How NULX handles your data

1. Information we collect

We collect the minimum information needed to provide the service, operate your account, and respond to inquiries.

• Account authentication information: your email address, sign-in method, and verification records. If you choose Google sign-in, we process the corresponding account identifier.
• Your organization name and a separate billing email address for invoices and payment notices
• Inquiry information: name, company, email, optional phone number, inquiry type, video-volume range, and message
• Signup attribution: the first NULX path visited while signed out, referring domain, and visit time. If you sign up, this is linked to your account; the full referring URL and an IP address for this attribution record are not stored.
• Video processed by you or your team plus related metadata. Files for a free account without connected storage use NULX-managed storage; files assigned to connected customer storage stay with the selected provider. Video processing may require temporary handling of your media to provide the service.
• Usage metering data for encoding, automatic captions, and storage or delivery usage
• Records of security- and billing-relevant actions, such as logins, API key creation, plan changes, and cancellation requests
• Operational request analytics: the account or authenticated user, requested feature, timestamp, processing result and duration, reported device/OS category, and referring domain. These records do not contain passwords, API tokens, request bodies, full referring URLs, or screen recordings; they are retained for 30 days by default
• Optional usage recordings: with your consent, Microsoft Clarity records clicks, scrolling, page navigation, and masked page content in the customer dashboard to help us improve usability.
• Webhook endpoint URLs you configure, if you use the webhooks feature to receive event notifications
• IP addresses, captured for rate limiting (abuse prevention) and recorded in audit/session logs for security purposes

2. Cookies

We use first-party cookies for login, form security, language preferences, and first-touch signup attribution. Operational request analytics uses server-side request records and does not create a separate visitor-tracking cookie. With your consent, Microsoft Clarity uses analytics cookies for dashboard usage recordings. Advertising storage consent is denied.

• Service cookie: supports secure forms, page notices, and signup attribution
• Login cookie: keeps you signed in and expires after 14 days of inactivity or 90 days total, whichever comes first
• Language preference cookie: remembers your selected language for one year
• You can block or delete cookies in your browser. Blocking session or login cookies may prevent sign-in and secure forms from working; deleting the locale cookie resets your language preference.
• Clarity is loaded only after you allow analytics. Choose Usage analytics preferences in the dashboard to decline or withdraw consent; withdrawing consent reloads the page and stops recording.

3. Why we use it

Collected data is used for service delivery, account security, billing, customer support, and product improvement.

• Service operations, including authentication and session management
• Billing and payment processing
• Support and follow-up
• Security monitoring and abuse prevention
• Product improvement

4. Processors and subprocessors

We share the minimum data needed with the following processors to operate the service.

• Microsoft Clarity: optional dashboard usage analytics and masked session recordings. Microsoft processes this data under its privacy statement: https://privacy.microsoft.com/privacystatement
• Hostinger: service hosting and video processing
• Neon: storage of account and service usage information
• Cloudflare: file storage and delivery needed to provide the service
• Cloudflare Workers AI: processing of audio information when the customer enables automatic captions
• OpenAI: processing of subtitle text only when the customer requests a subtitle translation (United States)
• Resend: transactional email, including sign-in codes, billing, and account notifications
• Google: account authentication when a customer chooses Google sign-in
• Sentry: service error analysis, excluding unnecessary personal and sensitive information.
• Creem: hosted checkout, subscriptions, receipts, and payment management. NULX receives payment status and customer/subscription identifiers, not card numbers.
• PayPal: hosted checkout, subscriptions, receipts, and payment management. NULX receives payment status and customer/subscription identifiers, not card numbers.

5. International processing and hosting

NULX is a global service operated from the Republic of Korea. We transfer data only when needed to provide a feature, secure the service, or meet a legal obligation. Transfers occur over encrypted connections when you sign in, send or receive service email, upload or process media, enable an optional feature, or when an operational error is reported.

• Malaysia: the current location for service hosting and video processing. Hosting services are contracted through Hostinger International Ltd.
• Neon: account and service usage information is processed in the contracted storage region and, where necessary, the support and subprocessor locations disclosed by the provider.
• United States and provider subprocessor locations: Resend handles transactional email; Sentry handles filtered error events; Cloudflare Workers AI receives audio information only when automatic captions are enabled; OpenAI receives subtitle text only when a translation is requested; Google receives authentication data only when Google sign-in is chosen.
• Customer-selected or globally distributed regions: Cloudflare and Bunny process media according to the NULX-managed or customer-selected storage and delivery configuration. Location hints are not data-residency guarantees.
• We use the provider data-processing terms and contractual safeguards available for these transfers. Processors may retain data only for the service purpose and their configured or legally required retention period.
• You can avoid optional caption, Google sign-in, or customer-selected provider transfers by not enabling those features. Core hosting, database, security, and transactional-email processing is necessary to operate an account; if you do not agree to that processing, do not create an account or request account deletion.

6. Retention

Account and video metadata is retained while the account operates; a verified deletion request is completed within 30 days. Default operating windows are 30 days for request activity, 30 days for webhook deliveries, 180 days for raw playback events, 365 days for security and billing audit events, and 90 days for integrity and processing evidence. Sessions expire after 14 days of inactivity or 90 days total. Backups are kept for 14 days by default and may contain deleted data during that window. Video in a free account without connected storage is moved to Trash after 90 inactive days and seven days' notice, then permanently deleted after another 30 days. General inquiry records may be retained for up to three years after the inquiry closes for support and dispute history. Billing, contract, refund, and dispute records are retained for the period required by applicable law.

7. Your rights

You can request access, correction, deletion, restriction or suspension of processing, and withdrawal of consent through /contact or contact@nulx.dev. Requests through an authorized representative are accepted as required by applicable law. After verification, we provide the result; if a legal retention duty applies, we explain its basis and duration.

8. Deletion procedure

Canceling an account stops new uploads and write actions but does not automatically delete data. After a separate deletion request and owner verification, we offer an export opportunity and delete account information and NULX-managed files within 30 days. Customer-owned storage is deleted by the customer or by NULX where the connection and permissions allow it; NULX does not delete files in external storage without deletion permission. Finalized billing records and backups may remain only for their legal or backup retention period.

9. Processing basis and paid service

Depending on the law that applies, we process data to perform a contract or take requested pre-contract steps, meet legal obligations, protect the legitimate interests of operating and securing the service, or act on consent. You may object where processing relies on legitimate interests. Information needed for free signup and inquiries is processed to provide the service or follow-up you request. Paid plans use a card subscription or an agreed invoice arrangement, with price and payment conditions shown before payment. We obtain separate consent where applicable law requires it, and we do not sell personal data or share it for cross-context behavioral advertising.

10. Operator and privacy contact

Control Beat Co., Ltd. is the operator of NULX and the controller responsible for the personal data described in this policy. Submit privacy questions, complaints, and rights requests through /contact or contact@nulx.dev.

• Legal name: Control Beat Co., Ltd. (주식회사 컨트롤비트)
• Representative and privacy lead: Geunhyeong Kim
• Registered office: 3F, Room J221, 408-1 Bongcheon-ro, Gwanak-gu, Seoul, Republic of Korea
• Business registration number: 526-88-03467
• Mail-order sales registration: 2025-서울관악-0809, filed with Gwanak-gu Office
• Privacy contact: contact@nulx.dev

11. Children, policy changes, and complaints

NULX is a business service and is not directed to children under 16. We do not knowingly create accounts for them; contact us if you believe a child submitted personal data. Material policy changes are announced on the service or by registered email before they take effect where required. You may also complain to the privacy or consumer-protection authority available under the law of your country.