Nexkey Privacy Policy
Effective Date: October 20, 2026
1. Introduction
Infinity Software Services LLC, doing business as Nexkey ("Nexkey," "we," "us," or "our"), is committed to protecting the privacy and security of personal information.
This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information through our website, mobile applications, web management portal, connected access control products, and related services (collectively, the "Services").
Nexkey provides electronic access control solutions that allow organizations to manage physical access to their facilities and maintain historical records of access activity.
Our Services are currently offered to customers in the United States.
2. Information We Collect
2.1 Account and Contact Information
We collect information necessary to create and manage user accounts, provide access credentials, and communicate with users.
This information may include:
First and last name
Email address
Telephone number
Company or organization information
Account authentication information
Information submitted through customer support requests or other communications
Account information may be provided directly by individuals or by organizational administrators authorized to create and manage accounts.
2.2 Access Control Information
Nexkey collects and maintains information necessary to operate its access control platform and provide security auditing capabilities.
This information may include:
User identity
Lock or access point identification
Physical location associated with a lock
Date and time of access activity
Credential issuance, sharing, and revocation
Changes to access permissions and schedules
Administrative actions
Access control event history
Bluetooth device identifiers
Lock battery status and firmware information
Connection and unlock activity
Failed authorization attempts
Access records are maintained to support organizational security, accountability, investigations, and historical auditing.
2.3 Bluetooth and Location Information
Nexkey's mobile applications use Bluetooth technology to communicate with compatible locks and determine when a device is within communication range.
Nexkey does not collect or store GPS coordinates from users' mobile devices.
We may maintain information about the physical locations of installed locks and access points. This information may be associated with access events.
Certain third-party analytics services may derive approximate geographic information from IP addresses.
2.4 Device and Application Information
We collect technical information necessary to operate, maintain, troubleshoot, and secure our Services.
Depending on the device and platform, this information may include:
Device type, model, and operating system
Application version
Language and time zone
Screen size
Push-notification device tokens
Device name and IP address associated with sign-in
Bluetooth signal strength
Lock firmware and battery information
Unlock attempts, results, and duration
Application errors and performance information
API requests and server activity
This information is used for authentication, service delivery, security monitoring, troubleshooting, and operational analysis.
2.5 Mobile Application Analytics
Nexkey uses Mixpanel analytics in its Android application to collect certain application events, including Bluetooth unlocks, remote unlocks, proximity unlocks, and events associated with requests for application reviews.
Depending on the event, information may include lock identifiers, firmware versions, Bluetooth signal strength, unlock duration, and related performance information.
Mixpanel also receives technical device information, including device model, operating system version, application version, screen size, mobile carrier, and an automatically assigned device identifier.
Mixpanel may derive approximate geographic information from IP addresses.
Nexkey does not intentionally transmit user names, email addresses, or Nexkey account identifiers through these analytics events.
Mixpanel analytics collection is not currently enabled in the iOS application.
2.6 Optional Bug Reporting
Nexkey provides an optional diagnostic feature called Enable Bug Reports in its mobile applications.
When enabled, this feature uses Bugsee to collect technical information that may include:
Screen recordings of application usage
User taps and interactions
Console logs
Network traces
Device information
Bug reporting is disabled by default and requires the user to enable it.
Users may disable this feature at any time through the application settings. Disabling the feature stops further Bugsee collection.
Information collected before the feature was disabled may remain subject to applicable retention practices.
2.7 Website and Web Portal Information
When individuals visit our website or web management portal, Nexkey and certain third-party providers may collect information through cookies, analytics services, and session-recording technologies.
This information may include:
IP addresses
Browser and device characteristics
Operating system
Pages visited
Website and portal interactions
Referral information
Cookie and device identifiers
Session activity
Approximate geographic information derived from IP addresses
These technologies help us understand website activity, troubleshoot technical issues, monitor performance, and evaluate marketing effectiveness.
