Privacy Policy

Last updated: September 25, 2026

Who we are

VISUALNEX.US (visualnex.us) is operated by BOT-HOLDINGS, LLC, doing business as codedatda.casa (“BOT-HOLDINGS”, “we”, “us”), based in Las Vegas, Nevada, United States. We are the data controller for the personal data described here. Questions and requests go to dev@codedatda.casa.

What we collect, and why

• Server and security logs. Like every website, when you visit we and the services in front of us receive your IP address, browser type, the pages you request, timestamps and referring page. Our host keeps standard access logs and our content delivery network (Cloudflare) filters traffic for attacks. We use this to run the site, keep it secure and investigate abuse.
• Booking and join form. When you use it we collect what you type: the service you need, name, email, phone, company, best callback time and timezone, event name, type, venue, city, dates, expected attendance and budget, service-specific details (screens, environment and permits, platform, performers or builds), for artists applying to join: your disciplines, reel or portfolio link and home base, your message. Files you attach are delivered to our team with the message and not kept on our server. We use it to prepare a quote, answer your question, or review your application to join the collective. The submission is emailed to the VISUALNEX.US partners who handle bookings (the [email protected] mailbox and one partner’s own visualnex.us mailbox).
• Accounts. If you create an account we store your email address, a hashed password and your account settings. Accounts exist only for the team media pipeline at /submit, where every account request is reviewed before it is activated. What the pipeline keeps is described under “Team media pipeline” below.
• Support chat. The chat button on this site opens a support assistant that is an AI: its answers are generated by an AI model run by OpenAI, using this site’s own pages and help articles. To start a chat you give your name and your email address and, if you choose, what the chat is about (booking a show, joining the collective, or a general question). Before your first message a Cloudflare Turnstile check runs to keep out bots; it sends browser signals and your IP address to Cloudflare. Each message you send, the details you entered, and the title and address of the page you are on are sent to OpenAI to produce the reply. A member of our team can read the conversation and may join it. Once a team member has joined, you may be able to send each other photos, videos, audio clips and files (for example PDFs or documents). Files go only to our team, never to the AI (the AI sees only the file’s name). They are stored on our server with the conversation and can be opened by anyone who has the file’s private link. Photos keep the details your camera embedded in them, such as location and time, so remove those before sending if you prefer. We email our team when a chat starts (your details, the page and your first question), when it needs a person, and a full transcript when it ends, and we email a copy of the conversation to the address you gave. On the site we keep the conversation, the details you entered, the pages you chatted from, a random chat ID, a shortened IP address (for IPv4 the last number is removed; for IPv6 only the network prefix is kept) and any thumbs-up or thumbs-down rating you give (with any comment you add to it); your browser keeps the open chat in session storage until you close the tab. Once a week, conversations our team handled are sent to OpenAI with email addresses, phone numbers and order or ZIP numbers masked, so it can suggest answers for the assistant’s knowledge base; a person reviews every suggestion before the assistant uses it. Conversations, files and the details you entered are deleted from the site 90 days after the chat started; records of which team member handled a chat, and our team’s own internal chat about it, are kept for up to 12 months; emailed copies stay in the mailboxes they were sent to. Our team’s phones are alerted through Google Firebase Cloud Messaging (and Apple’s push service on iPhone); the alert contains only a chat reference, not what you wrote. Please do not send payment card numbers, passwords, government ID or health information in the chat.
• Booking form delivery. You can attach up to five files (25 MB in total) to the booking form, such as decks, stage plots, riders and pixel maps. The email our partners receive also contains the IP address our server recorded for the request. The site keeps no copy of the form: attachments sit in temporary server storage only while the email is sent and are then deleted. To stop spam, the site keeps a counter keyed to a hash of that IP address for one hour. Riders, plots and lineups often name other people (performers, crew, venue staff), so please send only what we need to quote the show.
• Team media pipeline (/submit). Artists and crew can request an account at /submit to contribute photos and videos to our gallery. An account request collects a username, email address, password (stored only as a salted hash), a public display name and, if you choose, a short bio, website, Instagram handle and other links, together with the IP address the request came from. Each request is emailed to [email protected] with the username, display name, email address, website, Instagram handle, bio and IP address. When we approve an account we keep the username, email address, password hash and profile, and drop the IP address. Each upload collects the file, an attribution, caption, location, project year, category and an optional description (and, when the shared team login is used, a website, Instagram handle and links), together with the IP address the upload came from; a short notice of each upload, with the uploader’s account name and IP address, is emailed to [email protected]. Pending files are kept in a private folder outside the public web root until we review them, and rejected files are deleted. If we approve a piece, the photo or video is published on this site with your display name or attribution, caption, location, year, description, bio and links; your email address and IP address are never published. Photos are re-encoded as JPEG images no larger than 1400 pixels on a side; videos are published exactly as uploaded. Either can still carry metadata your camera embedded (such as GPS location), so remove it before you upload. To stop abuse, sign-in and sign-up attempts are counted against a hash of your IP address for 15 minutes. Signing in to the pipeline sets one strictly necessary cookie, vnx_sub_auth, which lasts 8 hours.
• Browser storage. If you dismiss the cookie notice, the site remembers that in your browser’s local storage (vnx-cookie-ok); nothing is stored before you click.
• Security records. Our security plugins (Wordfence and an activity log) record sign-in attempts, blocked requests and changes made by site administrators, with the IP addresses involved. Wordfence shares the IP addresses of attacking requests with the threat network run by its maker, Defiant, Inc.
• Page-load measurement. Our content delivery network (Cloudflare Web Analytics) records page loads and timing without cookies and without identifying you across sites.

We do not collect more than we list here, we do not buy data about you from data brokers, and we do not sell your personal data.

