Privacy Policy

Effective Date: July 29, 2026

NXGEN Holdings LLC ("NxGeN," "we," "us," or "our") operates an invitation-only community for next-generation members of family offices and the people they trust. This Privacy Policy explains how we handle your information when you apply for membership, use our digital platform at nxgen.club and related applications (the "Platform"), attend our events, or otherwise interact with us (collectively, the "Services").

Membership in NxGeN is a relationship of trust. Much of the information we hold about you, your family office affiliation, your investment focus, your interests, who you connect with, and what you share with peers, is sensitive. We treat it that way. The commitments below are deliberately strict: we do not sell your data, we do not share it with advertisers, and we do not use it to train machine-learning models.

By accessing the Services, you confirm that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.

1. Information We Collect

1.1 Information You Provide When Applying for Membership

Membership is by invitation. When you apply, you may provide:

• Identity and contact details: legal name, preferred name, date of birth, photograph, email, phone number, and mailing address.
• Background information: family office affiliation (where you choose to share it), professional history, investment focus, geographies of activity, and a personal statement about why NxGeN.
• References: the name of the existing member, partner, or NxGeN team member who introduced you, and any references you supply.

NxGeN's vetting committee reviews applications. The vetting process is human, not automated. From time to time, we may verify the identity, background, or accreditation status of an applicant or member through reputable third-party services. If we engage such a service, we will reflect it in our subprocessor list and disclose what is collected.

1.2 Profile and Activity Information You Provide as a Member

Once admitted, you choose what to add to your profile and how visibly to share it. This may include:

• Profile content: bio, interests, "what I bring / what I'm looking for," portfolio focus, lifestyle interests, and any optional family office affiliation.
• Trust-layer settings: which fields are visible at directory level versus profile level versus to confirmed connections only.
• Connections: the members you connect with, your introduction requests, and intermediary approvals.
• Peer Advisory Circle membership: the Circle you are placed in, your attendance, and any commitments you choose to log. Circle session content (discussions, recordings, transcripts) is not retained by us, see Section 4.
• Network participation: posts, comments, and reactions in interest-based Networks (e.g., AI & Entrepreneurship, Impact Investing).
• Givers Network listings and requests: assets you choose to share with your Inner Circle, requests you make, and offers you receive.
• Direct messages: message metadata (who messaged whom, when) and message content. We encrypt direct-message content in transit and at rest and apply strict access controls, see Section 4.
• Deal Vault and investment materials: deal records and documents you choose to add, the relationship and economic-interest disclosures you provide, and your stated investment criteria ("mandates"). These are private to you, encrypted at rest, and not shared with anyone unless you explicitly choose to share them.
• Family Space content: information you add to your family circle (notes, documents, facts, and contacts) and the family members you invite, all of whom must be adults (see Section 9).
• AI assistant activity: the prompts you send to Jen and the responses it returns, which are retained in your conversation history. We do not use this content to train machine-learning models, and our AI providers are contractually barred from doing so.
• Practice (paper) trading: your simulated portfolio, watchlists, and practice-trade history. This feature uses no real money and executes no real trades.
• Event activity: RSVPs, breakout selections, check-ins at sessions and activities, photos taken at events where you are visible, and post-event connection prompts you act on.
• Payment information: billing details for membership dues and event fees, processed by our payment processor (Stripe). We do not store complete payment card numbers on our servers.
• Support and feedback: information you provide when contacting NxGeN, submitting feedback, or reporting concerns.

1.3 Information We Collect Automatically

When you use the Platform, we automatically collect:

• Device information: IP address, browser type and version, operating system, device identifiers, and language settings.
• Usage information: pages visited, features used, session duration, and aggregated interactions with the Platform.
• Authentication information: magic-link tokens (short-lived) and, if you opt in, biometric identifiers used by your device locally for sign-in (these never leave your device).
• Server logs: error reports and performance data used to diagnose issues.
• Cookies and local storage: a small number of first-party cookies and browser-storage entries that keep the Services working, save your in-progress application, preserve referral credit, and store your cookie-consent choices, plus privacy-friendly analytics that load only with your consent. See Section 12 and our Cookie Policy for the itemized list.

