Privacy Notice

Nexorio s. r. o. · version 1.5 · 9 October 2026

1. Controller and contact

The controller for the website and information used to deliver products under the Denis Bubeník brand is Nexorio s. r. o., Slovak company ID (IČO) 55 918 263, Palánok 1, 949 01 Nitra, Slovakia. For data protection matters, contact denis@nexorio.io. Telephone: +421 914 131 415. You can also reply to a contract-confirmation message at denis@nexorio.io.

Whop operates its own platform, accounts and purchase processing. This notice explains Nexorio's processing. Whop explains processing for its own services at https://whop.com/privacy/.

2. Information, purposes and legal bases

• Enquiries and proposed work: name, email, company, request description and message contents, to respond and assess proposed work. The basis is pre-contractual steps requested by an individual under Article 6(1)(b) GDPR; for a company representative or general business correspondence, legitimate interests in handling that correspondence under Article 6(1)(f).
• Purchases, memberships and delivery: Whop account and membership identifiers, purchase reference, product, topic/tier, plan, entitlement status, currency, initial amount paid and contact email reported by Whop. We use them to identify the purchase, deliver confirmation, provide content and support. The basis is contract performance under point (b); for a business representative, legitimate interests in administering the business purchase under point (f) also apply. A membership-creation date is not automatically evidence of the contract date.
• Terms and delivery choice: your declaration of consumer or business purchase, acceptance of specific terms, the information shown, your acknowledgement and express early-delivery choice, time, language, document version and connection to the membership/purchase. We retain the immutable contract confirmation and receipt acknowledgement. The bases are legal obligation under point (c), contract performance under point (b) and protection of specific claims under point (f). Early-delivery choice is not marketing consent or consent under the GDPR.
• Withdrawal, refunds and defects: name, email, contract identification, notice contents, time, necessary evidence and handling outcome. The bases are legal obligations under point (c), the commercial refund policy under point (b), and protecting claims under point (f).
• Accounting: identity, billing and transaction information needed for records and legal obligations under point (c). The website's contract confirmation is not a tax invoice or proof of a bank payout.
• Security and operation: IP address, request time and URL, browser information, authentication-session information and technical errors, to protect the website and paid content; legitimate interests under point (f).
• Optional analytics: information about visits to public pages as described in section 5; your consent under point (a).

The website does not receive your Whop password or full card details. Without necessary information we may not be able to identify and handle a purchase or notice. We do not request an identity document or unnecessary information for an ordinary question.

3. Contact, withdrawal and local working tools

The contact form prepares a message in your email application. It does not itself submit the fields to the website server; you send the message after reviewing it. We process correspondence once received.

When using the online function at https://bubenikdenis.com/en/withdrawal or https://bubenikdenis.com/odstupenie, you submit your name, email and contract identification after reviewing and confirming them. The server records the notice, reference, UTC time, language and confirmation version for receipt and handling. Confirmation includes the specific notice and time; you can save it as TXT and it is also sent by email. Receipt of the notice is not completion of a financial refund. You can also send a notice to denis@nexorio.io or by post to Nexorio; the online function requires neither a reason nor sign-in.

Diagnostic answers, calculations, notes and working records stay locally in your browser. Tools do not automatically send them to Nexorio or Whop or attach them to your membership. Sign-in does not synchronise them between devices. An export is a file on your device. If you choose to send it to us, we process the contents as part of your request.

Local records remain until cleared in the tool or browser; the browser may also clear them. Remove them after working on a shared device. Do not send passwords, tokens, patient health information or unnecessary client personal information; an anonymised description is enough for an initial assessment.

4. Sign-in, confirmation and entitlement checks

Sign-in uses the Whop account identifier and basic profile, with openid profile authorisation and no email sign-in scope. Separate server-side verification of a purchased membership provides the contact email needed for contract confirmation. It does not provide access to your email inbox.

Before delivery, we record your specific choice and prepare an immutable confirmation with the reference, product, terms and your declaration. You save the TXT and acknowledge receipt. Where email delivery is enabled, it is also sent by email. Acceptance by an email provider alone does not establish delivery to your inbox. The confirmation or saving it does not create a new payment.

For delayed delivery, an authorised person may need information from the original receipt to verify the actual contract date, delivery date and end of online access. They use only necessary evidence and may provide a separate immutable supplemental confirmation. Full card details are not requested. Asking for this review is not a new purchase or marketing consent.

The server automatically checks the purchased topic/tier, customer entitlement and required confirmation record. This is a technical delivery/access check, not a personal or financial assessment. If it does not match the purchase, request human review. Diagnostic recommendations are indicative and do not create an order.

5. Cookies and optional analytics

Necessary cookies protect sign-in and the session. The authorisation window is at most 10 minutes and the session at most 8 hours; either can end earlier after sign-out or loss of entitlement. This is separate from the purchased 731-day online access period. The withdrawal server uses pseudonymous security counters derived by HMAC from the email and hosting-confirmed IP. Counters do not contain those plaintext values; the notice itself contains contact information. Blocking necessary cookies may prevent sign-in. Working tools use local storage for your work.