How we use AI

Some of what this service does is generated by machine-learning models run by a third-party provider. Specifically:

• the Nex chat assistant, which answers questions about booking and joining the collective from this site’s own pages and hands real booking requests to a person
• weekly suggestions for the assistant’s reference material, drawn from chats our team handled with email addresses, phone numbers and order-like numbers masked out, each approved by a person before the assistant uses it

We use OpenAI (OpenAI, L.L.C.) for this. We send them only what is needed to answer the request. Under their API terms they do not use the content we send to train their models, and we do not use your content to train models either. Generated text can be wrong, incomplete or out of date; treat it as a draft, not as professional, legal, medical or financial advice. A person on our team may read a conversation or output to help you or to check quality.

Nex cannot quote a price or confirm a booking; only a partner’s written quote does.

Legal bases (EU, UK and similar laws)

• Contract: to provide what you asked for, such as answering a message, fulfilling an order or running your account.
• Legitimate interests: keeping the site secure, preventing fraud and abuse, understanding aggregate use of the site, and running our business, balanced against your rights.
• Consent: any optional field you choose to fill in, and any optional feature you switch on. You can withdraw consent at any time; it does not affect processing that already happened.
• Legal obligation: tax, accounting and responding to lawful requests.

Cookies and similar technologies

This site sets no tracking cookies. It may set strictly necessary cookies (for example a Cloudflare security cookie such as cf_clearance or __cf_bm, or a cookie that remembers your cookie choice) that do not track you across sites and need no consent.

Our site does not currently respond to Do Not Track or Global Privacy Control browser signals; use your browser settings instead.

Who we share it with

We share personal data only with the service providers that help us run this site and deliver what you asked for. Each is a separate company that processes it under its own terms, which include data-protection commitments:

We also disclose data when the law requires it (for example a valid court order), to protect our rights, safety or property or those of others, and, if our business is sold or reorganized, to the successor under this same policy. We do not sell personal data and we do not share it for cross-context behavioral advertising.

International transfers

We are based in the United States and our providers are mostly US companies, so your data is processed mainly in the United States. Our team also administers our sites and services from Hong Kong, and working copies of some production data are kept on our administrators’ workstations there. If you are in the EU, UK or Switzerland, transfers rely on the providers’ EU Standard Contractual Clauses or Data Privacy Framework certification, plus the security measures below. You can ask us for details of the safeguard that applies.

How long we keep it

• Server and security logs: kept by our hosting provider as part of its standard log rotation; our content delivery network keeps request logs only briefly.
• Booking and join form: until we have dealt with your message and for up to 24 months after, unless you ask us to delete it sooner.
• Support chat: conversations, files, and the details you entered, 90 days from the start of the chat; records of which team member handled a chat and our team’s internal team chat about it, 12 months; suggested knowledge-base answers (with contact details and numbers masked), until we delete them; emailed copies stay in the receiving mailboxes while we may need them to help you.
• Media-pipeline accounts: until the account is deleted, which we do on request. Pieces you published stay on the site, with your credit, until you ask us to remove them.
• Team media pipeline: account requests until we approve or reject them (the IP address is not kept on an approved account); pending uploads until we review them (rejected files are deleted at once); published pieces, their credits and the upload record, including the IP address it was sent from, until you or we remove them.
• Spam counters keyed to a hash of the IP address: one hour (booking form) and 15 minutes (media pipeline sign-in and sign-up).
• Security activity log: 12 months.

Security, and what happens if something goes wrong

We protect personal data with encryption in transit (HTTPS), with every plain-HTTP request redirected to HTTPS, Cloudflare’s edge network in front of the site, which blocks known attack traffic, login protection with automatic blocking of repeated failed logins, access limited to the people on our team who need it, and uptime and health monitoring of our servers. Media-pipeline uploads wait for review in a private folder outside the public web root. Files exchanged in the support chat are stored in the site’s uploads folder behind a deny-all rule and can be opened only through unguessable links. No system is perfectly secure, so we also plan for failure: if we learn of a security incident that affects your personal data, we will investigate, contain it, and notify you and any regulator we are required to notify without undue delay and within the time the applicable law sets (72 hours to the supervisory authority under the GDPR).

If you believe you have found a security problem in this site or any of our services, please tell us at dev@codedatda.casa before you tell anyone else. We will not pursue good-faith researchers who report responsibly and do not access, change or destroy other people’s data.

Your rights

Wherever you live, you can ask us what personal data we hold about you, ask us to correct or delete it, ask for a copy in a portable format, object to or restrict how we use it, and withdraw any consent you gave. If you are in the EU, UK or Switzerland these are your rights under the GDPR and UK GDPR, and you may also complain to your data protection authority. If you are a California resident, the CCPA/CPRA gives you the rights to know, delete, correct, and to opt out of sale or sharing (we do not sell personal data and we do not share it for cross-context behavioral advertising), and we will not treat you differently for exercising them; residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other US states with privacy laws have similar rights, including the right to appeal a decision we make about your request.

To exercise any of these, email dev@codedatda.casa from the address you used with us, or tell us enough for us to find and verify your record. An authorized agent may act for you if they show us your written permission. We answer within 30 days (45 for California requests, extendable once) and we do not charge for this unless a request is clearly excessive.

Children

This site is not directed to children and we do not knowingly collect personal data from anyone under 13 (or under 16 in the EU). If you believe a child has given us data, contact us and we will delete it.

Links to other sites

Links to sites we do not run (including app stores, GitHub, payment processors and social networks) are covered by those sites’ own policies.

Changes

When we change this policy we update the date at the top and, for material changes, post a notice on the site or email registered users. Earlier versions are available on request.

Contact

BOT-HOLDINGS, LLC, doing business as codedatda.casa
Las Vegas, Nevada, United States
dev@codedatda.casa