Privacy Policy

Last updated October 22, 2026

This Privacy Policy explains how Nexju (“Nexju”, “we”, “us”) collects, uses, shares, and protects information when you use our website and ancestry-modeling service at nexju.com (the “Service”). It also describes the choices and rights you have over your information, including any DNA data you upload.

1. Information we collect

• Account information. When you sign in with Google, we receive your name, email address, and profile identifier from your Google account. We use it to create and identify your account.
• DNA data you upload. If you upload raw autosomal data files (for example from a consumer genetic testing service), we process those files to convert them into analysis formats and to run the analyses you request. See “Your DNA data” below.
• Analysis inputs and results. The populations, models, and parameters you select, and the scientific results returned for your runs, are stored in your run history so you can reproduce and revisit them.
• Usage and billing data. Records of the metered analyses you launch, your plan or credits, and payment-related metadata processed by our payment provider.
• Technical data. Standard server logs, including IP address, browser type, and request timestamps, used for security and reliability. Your browser also reports how long each page took to load and respond; we keep these timings only as anonymous counts by page, broad region, and phone or desktop, with no cookie or identifier.
• Cookies. We use a session cookie to keep you signed in and small preference cookies to remember interface settings such as sidebar state and your analytics choice. Analytics cookies are set only if you allow them, as described below. We do not use advertising or cross-site tracking cookies.

2. Your DNA data

Genetic data, and the ancestry results derived from it, are special categories of personal data under Article 9 GDPR, and we treat them accordingly:

• We process a DNA file only with your explicit consent, which you give for each file by ticking the consent box when you upload it. We record when you consented and to which wording.
• Raw DNA files reach us only through your signed-in upload page or a single-use upload link, and are stored solely to convert and run the analyses you request.
• We do not sell your DNA data, share it with advertisers or data brokers, or use it to train machine-learning models.
• We do not add your DNA data to shared research datasets. Your uploads remain associated with your account and are visible only to you (and to Nexju personnel who need access to operate and support the Service).
• You can withdraw consent at any time by deleting the file. We then stop processing it and delete the raw file and its converted genotypes. Results you already ran stay in your run history until you delete them or your account. Withdrawal does not affect processing that took place before it.

3. How we use information

We use the information we collect to:

• operate, provide, and maintain the Service, including running the analyses you request;
• create and administer your account and authenticate you;
• meter usage, process payments, and prevent abuse;
• provide customer support and respond to your requests;
• send you service emails, such as receipts and notices about your account, and the Nexju newsletter unless you unsubscribe;
• maintain the security and integrity of the Service, including protecting against unauthorized access and misuse;
• if you allow analytics, understand how the Service is used, such as which features are used and where sign-up and checkout fail, so we can improve it; and
• comply with legal obligations and enforce our Terms of Service.

4. Legal bases

Where the GDPR or similar laws apply, we process your information on the following legal bases: performance of our contract with you (operating the Service and running your analyses); legitimate interests (security, abuse prevention, service improvement, and sending account holders the newsletter about the Service); and compliance with legal obligations. We use analytics cookies only on the basis of your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

We process genetic data, and ancestry results derived from it, only on the basis of your explicit consent under Article 9(2)(a) GDPR. Uploading DNA is optional, and consent is never a condition of using the rest of the Service.

5. How we share information

We do not sell your personal information or your DNA data. We share information only with:

• Service providers that help us operate the Service, such as Google (authentication and, if you allow it, Google Analytics), our payment processor for billing, Amazon Web Services to deliver email, and hosting and infrastructure providers. These providers process data on our behalf and are contractually restricted from using it for other purposes.
• Authorities, where we are legally required to disclose information, or to protect the rights, property, or safety of Nexju, our users, or the public.
• A successor entity, in the event of a merger, acquisition, or asset sale, in which case this Privacy Policy will continue to apply to your information.

6. Data retention

We keep your account information, uploaded DNA data, and run history for as long as your account is active so the Service works as expected. If you delete an upload, we delete the associated genetic data. If you request deletion of your account, we deactivate it at once and, 30 days later, delete or anonymize your personal information and DNA data, except where we must retain limited records for legal, billing, or security purposes. If you sign in again within those 30 days, the deletion is cancelled and your account stays as it was.

7. Security

We protect the Service with measures including encrypted connections (TLS), access controls, audit logging, and single-use upload links for DNA files. Raw DNA content is never included in logs. No method of storage or transmission is completely secure, and we cannot guarantee absolute security, but we take incidents seriously and will notify affected users where required by law.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise the two you will use most without contacting us: in the Service under “Data & privacy” you can download a copy of your data (account, uploads metadata, model configurations, run results, workflows, custom datasets, and usage history) and delete your account and stored DNA files, which we do 30 days after your request unless you sign in again before then. For anything else, contact us using the details below. You can also delete uploaded DNA files directly from the Service at any time. To stop the newsletter, untick it on your Email preferences page or use the Unsubscribe link in any newsletter.

9. International transfers

We and our service providers may process information in countries other than your own. Where required, we use appropriate safeguards for such transfers, such as standard contractual clauses.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy as the Service evolves. When we make material changes, we will update the “last updated” date and, where appropriate, notify you through the Service. Continued use of the Service after an update means you accept the revised policy.

12. Contact

Questions about this Privacy Policy or about how your data is handled? Contact us at [email protected].