1.4 Information from Third Parties

We may receive information about you from:

• The member or NxGeN team member who introduced you, in connection with your application.
• Event partners and venues providing attendance, registration, or activity participation information for events you sign up for.
• Publicly available sources (e.g., professional bios) that we may use to confirm details you provide.

1.5 Sensitive Information

The nature of NxGeN means members may discuss financial, family, and lifestyle matters that are sensitive to them. We do not require members to disclose financial details, family dynamics, or any other sensitive matter. Anything you share in a Circle, Network, message, or asset listing is your choice. We apply the safeguards in Section 6 to all member information, and we apply the heightened protections in Section 4 to Circle content and direct-message content specifically.

2. How We Use Your Information

We use your information for the following purposes:

• Provide the Services: operate the Platform, run the application and onboarding flow, place you in an appropriate Peer Advisory Circle, suggest relevant Networks and connections, manage event registration and check-in, and run the Givers Network.
• Verify identity and protect trust: confirm you are who you say you are, prevent impersonation, and investigate concerns reported by members.
• Communicate with you: send service-related messages (e.g., onboarding, Circle scheduling, event logistics), respond to inquiries, and provide member support.
• Process payments: charge membership dues and event fees through our payment processor.
• Improve the Services: analyze aggregated, de-identified usage patterns to refine features and programming. We do not use your content to train machine-learning models.
• Security and abuse prevention: detect and respond to fraud, unauthorized access, and conduct that violates our Terms of Service.
• Legal compliance: comply with applicable laws, regulations, and lawful requests.

We will never use your information for cross-context behavioral advertising or for targeting by third parties.

3. How We Share Your Information

We share your information only as described below.

• With other members, on your terms. Profile information is visible according to the trust-layer settings you choose (directory-level, profile-level, or confirmed-connection-level). Members are expressly prohibited from scraping, exporting, or commercially using member information, see our Terms of Service.
• With service providers (subprocessors). We share information with vendors who help us run the Services, under contracts that require them to protect your information and use it only for our purposes. Our current subprocessors are listed in Section 11.
• With event partners. Where you have opted into a sponsor- or partner-led experience, limited information necessary to participate (e.g., your name and the fact that you registered) may be shared with that partner. We do not provide partners with member directories or non-attendee data.
• For legal reasons. We may disclose information when required by law, regulation, legal process, or governmental request, and to protect the rights, property, or safety of NxGeN, members, or others.
• With your explicit consent, for purposes you have specifically agreed to.
• In a business transfer. If NxGeN is involved in a merger, acquisition, financing, or sale of assets, your information may transfer as part of that transaction. We will notify you in advance and your information will continue to be protected by this Privacy Policy or an equivalent successor.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We do not provide your personal information to advertisers, data brokers, or third-party targeting platforms.

4. Heightened Protections for Circles and Direct Messages

Two parts of the Platform receive heightened protections that are stricter than what most platforms offer.

4.1 Peer Advisory Circle Confidentiality (the "Vegas Rule")

What is shared in a Circle stays in the Circle.

• Circle sessions are not recorded and not transcribed server-side.
• Circle session content is not stored on our servers and is not searchable within the Platform.
• The only Circle data that persists is what you personally choose to record as your own commitments, which only you can see.
• The facilitator may log session metadata (date, attendance) for scheduling and continuity purposes.

Circles operate on member-to-member trust. NxGeN reinforces that trust technically; members reinforce it socially through the membership commitment described in our Terms of Service.

4.2 Heightened Protections for Direct Messages

Direct-message content is sensitive by default. We protect it as follows:

• We encrypt direct-message content in transit (TLS 1.3, or 1.2 where the client does not support 1.3) and at rest (AES-256 or equivalent).
• Access to message-content storage is restricted to a small number of trained NxGeN personnel and only where necessary to operate the feature, investigate abuse reported to us, or comply with law.
• We do not scan the content of direct messages for advertising or third-party targeting purposes (and we do not run advertising or third-party targeting in the first place, see Section 3).
• We do not use direct-message content to train machine-learning models.

Direct messages are protected by server-side encryption as described above, rather than end-to-end encryption. We chose this model so that we can investigate reported abuse and meet our legal obligations; any access to message content by NxGeN personnel happens only through a logged review process that requires a recorded reason and is limited in time. If we materially change how direct messages are protected, we will update this Privacy Policy and notify members.