2.8 Payment Information
Nexkey uses third-party payment processors to process payments for products and services.
Payment card information is collected and processed by the applicable payment provider.
Nexkey does not store payment card numbers or card security codes.
We may retain billing records, payment status, transaction information, and purchase history for business operations, accounting, customer support, and legal compliance.
2.9 Information Provided by Organizations
Organizations using Nexkey may create accounts and assign access permissions to employees, contractors, visitors, and other authorized individuals.
Organizations determine which individuals receive access to their facilities and manage those permissions through Nexkey's Services.
Nexkey processes this information to provide access control functionality and maintain associated records.
3. How We Use Personal Information
Nexkey uses personal information to:
Create, authenticate, and manage user accounts.
Issue and manage digital access credentials.
Enable authorized access to compatible locks and access points.
Maintain historical access control and audit records.
Provide customer support and troubleshoot technical issues.
Monitor and improve application and hardware performance.
Communicate account, operational, and security information.
Process payments and maintain business records.
Provide information about Nexkey products and services.
Detect, prevent, and investigate unauthorized activity or security incidents.
Comply with applicable laws and enforce agreements.
We also use website and application analytics to understand how our Services are used and to improve functionality and reliability.
4. How We Disclose Personal Information
4.1 Organizational Administrators
Authorized administrators may access information associated with individuals who have been granted access to their organization's facilities.
This may include:
User names and contact information
Access permissions
Credential status
Access event history
Administrative activity
Organizations are responsible for determining who receives access and for managing their facilities and authorized users.
4.2 Service Providers
Nexkey uses third-party providers to operate, maintain, secure, and support its Services.
These include providers of:
Cloud hosting and infrastructure
Database management
Authentication
Email and SMS communications
Push notifications
Application monitoring
Analytics and diagnostics
Technical support
Internal communications
Payment processing
Providers used by Nexkey include Amazon Web Services, MongoDB Atlas, Heroku, Mailgun, Twilio, Apple Push Notification service, Google Firebase Cloud Messaging, New Relic, Mixpanel, Bugsee, LogRocket, Hotjar, Google Analytics, Zendesk, and Slack.
These providers may process information necessary to perform their respective services.
For example, monitoring services may receive technical information and account identifiers, while support and internal communication systems may receive information relevant to customer requests or operational events.
4.3 Customer-Enabled Integrations
Nexkey supports integrations and automated workflows through services such as Zapier, IFTTT, and customer-configured webhooks.
When an organization enables an integration, information may be transmitted to the selected service as necessary to support the configured functionality.
Organizations should review the privacy practices of integrations they choose to enable.
4.4 Authorized Nexkey Personnel
Authorized Nexkey employees and personnel may access customer information when reasonably necessary to provide technical support, troubleshoot issues, maintain the Services, investigate security incidents, or perform legitimate business operations.
Access is managed through internal role-based controls.
4.5 Legal Requirements and Business Transactions
We may disclose personal information when necessary to comply with applicable law, respond to valid legal requests, investigate suspected wrongdoing, or protect the rights, property, and safety of Nexkey, its customers, and others.
Information may also be transferred in connection with a merger, acquisition, restructuring, sale of assets, or similar business transaction, subject to applicable law.
4.6 Aggregated and De-Identified Information
Nexkey may use aggregated or de-identified information for analytics, research, product improvement, and business purposes.
Where information is treated as de-identified, we take measures intended to prevent its association with an identifiable individual.
5. Data Security
Nexkey maintains technical and organizational safeguards designed to protect personal information from unauthorized access, alteration, disclosure, and destruction.
These safeguards include:
Encryption of supported external service connections using TLS 1.2 or higher
AES-256 encryption of stored database information and backups
Encryption of files stored in Amazon S3
Role-based access controls
Logical separation of customer information
Authentication through AWS Cognito
Optional multifactor authentication through SMS
Security monitoring and logging
Controls limiting authentication verification-code requests
Certificate pinning in supported mobile applications
Records of certain administrative and staff activities
Customer information is maintained in a shared database environment with logical access controls designed to restrict access according to user permissions.
