Privacy Policy | Nicholson Solutions

1. Scope and privacy roles

This Privacy Policy applies to personal information Nicholson Solutions controls through its website, sales and ordering processes, customer administration, support, and operation of its software services. It does not replace a customer organization’s own privacy notices or policies for the people whose information that customer enters into Nicholson Solutions products.

When a business customer uses Nicholson Solutions software to manage its own members, visitors, guards, employees, sites, or operations, that customer generally determines the purposes and means of collecting and using the underlying operational information. Nicholson Solutions generally processes that information on the customer’s behalf to provide the contracted software and related services.

For information Nicholson Solutions collects directly for its own business purposes—such as sales contacts, order records, billing records, security records, and support communications—Nicholson Solutions determines the purposes of that processing.

2. Information we collect

Depending on how you interact with Nicholson Solutions, we may collect:

Business and contact information: company name, contact name, business email, phone number, role, site or location information, and related account details.
Order and billing information: selected product, plan, quantity, order reference, subscription or invoice status, payment status, transaction identifiers, accepted legal-document versions, acceptance timestamps, and billing-related records. Payment-card details entered into Stripe-hosted checkout are processed by Stripe and are not entered into the Nicholson Solutions website order form.
Account and access information: user identifiers, roles, memberships, account status, login and recovery events, device or kiosk authorization information, and security-related records.
Operational data supplied by customers: depending on the product, this can include member, visitor, guard, employee, site, attendance, check-in/check-out, incident, activity, vehicle, photo, contact, and related operational records.
Communications and support information: messages, support requests, onboarding details, configuration questions, and records needed to resolve issues.
Technical information: ordinary hosting, security, diagnostic, and access information such as IP address, browser or device characteristics, timestamps, request logs, error information, and similar technical records generated by the systems used to deliver and protect the services.

3. How we use information

We use personal information as reasonably necessary to:

provide, configure, operate, maintain, and support Nicholson Solutions products;
process orders, subscriptions, invoices, payments, activation, setup, cancellation, and renewal;
authenticate users, authorize access, protect accounts, investigate suspicious activity, and maintain security;
send service communications, account notices, order confirmations, support messages, and operational notifications requested by customers;
troubleshoot, diagnose, repair, and improve reliability, security, and usability;
maintain business, tax, payment, security, audit, legal-acceptance, and legal records;
enforce agreements, prevent misuse, and comply with lawful requests and applicable law.

Nicholson Solutions does not use identifiable Customer Data for unrelated product development, advertising, or marketing without customer authorization. Nicholson Solutions may use de-identified or aggregated information that does not reasonably identify a customer or individual to understand service performance, security, reliability, and usage patterns.

4. Customer-controlled operational data and customer responsibilities

Customers are responsible for deciding what lawful operational information they enter into Nicholson Solutions products and for providing notices or obtaining consents required for their use case. Nicholson Solutions does not determine a customer’s employment, visitor, membership, security, surveillance, disciplinary, or access-control policies.

For employee, visitor, security, and gym-member records, customers remain responsible for lawful collection, employment notices, surveillance or monitoring disclosures, access decisions, parental or guardian permissions where required, and other consents or policies applicable to their operations.

Customers should avoid entering information that is not necessary for the operational purpose of the selected product. Unless Nicholson Solutions expressly agrees otherwise in writing, customers should not use the services to store Social Security numbers, complete payment-card numbers, unrelated account passwords, or highly sensitive regulated information that the product was not designed to handle.

5. Payment processing

Nicholson Solutions uses Stripe for payment and subscription processing. When a customer uses Stripe-hosted checkout, payment-card and payment-method information is provided directly to Stripe. Nicholson Solutions may receive transaction and subscription information from Stripe, such as payment status, customer or subscription identifiers, amount, billing period, and other records needed to reconcile the order and provide service.

Stripe’s handling of information is also governed by Stripe’s own terms and privacy practices.

6. Service providers and subprocessors

We use service providers to operate Nicholson Solutions. Depending on the service and feature, these may include:

Supabase for database, authentication, storage, and server-side application services;
Vercel for website and application hosting and delivery;
Microsoft for business email and service communications;
Stripe for payments, billing, subscriptions, and related transaction services;
other infrastructure, communications, security, or support providers when needed for an enabled feature.

These providers may process information only as permitted by their agreements and applicable law. Nicholson Solutions does not authorize service providers to use Customer Data for their own unrelated purposes. Nicholson Solutions maintains a documented subprocessor list for material providers used to process customer information. Where a Data Processing Addendum applies, subprocessor use is governed by that addendum.

7. When we disclose information

We may disclose information:

to service providers that help us operate the services;
to authorized administrators or users of the applicable customer account;
when a customer directs or authorizes the disclosure;
to comply with law, legal process, court order, or lawful government request;
when reasonably necessary to protect Nicholson Solutions, customers, users, systems, or others from fraud, abuse, security threats, or unlawful activity;
in connection with a merger, financing, acquisition, reorganization, sale of assets, or similar business transaction, subject to appropriate protections.

8. Sale of personal information and advertising

Nicholson Solutions does not sell personal information for money. Based on the current Nicholson Solutions website implementation, Nicholson Solutions does not operate third-party behavioral advertising pixels or a cross-context behavioral advertising program on the public website.