4.3 Givers Network Listings

Asset listings in the Givers Network are visible only to your Inner Circle connections. They are not searchable by the broader membership, are not displayed publicly, and are not shared with vendors except as needed to operate concierge logistics that you specifically request.

4.4 AI Features and Automated Processing

Some features, including our assistant "Jen" and our Senior Advisor experiences, use artificial intelligence to respond to your requests.

• What is processed. To answer a request, we send the AI provider only the prompt and a curated subset of your member-visible information needed to respond. Sensitive materials, including deal materials you have not consented to AI use for, are excluded.
• No training. Our AI providers (identified in Section 11) are contractually barred from using your information to train their models, and we do not use it for that purpose either.
• No automated decisions with legal effect. We do not use AI to make decisions that produce legal or similarly significant effects about you without human involvement. Membership vetting is performed by people, not by automated decision-making.
• Accuracy. AI output can be incomplete or inaccurate and is provided for information only. It is not professional advice. See our Terms of Service and Investment and Securities Risk Disclosure.

Where the GDPR or similar laws apply, you may contact us at privacy@nxgen.club with questions about automated processing.

5. Data Retention

We retain your information for as long as your membership is active and as needed to provide the Services. After your membership ends:

• Account information and profile content: deleted within sixty (60) days of termination, except where retention is required by law (e.g., financial records) or for legitimate business purposes such as resolving disputes, enforcing agreements, or preserving member-trust integrity records.
• Direct-message content: deleted from active systems within sixty (60) days of termination. Deletion may take longer for messages exchanged with members whose accounts remain active, in which case the content is preserved on the recipient's side under their account.
• Circle session content: ephemeral; nothing persists beyond the limited metadata described in Section 4.1.
• Backups: information may persist in routine backups for up to ninety (90) days after deletion from active systems.
• Aggregated, de-identified data: may be retained indefinitely because it cannot be linked back to you.

5.1 Deleting Your Account

You do not have to wait for your membership to end, and you do not have to ask anyone. You can delete your account yourself at any time:

• In the app: tap your profile picture in the top right to open You, then scroll down the list and tap Delete account.
• On the web: go to <https://nxgen.club/delete-account>. Use this if you can no longer sign in.

Either route sends a confirmation link to the email address on your account. Nothing is deleted until you open that link. After you confirm, there is a short grace period before the deletion runs, and you can cancel at any point before it does, either from the same screen in the app or from the cancel link in that same email.

Once the deletion runs, the timings in this Section 5 apply, and we treat the deletion as a termination of your membership. You may also request deletion by contacting privacy@nxgen.club if you prefer to deal with a person.

6. Data Security

We protect your information using technical and organizational measures appropriate to its sensitivity, including:

• Encryption in transit using TLS 1.3 (or, where 1.3 is not supported by the requesting client, TLS 1.2).
• Encryption at rest using AES-256 or an equivalent industry-standard algorithm.
• Access controls including role-based access, the principle of least privilege, multi-factor authentication for administrative access, and automated session timeout.
• No public indexing. Member profiles are not indexed by search engines. We enforce this through robots.txt, noindex meta tags, and authenticated routing.
• Audit logging of access to member information.
• Regular vulnerability scanning and penetration testing of the Platform.
• Secure software development practices and protections against the OWASP Top 10.
• Vendor risk management - every subprocessor in Section 11 is contractually bound to protect your information.
• Incident response and breach notification - we maintain an incident-response process, and if a breach affecting your personal data occurs, we will notify affected members and the relevant authorities as required by applicable law and without undue delay.
• Annual third-party security audit beginning in our second operating year (Phase 2 of the Platform roadmap), with the goal of formal SOC 2 Type II attestation thereafter.

No system is perfectly secure. While we work hard to protect your information, we cannot guarantee absolute security.

7. International Members and Data Transfers

NxGeN is a global community with members across the United States, Europe, the United Kingdom, the Middle East, and Africa. NXGEN Holdings LLC is formed in Florida, and our primary infrastructure is hosted in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States.

For transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable) or another lawful transfer mechanism. We perform transfer impact assessments where required.

8. Your Rights and Choices

Depending on your location, you may have the rights described below. We will respond to verified requests within the timeframes required by applicable law.

