitors use our Site so that we can improve it. IP addresses are blocked/anonymised and data is used only for anonymous, aggregated statistics. This data is processed by Google and may be transferred outside the UK (see Section 7). For more information, see Google’s Privacy Policy and Google’s guide on how Google Analytics processes data. You can also opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on.

5. How and why we use your data (legal basis)

Under UK GDPR, we must have a valid legal basis to process your personal data. We rely on the following:

  • Performance of a contract — to create and manage your account, process orders, deliver purchased products/services, administer subscriptions and memberships, issue and manage software licences, and provide customer support.
  • Legal obligation — to keep financial and tax records as required by HMRC, to respond to lawful requests from authorities, and to comply with consumer protection law.
  • Legitimate interests — to maintain the security and proper functioning of the Site, prevent fraud, understand and improve how the Site is used (via analytics), and enforce our software licence terms. We only rely on legitimate interests where these do not override your own rights and interests.
  • Consent — where required, for example for non-essential (statistics) cookies, or if you voluntarily use the AI chatbot. You can withdraw consent at any time (see Section 3 and Section 9).

We do not currently send marketing or promotional emails. If this changes in the future, we will only do so with your consent (or another valid legal basis) and will always provide a clear way to opt out.

6. Who we share your data with

We do not sell your personal data. We share personal data only with trusted third parties who process it on our behalf (“processors”) or who require it to provide a service to you:

  • Stripe, Inc. — payment processing for one-off purchases and recurring subscription billing.
  • Anthropic — processes messages you send to the AI chatbot, where used.
  • Google LLC (Google Analytics) — website usage analytics, with consent.
  • Complianz — our cookie consent management provider, which records your consent choices (such as your IP address, consent status, and timestamp) as required by law to demonstrate compliance.
  • Hosting and infrastructure providers — who host the Site and store its data (including WordPress, WooCommerce, and related plugin data) on our behalf, under contractual confidentiality and security obligations.
  • Backup service providers — used to create secure backups of the Site (including order and account data) for business continuity and disaster recovery purposes.
  • Professional advisers and authorities — such as our accountants, auditors, insurers, or law enforcement/regulators, where necessary to comply with a legal obligation or protect our legal rights.

If we send a password reset on your behalf, your IP address will be included in the reset email. If our business is sold or restructured, personal data may be transferred to the new owner as part of that transaction, subject to the same protections described in this policy.

7. International data transfers

Some of the third parties we use (including Stripe, Anthropic, and Google) are based in, or process data in, the United States or other countries outside the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, an adequacy decision, or another legally recognised transfer mechanism, so that your data continues to receive a level of protection equivalent to UK data protection law.

8. How long we keep your data

  • Financial and order records (invoices, transaction records, tax-relevant data) are retained for 6 years from the end of the relevant tax/financial year, in line with HMRC record-keeping requirements.
  • Account data is retained for as long as your account remains active. If you close your account or request deletion, we will delete or anonymise your personal data, except where we are required to retain it for legal, tax, or fraud-prevention purposes (such as the financial records above).
  • Subscription and licence data is retained for the duration of the subscription/licence and for a reasonable period afterwards to handle renewals, disputes, or support queries.
  • Support and correspondence is retained for as long as reasonably necessary to resolve your query and for a reasonable period afterwards for record-keeping.
  • AI chatbot conversations are retained only as long as necessary to provide the service and in accordance with Anthropic’s data retention practices for API data.
  • Analytics data collected via Google Analytics is retained in accordance with our configured Google Analytics data retention settings.
  • Cookie consent records are retained by our consent management provider, Complianz, as evidence of your consent choices, in accordance with legal record-keeping requirements.

9. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access — request a copy of the personal data we hold about you.
  • Right to rectification — ask us to correct inaccurate or incomplete data.
  • Right to erasure — ask us to delete your personal data, where there is no legal reason for us to continue processing it.
  • Right to restrict processing — ask us to limit how we use your data in certain circumstances.
  • Right to data portability — request that we transfer your data to you or a third party in a structured, commonly used, machine-readable format.
  • Right to object — object to our processing of your data based on legitimate interests, or for analytics purposes.
  • Right to withdraw consent — where we rely on your consent (e.g. non-essential cookies or use of the AI chatbot), you may withdraw it at any time, including via the cookie consent settings on the Site.
  • Rights related to automated decision-making — we do not currently use your personal data for any decision-making that produces legal or similarly significant effects on you based solely on automated processing.

If you have an account with us, you can access and update most of your personal data (such as your name, address and order history) directly from your account dashboard.

To exercise any of these rights, contact us at privacy@og-nexus.com. We will respond within one month, as required by law. We may need to verify your identity before actioning a request.

10. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. This includes the use of secure (HTTPS/TLS) connections, access controls, regular software updates, and secure, access-controlled backups. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner’s Office and affected individuals as required by law.

11. Children’s privacy and age restrictions

Our Site and products are intended for business and professional use and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us at privacy@og-nexus.com and we will take steps to delete it.

Certain current or future products (including security and penetration-testing tools, such as OG Red Team) are intended solely for authorised, professional and lawful use by adult users. Access to such products may require you to confirm you are at least 18 years old and are authorised to use the tool for lawful purposes, and additional age or eligibility restrictions may be specified on the relevant product page.

12. Third-party links and embedded content

Our Site may contain links to third-party websites, or embedded content (such as videos), which are not operated by us. If you click a third-party link or interact with embedded content, you will be subject to that third party’s own privacy policy. We recommend you review the privacy policy of any third-party site you visit.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page with a revised “Last updated” date. We encourage you to review this policy periodically.

14. How to complain

We hope we can resolve any query or concern you raise about our use of your data. If you have any concerns, please contact us first at privacy@og-nexus.com.

The UK GDPR also gives you the right to lodge a complaint with the UK’s independent supervisory authority for data protection:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint

15. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

OG Nexus Ltd
8, 40 Dyke Road, Brighton, United Kingdom, BN1 3JB
Email: privacy@og-nexus.com
Website: https://og-nexus.com