If these practices materially change, this Privacy Policy will be updated and any notice or choice required by applicable law will be provided.

9. Cookies and similar technology

The public website and hosted applications may use technical storage, cookies, local storage, session storage, or similar browser features when necessary for functions such as authentication, security, kiosk/device authorization, preferences, session continuity, offline operation, or application performance.

Hosting and infrastructure providers may also create ordinary request, security, and diagnostic logs needed to operate and protect their services.

10. Data retention, export, deletion, and backups

Nicholson Solutions retains information only for as long as reasonably necessary for the purpose for which it was collected, to provide active services, maintain legitimate business and security records, resolve disputes, enforce agreements, and comply with legal, tax, accounting, or regulatory obligations.

Unless an Order states otherwise, after a paid customer service term ends the customer has thirty (30) days to request a reasonable final export of Customer Data that remains reasonably available to Nicholson Solutions. After that retrieval period, Nicholson Solutions may begin deletion from active production systems and intends to complete deletion from systems under its direct administrative control within sixty (60) days, subject to legal holds, fraud prevention, security needs, technical constraints, and service-provider limitations.

Residual copies may remain in encrypted backups until those backups are overwritten or deleted through ordinary backup cycles. Backup copies are not maintained for ordinary customer access and generally are restored only for disaster recovery or security purposes.

Billing, tax, legal-acceptance, security, fraud-prevention, audit, and similar business records may be retained for longer periods when reasonably necessary or legally required. Nicholson Solutions may retain de-identified information that does not reasonably identify a customer or individual.

11. Security

Nicholson Solutions uses reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, misuse, alteration, loss, or disclosure. Measures may include account controls, role-based access, customer separation, authentication, restricted administrative access, encrypted communications, provider security features, monitoring, logging, and recovery procedures appropriate to the service.

No method of transmission or storage is completely secure. Nicholson Solutions cannot guarantee that a security incident will never occur. If Nicholson Solutions becomes aware of a breach requiring notice under applicable law, Nicholson Solutions will take steps consistent with its legal obligations and incident-response process.

12. Children and minors

The Nicholson Solutions public website and ordering process are intended for business users, not children. Nicholson Solutions does not knowingly offer direct account registration to children under 13 through the standard products.

Some customer organizations, such as gyms, may lawfully maintain ordinary business records about minors as part of their operations. In those cases, the customer is responsible for determining and obtaining parental, guardian, contractual, or legal authorization required for the customer’s collection and use of that information.

Customers must not enable or direct children under 13 to create Nicholson Solutions accounts or directly submit personal information through a child-directed Nicholson Solutions experience unless the applicable product has been specifically designed and legally reviewed for that purpose.

13. Biometric information and ordinary photographs

Nicholson Solutions products may support ordinary photographs for identification or operational records. Ordinary photographs are not treated by Nicholson Solutions as biometric templates or biometric identifiers merely because they are stored as images.

Nicholson Solutions does not offer biometric enrollment, facial-recognition templates, face-geometry analysis, fingerprint recognition, voiceprint identification, or similar biometric-identification functionality as part of the standard products described by this Policy. Customers must not repurpose photographs or other records through Nicholson Solutions services for biometric identification unless Nicholson Solutions has separately approved the feature in writing and the parties have implemented required legal safeguards, including applicable notice, consent, retention, deletion, and security requirements.

14. Access, correction, export, and deletion requests

Customers can correct many records through their own administrative tools. A customer may also contact Nicholson Solutions for reasonable assistance with account access, correction, export, or deletion where the request concerns information Nicholson Solutions controls.

When Nicholson Solutions processes information on behalf of a customer organization, an individual request may need to be directed to that customer because the customer controls the underlying business record. Nicholson Solutions may assist the customer as appropriate.

15. Legal rights

Privacy rights vary depending on the person’s location, the type of information, and Nicholson Solutions’ role in processing it. Where applicable law provides a right to access, correct, delete, restrict, or otherwise exercise control over personal information, Nicholson Solutions will respond as required after reasonably verifying the request.

Nothing in this Policy limits rights that cannot lawfully be limited.

16. Data location and transfers

Nicholson Solutions and its service providers operate primarily through U.S.-based business and cloud infrastructure. Information may be processed in locations where Nicholson Solutions or its service providers maintain systems or personnel, subject to applicable contractual and legal protections.

17. Security incidents and breach response

Nicholson Solutions maintains procedures for investigating suspected security incidents, limiting harm, restoring affected services, preserving relevant records, and providing notices when required by applicable law or contract. Customers agree to promptly report suspected unauthorized access to their Nicholson Solutions accounts.

18. Security incidents and breach response

If Nicholson Solutions confirms a Security Incident affecting Customer Data, Nicholson Solutions will notify the affected business customer without undue delay and, unless legally prohibited or a longer period is reasonably necessary to avoid materially impairing an active investigation, within five (5) business days after confirmation. The notice will include information reasonably available to Nicholson Solutions that can assist the customer in evaluating its own notification obligations.

Customers agree to promptly report suspected unauthorized access to their Nicholson Solutions accounts and to cooperate reasonably with incident response.

19. Changes to this Policy

We may update this Privacy Policy as our products, providers, legal obligations, or data practices change. The current version and date will be posted on this page. Material changes will be communicated in a reasonable manner when appropriate. A customer’s accepted Privacy Policy version may be retained with its order records.