This Data Handling Policy describes how PCI-Nexus collects, stores, processes, and protects data in connection with the Service. This policy supplements our Privacy Policy and applies to all data processed through the platform, including data belonging to your client organizations.
PCI-Nexus collects and processes the following categories of data:
We do not intentionally collect or store actual payment card numbers, PINs, cardholder data, or other sensitive authentication data. You should not upload files containing live cardholder data to the platform.
All data stored in PCI-Nexus is protected with the following controls:
PCI-Nexus uses Claude AI (operated by Anthropic) to analyze evidence files uploaded to the platform. When you upload an evidence file, the content of that file is sent to Anthropic’s API for analysis against applicable PCI DSS requirements.
Key facts about our AI processing:
We retain your data for as long as your account is active plus a 90-day post-cancellation period. During the 90-day retention window after cancellation, your data remains available for export. After 90 days, all data associated with your account and client organizations is permanently and irreversibly deleted from our systems and backups.
Audit logs are retained for a minimum of 12 months to support PCI DSS Requirement 10 compliance for organizations using the platform for their own compliance program.
You may request deletion of specific data records or your entire account at any time by contacting us at jeatonit@outlook.com. We will process verified deletion requests within 30 days. We will confirm completion of deletion in writing.
Note that deletion of certain records may affect the integrity of your compliance audit trail. We will advise you of any such implications before processing the deletion request.
PCI-Nexus uses the following third-party subprocessors to deliver the Service:
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic (Claude AI) | AI evidence review and compliance chat | Evidence file contents, compliance queries | United States |
| Vercel | Web application hosting and delivery | Web traffic, session data | United States / Global CDN |
| Supabase | Database and authentication infrastructure | All platform data, user credentials | United States |
| Google Analytics | Marketing site analytics (with consent) | Anonymized page view and session data | United States |
We will update this list when we add new subprocessors and will notify subscribers of material changes to our subprocessor arrangements.
In the event of a security incident that results in unauthorized access to, disclosure of, or destruction of your data, we will notify you as required by applicable law. For incidents that meet the threshold for notification under CCPA, GDPR, or other applicable regulations, we will provide notification within the timeframe required by the applicable regulation, and in no event later than 72 hours after we become aware of the incident.
For questions about this Data Handling Policy or to make a data-related request, contact us at:
PCI-Nexus
Operated by Joe Eaton
1350 Hemlock St., Napa, CA 94559
jeatonit@outlook.com