Security protections vary by system and platform. Mobile applications also rely on operating-system security protections.
Although Nexkey takes measures to protect personal information, no electronic transmission or storage system can be guaranteed to be completely secure.
6. Data Retention
Nexkey retains personal information according to its operational purpose, security requirements, organizational auditing needs, and applicable legal obligations.
Certain records have defined retention periods. Other records are currently maintained without an automatic expiration date.
6.1 Account Information
When a user submits an account deletion request, Nexkey deactivates the account and removes certain information, including:
Phone number and email address from the primary account profile
Login credentials and associated AWS Cognito identity
Active sessions
Push-notification device tokens
The user's first and last name and an internal account record are retained to preserve historical access information.
Certain access-group records may retain copies of the user's name, telephone number, and email address until the group is next edited.
Support tickets associated with account deletion requests, including the requester's email address and message, are also retained.
6.2 Historical Access Records
Nexkey provides access control and security auditing services to organizations.
Historical access records are an essential part of these services because they allow organizations to review access activity, investigate security incidents, and maintain accountability for access to their facilities.
For this reason, historical access records are not automatically removed when a user requests account deletion.
These records may continue to identify the individual by name and may contain other identifying information captured when the event occurred.
Historical access records are not automatically anonymized following account deactivation.
Access records are currently retained without an automatic expiration date. Records associated with a lock may be removed when the lock is reset or factory-reset.
6.3 Database Backups
Nexkey maintains database backups in the United States through MongoDB Atlas.
Current backup retention periods are:
Daily backups: 7 days
Weekly backups: 4 weeks
Monthly backups: 12 months
Information removed from active systems may remain in backups for up to 12 months before the applicable backup expires.
6.4 Operational Records
Certain operational records have established retention periods:
InformationRetention PeriodApplication and web server logs1 monthCertain analytics service logs1–3 monthsWi-Fi hub status history21 daysTemporary lock access data21 daysInternal job and push-notification status records7 daysDatabase backupsUp to 12 months
Other information may be retained without an automatic expiration date, including:
Invitations and notifications
Certain API request logs
Support tickets
Device records
Lock usage data
Staff action logs
Certain background-service logs
Partner API logs
6.5 Information Stored on Mobile Devices
Nexkey's mobile applications may maintain locally cached information necessary for application functionality.
This information is cleared when a user logs out or uninstalls the application.
Mobile devices may also apply operating-system security protections to locally stored application information.
7. Account Deletion Requests and Historical Records
Users may initiate an account deletion request through the Nexkey mobile application or contact support@nexkey.com for assistance.
When a request is submitted through the application, a support ticket is created for processing.
Nexkey Support deactivates the account, removes active authentication credentials, terminates active sessions, and removes certain personal contact information from the primary account profile.
Because Nexkey provides physical access control and security auditing services, historical records of access activity remain available to the organization.
An individual's request to delete an account does not automatically erase records showing when that individual accessed a facility.
This retention supports organizational security, accountability, investigations, and historical auditing.
Accordingly, certain identifying information, including the individual's name and historical access activity, remains in Nexkey's systems following account deactivation.
Some historical records may also retain contact information captured before the account was deactivated.
Information removed from active systems may remain in database backups for up to 12 months.
Individuals may contact support@nexkey.com with questions about retained information or to request additional deletion.
Nexkey evaluates such requests in accordance with applicable privacy laws and any relevant exceptions.
8. Cookies, Analytics, and Tracking Technologies
Nexkey uses cookies and similar technologies to support website functionality, understand visitor activity, monitor performance, troubleshoot issues, and evaluate marketing effectiveness.
These technologies may collect information including IP addresses, browser characteristics, device identifiers, pages visited, and website interactions.
