Privacy
policy.
Provisional document under review. This version does not establish full legal compliance.
1. Controller and outstanding information
The data controller is Sofylei LLC, trading as Nexomiza. Mailing address: 8206 Louisiana Blvd NE, Ste A #2262, Albuquerque, New Mexico 87113, United States. For privacy enquiries and rights requests: contact form. Providers’ contractual terms, processing locations and safeguards still need to be verified.
2. Data requested
The form requests your name, email address, area of interest and project description. Phone number and business or project name are optional. The data comes from what you send us. Required fields are needed to handle your enquiry. Do not send identity documents, passwords, bank details or especially sensitive information in this initial contact.
3. Purposes and legal bases
When you request a proposal to engage our services personally, we use the data needed to reply and prepare it on the basis of pre-contractual measures requested by you (GDPR Article 6(1)(b)). When you contact us for a business or make a general professional enquiry, the intended basis is our legitimate interest in handling that communication (Article 6(1)(f)). Technical data is used to protect the form and limit automated submissions, also on the basis of our legitimate interest in security. Rights requests are handled to meet data-protection obligations (Article 6(1)(c)).
The form does not add you to a marketing list or subscribe you to advertising. Reading this policy informs you about processing; it does not constitute general consent to any use of your data.
4. How an enquiry is handled
The server checks your chosen puzzle or text alternative. When you select Send enquiry, it requires that verification, applies security limits and forwards the enquiry to Nexomiza's corporate inbox through Arsys's email service. The delivery service is used upon submission; Nexomiza has not added third-party chat, advertising tools or visitor analytics to this website.
Sending and receiving the enquiry involves data processing by Arsys as Nexomiza's email service provider. Hosting services may process technical connection data to provide and protect the service.
5. Providers and international transfers
The form uses Arsys to send enquiries to Nexomiza's corporate inbox. The VPS hosting provider has yet to be identified; this information will be updated with the final provider before publication. The mailbox provider's contractual identity and terms, processing agreements, processing locations, subprocessors and safeguards for any international transfers still need to be confirmed. We do not claim that all data remains in the European Union.
6. Retention
The intended approach is to retain correspondence as long as needed to handle the enquiry and related matters, then delete it when no longer necessary, subject to retention or restricted storage for legal obligations or potential liabilities. The operational policy and providers' retention periods must be settled before this information is finalised.
7. Your rights
Where provided by law, you may request access, rectification, erasure, restriction, objection and portability, and withdraw consent where processing is based on it, without affecting prior lawfulness. You can use the contact form. You can also write to the controller’s mailing address without using the puzzle. Additional identity information will only be requested where necessary and proportionate. The ordinary response period is one month; if an extension is justified by complexity or the number of requests, you will be informed within that first month.
You may also lodge a complaint with the Spanish Data Protection Agency.
8. Technical data and spam protection
The server receives connection data, including your IP address. To link challenges to the browser and limit attempts, the verification database stores random identifiers, cryptographic values derived from the connection, timestamps and counters. It does not store the plain IP address or enquiry content. These pseudonymised values are not anonymous data.
The technical verification cookie expires ten minutes after each challenge is issued; a new challenge renews this period. Challenges expire after three minutes. A verified challenge is deleted when used to attempt submission. In the VPS version, expired challenges and counters are deleted when a new challenge is issued and every five minutes while the server is running. They are also cleaned up at startup. Technical backups, if enabled, are rotated within a maximum of seven days.
Verification and rate limits may temporarily block an attempted submission. They reduce automated submissions but do not guarantee their complete elimination.
Global limits allow 30 sending attempts per hour and 100 per 24 hours, with at most two email submissions processed simultaneously. These limits use random identifiers and attempt timestamps, without the enquiry content or contact details. Records are no longer needed once they fall outside the 24-hour window and are deleted when a submission is attempted and during periodic cleanup, every five minutes while the server is running.
9. Automated decisions and changes
This form does not make automated decisions with legal effects on you or build marketing profiles. The policy will be updated when processing changes or outstanding details are completed.
Last reviewed: 14 October 2026.