Google Analytics 4 loads only after analytics consent. We measure visits to public pages, language, general traffic source and restricted campaign labels. We do not send form contents, diagnostic answers or notes, authentication information, withdrawal notices, contract confirmations or private-library activity. Page addresses are sent without query parameters or fragments; campaign labels must not contain personal information. We do not use advertising pixels or Google Analytics advertising features.

Without consent, the Google script does not load. After consent, _ga and _ga_* cookies distinguish browser visits for no more than 180 days; we save the analytics choice locally for 6 months. You can change consent at any time using “Cookie settings” in the footer. Declining does not restrict the website, diagnostic or purchased content; withdrawal stops analytics and clears its cookies. GA4 is configured to retain individual user and event information for 2 months, without resetting after further activity; standard aggregated reports may remain longer. GA4 does not store IP addresses of EU, Swiss and UK users within the scope described by Google.

Analytics is provided by Google Ireland Limited. Information: https://policies.google.com/privacy?hl=en and https://support.google.com/analytics/answer/12017362?hl=en. External sites, such as Whop and LinkedIn, have their own rules and cookies.

6. Recipients and transfers

Authorised Nexorio personnel and providers use information only as needed. Vercel hosts the website. The primary contact address denis@nexorio.io is a Google Workspace mailbox. Previous contact addresses may still use existing Namecheap forwarding; that is not a description of delivery to the denis@nexorio.io mailbox. Whop provides accounts, purchases, payment processing and membership-verification information. Accountants, professional advisers or authorities may receive information where necessary for legal obligations or protecting claims.

Contract/delivery evidence and withdrawal records are stored in separate private schemas within the existing Nexorio Supabase project, in EU-West Ireland. This is not a public database or a combination of the records with other products in that project. Access is restricted through server authentication and permissions. The sending queue contains the necessary recipient, immutable confirmation text and attempt status, so that failed sending can be retried without creating different contract terms.

When a confirmation is sent by email, the existing Nexorio Resend workspace using mail.nexorio.io processes the recipient email, contents, attachment and delivery metadata. It has an Ireland sending region; this does not mean data is stored exclusively in the EU. Resend's terms describe email information also being processed in the United States. Details: https://resend.com/security/gdpr and https://resend.com/legal/dpa.

Provider roles depend on the service; a provider may also act as an independent controller. Services may process information outside the EEA, including in the United States. Transfers are subject to an applicable adequacy decision or contractual safeguards for the particular service. An Irish database or sending region does not establish that all associated information stays exclusively in the EU. You may request information about safeguards at our contact address.

7. Retention

We retain correspondence while handling a request and afterwards only as needed for related work, legal obligations or specific claims. Accounting documents follow applicable statutory periods. Evidence of the contract, notice, delivery choice, confirmation receipt, withdrawal, refund and defect is kept during handling and afterwards only for a legal obligation or protecting a claim. Criteria include the record's nature, relationship duration, applicable legal period and any dispute.

When the purpose ends, an authorised person reviews the closed case and arranges removal of unnecessary active records; an open dispute can justify postponement. Immutable evidence is not a reason for unlimited retention. Delivery copies, queues, metadata, technical logs, security counters, mailboxes and backups are assessed separately according to their purposes and actual settings. A single retention period is not inferred from the 14-day refund window or 731-day access period. Erasing an active record does not instantly erase backups or delivered email; ending online access does not erase mandatory accounting records or the Whop account.

8. Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and portability. You may object to legitimate-interest processing. You can withdraw consent without affecting earlier lawfulness. Marketing or analytics consent is not a condition of purchasing.

Contact denis@nexorio.io. We may proportionately verify that the request concerns your information. We normally respond within one month; any lawful extension and reason will be communicated. You may complain to the competent supervisory authority, including the Office for Personal Data Protection of the Slovak Republic: https://www.dataprotection.gov.sk/.

English peer community

Joining the optional free Whop community is separate from buying a toolkit or consenting to marketing. Whop provides the community account, discussion and notification facilities under its own privacy and account rules. Nexorio moderators can see the profile and posts made available to them through the chosen community settings. Other participants may see shared posts and profile details according to the actual discussion visibility; do not treat the forum as confidential client support.

Participation is optional. Do not post customer or patient records, credentials, payment details or other private information. Use anonymised workflow examples. Purchase references and access/refund issues belong in the private support channel at denis@nexorio.io. We use moderation information to operate the space, address conduct reports and protect participants; we do not automatically add community members to an email campaign or contact imported lead lists. Notification choices are controlled by the available Whop settings. Community records and provider copies have their own purpose and retention review; closing an account does not promise immediate removal of every backup or previously shared copy. Contact us about privacy requests or moderation information; mandatory rights remain available.

New public website measurements may include the selected toolkit identifier, diagnostic completion without answers and an outbound checkout click after analytics opt-in. A click is not recorded as a purchase. Private purchase/receipt references, diagnostic answers and community posts are not sent to GA4.