8.1 Public Website
Nexkey's public website uses Google Analytics and includes tracking technologies associated with Meta and Microsoft Advertising.
These services may collect information about website visits and interactions and may process information under their respective privacy practices.
Certain tracking technologies may operate before a visitor acknowledges Nexkey's cookie notice.
8.2 Web Management Portal
Nexkey uses LogRocket, Hotjar, and Google Analytics to analyze activity and troubleshoot issues in its web management portal.
These technologies may collect session activity, user interactions, and technical information.
Session-recording technologies may capture information displayed during a session. Nexkey uses configuration controls intended to protect sensitive information from being recorded.
8.3 Managing Cookies
Visitors may manage or disable cookies through their browser settings.
Certain website features may not function as intended when cookies are disabled.
Individuals may also contact support@nexkey.com with questions concerning website tracking or privacy preferences.
9. Marketing Communications
Nexkey may communicate with customers and prospective customers about products, services, company announcements, and related offerings.
Individuals may opt out of promotional email communications through applicable unsubscribe mechanisms or by contacting support@nexkey.com.
Opting out of promotional communications does not prevent Nexkey from sending necessary account, operational, transactional, or security-related communications.
10. Your Privacy Rights
Depending on applicable law, individuals may have rights concerning their personal information, including:
Access to certain personal information
Correction of inaccurate personal information
Deletion of personal information, subject to applicable exceptions
Data portability
Opting out of certain processing activities where required by law
Appealing certain privacy request decisions where applicable
Privacy requests may be submitted to:
Nexkey may request information reasonably necessary to verify the identity and authority of individuals submitting requests.
Where Nexkey processes information on behalf of an organization, certain requests may need to be directed to that organization.
Nexkey will evaluate and respond to applicable requests in accordance with relevant legal requirements.
Account deletion requests do not automatically remove historical organizational audit records. Requests involving retained information will be evaluated under applicable law.
11. Children's Privacy
Nexkey's Services are designed primarily for business and organizational access control and are not directed toward children under 13 years of age.
Organizations using Nexkey may create accounts for individuals they authorize to access their facilities.
Nexkey does not currently impose a minimum age restriction on accounts created by organizational administrators.
Nexkey does not knowingly maintain accounts for children under 13.
If Nexkey becomes aware that it is processing personal information relating to a child in circumstances requiring additional protections, it will address the information in accordance with applicable law.
Parents or legal guardians with questions concerning a child's personal information may contact support@nexkey.com.
12. Third-Party Websites and Services
Nexkey's website or Services may contain links to third-party websites and services.
These third parties operate under their own privacy policies and practices.
Nexkey encourages users to review the privacy policies of third-party services before providing personal information.
13. Changes to This Privacy Policy
Nexkey may update this Privacy Policy to reflect changes in its Services, business practices, technology, or applicable legal requirements.
When changes are made, Nexkey will publish the updated Privacy Policy on its website and revise the effective date.
Additional notice or consent will be provided when required by applicable law.
14. Contact Information
For questions, concerns, or requests concerning this Privacy Policy or the handling of personal information, contact:
Infinity Software Services LLC
Doing business as Nexkey
Website: https://www.nexkey.com
Email: support@nexkey.com
15. Additional Information for U.S. Residents
Certain U.S. state privacy laws provide eligible residents with additional rights concerning their personal information.
The availability and scope of these rights depend on applicable law, including whether the relevant law applies to Nexkey and the information involved.
Nexkey will evaluate and respond to applicable privacy requests in accordance with relevant legal requirements.
Individuals may contact support@nexkey.com to submit privacy-related inquiries or requests.
Where information is processed on behalf of a customer organization, certain requests may need to be addressed by that organization.
Nexkey may retain information necessary to preserve organizational access control audit histories, investigate security incidents, comply with legal obligations, or support other legitimate purposes, subject to applicable privacy laws and individual rights.