8.1 Rights Available to All Members

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate or incomplete (you can also edit most of your profile yourself).
• Deletion: ask us to delete your information, subject to limited exceptions described in Section 5. You can also delete your account yourself, in the app or at <https://nxgen.club/delete-account>, without contacting us. See Section 5.1.
• Portability: request a copy of your information in a structured, machine-readable format.
• Opt out of non-essential communications: unsubscribe from newsletters, programming announcements, and other non-essential messages at any time. Service-related communications (e.g., security notices, billing) cannot be opted out of while your membership is active.
• Adjust trust-layer settings: change at any time which fields are visible to which audiences.

8.2 Additional Rights for EEA, UK, and Swiss Residents

If you are located in the EEA, the United Kingdom, or Switzerland, you also have the right to:

• object to or restrict our processing of your personal data;
• withdraw consent at any time where we rely on your consent;
• lodge a complaint with your local supervisory authority.

We process your personal data on the following legal bases under the GDPR / UK GDPR:

• Contract - to provide the Services that you have requested.
• Legitimate interests - to operate, secure, and improve the community, prevent abuse, and protect the trust members place in NxGeN. We have balanced these interests against your rights.
• Legal obligation - to comply with applicable law.
• Consent - where we ask for it (e.g., optional marketing communications).

8.3 Additional Rights for California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know, delete, and correct your personal information; to opt out of "sale" or "sharing" of personal information; and to non-discrimination for exercising these rights.

We confirm: we do not sell or share personal information in the senses defined by the CCPA/CPRA. We do not engage in cross-context behavioral advertising.

8.4 Exercising Your Rights

To exercise any of these rights, contact privacy@nxgen.club. We may need to verify your identity before responding. You may also designate an authorized agent to act on your behalf, subject to verification.

Deletion is the one right you can exercise without us: delete your account in the app from the You screen, which opens from your profile picture in the top right, under Delete account, or at <https://nxgen.club/delete-account> if you can no longer sign in. See Section 5.1 for how confirmation and cancellation work.

9. Children's Privacy

The Services are not intended for, or directed to, individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. This applies to Family Spaces as well: every person you invite to a Family Space must be at least 18, and you must not add a minor or submit a minor's personal information through the Services. If we learn that we have collected information from anyone under 18, we will delete it. If you believe a child has provided information to us, please contact privacy@nxgen.club.

10. Third-Party Links and Services

The Platform may contain links to third-party sites or integrate with third-party services. This Privacy Policy does not apply to those services, and we are not responsible for their practices. Review their privacy policies before using them.

11. Subprocessors

We rely on the following subprocessors to provide the Services. Each is contractually bound to protect your information.

We may update this list. The current and complete list of subprocessors is maintained at <https://nxgen.club/legal/subprocessors>. Material changes are published there and notified to institutional partners under their Data Processing Agreements.

12. Cookies and Similar Technologies

We use a limited set of first-party cookies and browser-storage technologies (local and session storage), together with strictly necessary cookies set by our security and hosting providers. We use them to:

• keep the Services working - maintain your session, save your in-progress membership application, and protect the site against bots and abuse (Cloudflare);
• preserve referral credit - remember the member who invited you so they are credited when you apply (stored for up to ninety (90) days);
• remember your privacy choices - store your cookie-consent selections; and
• measure usage, only if you allow it - privacy-friendly, aggregate analytics (Vercel) that do not track you across other sites and that load only after you consent.

We do not use advertising cookies, cross-site trackers, or third-party targeting pixels.

When you first visit the Platform, a consent banner lets you accept or reject non-essential (analytics) technologies. Strictly necessary technologies cannot be switched off, because the Services will not function without them. You can change or withdraw your choice at any time through the Cookie Preferences link in the site footer, or through your browser settings, and we honor Global Privacy Control (GPC) signals.

For the full, itemized list of cookies and storage entries, including names, providers, durations, and purposes, see our Cookie Policy.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date above and provide notice through the Platform or by email. Your continued use of the Services after the change becomes effective constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

For privacy questions or requests:

NXGEN Holdings LLC Privacy: privacy@nxgen.club Legal: legal@nxgen.club Website: nxgen.club

EEA, UK, and Swiss residents may also contact their local supervisory authority. The lead supervisory authority for our processing of EEA personal data is the Irish Data Protection Commission.