Privacy Policy

Last updated August 23, 2026 · NSSX Holdings Inc., 3110 1st Ave N, St. Petersburg, FL 33713

1. Who we are and what this covers

NSSX Holdings Inc. ("NSSX," "we," "us") operates this website to (a) help families and individuals find out whether they may qualify for a social-media addiction claim, (b) run a partner/affiliate program, and (c) offer qualified-claimant allocations to investors. This policy explains what we collect from each of those groups, how we use and share it, and the rights you have under federal law and the laws of your state. It applies to this site, our intake forms, and the calls, texts, and emails we send.

We are a marketing and intake company, not a law firm. Information you submit is used to evaluate and refer your potential claim to licensed attorneys. Submitting information does not create an attorney-client relationship.

2. Information we collect

Families and claimants:

• Contact details: name, mobile number, email, state, IP address and device information.
• Claimant details: relationship to you, name, date of birth, whether the claimant is a minor, and parent/guardian status.
• Platform use: which Meta platforms were used (Instagram, Facebook), account usernames/handles, age at first use, years of use, and approximate daily time spent.
• Health information: diagnosed conditions, diagnosis dates, treating providers, hospitalization and treatment history, and medical records you choose to upload. We collect this only with your explicit authorization (see Section 5).
• Military or first-responder affiliation (optional).
• Documents you upload: identification, proof of accounts, screenshots, medical records, proof of guardianship.
• Consent records: the date, time, IP address, and wording of each consent you give (communications consent, HIPAA authorization, e-signature).
• Communications: texts, emails, and call notes between you and our team, including automated and AI-assisted messages.

Partners and affiliates:

Investors:

Automatically:

3. How we use information

• Evaluate whether a claim meets litigation criteria (rule-based scoring, AI-assisted review, and human review).
• Contact you by phone, text, and email about your claim, documents, and agreements — with your consent (Section 4).
• Refer qualified claims to licensed attorneys and, where you direct, transmit your intake data, signed agreements, and records to the law firm (including through its Salesforce system).
• Prepare and deliver the contingency fee agreement and HIPAA authorization for your review and signature.
• Run the partner program (attribution, payouts, fraud and compliance checks) and investor allocations.
• Send optional wellness-product information only after you separately opt in.
• Operate, secure, and improve the site; comply with law; enforce our terms.

We use AI tools (including Anthropic's Claude) to check uploaded documents for legibility, summarize claim packets for reviewers, prioritize imported records, and draft personalized reminders within approved templates. AI output is reviewed by people before a claim is marked qualified or submitted. We do not use your information to train AI models.

4. Calls, texts, and email (TCPA, CAN-SPAM, state telemarketing laws)

When you submit an intake form you give prior express written consent for NSSX and the affiliated law firm to call and text you — including using automated technology and AI-assisted messages — at the number you provide, even if it is on a federal or state Do Not Call list. Consent is not a condition of service; you may instead email intake@nss-x.com. Message and data rates may apply. Reply STOP to any text to opt out, HELP for help. Every email includes an unsubscribe link. We honor quiet hours and do not text between 9 p.m. and 8 a.m. your local time. We comply with Florida's Telephone Solicitation Act, the Oklahoma Telephone Solicitation Act, Washington's Commercial Electronic Mail Act, and similar state laws where applicable.

5. Health information and HIPAA

NSSX is not a HIPAA covered entity, but we handle your health information as if it were. We collect diagnosis and treatment details and medical records only after you (or the claimant's parent/legal guardian) sign a HIPAA-compliant authorization (45 C.F.R. § 164.508) that names who may disclose the records, who may receive them, the purpose, and the expiration, and that explains your right to revoke. Health information is encrypted in transit and at rest, stored in access-controlled systems, disclosed only to the law firm handling your claim and service providers bound by confidentiality, and never sold or used for advertising. Records obtained under your authorization may be re-disclosed by the recipient law firm only as permitted by law and your authorization. You may revoke the authorization at any time in writing to intake@nss-x.com; revocation does not affect disclosures already made.

6. Minors

Many claimants are under 18. We collect a minor's information only from a parent or legal guardian who confirms that status, and we require proof of guardianship before a claim is filed. We do not knowingly collect information directly from children under 13 (COPPA). If you believe a child provided information directly, contact us and we will delete it.

7. How we share information

• Law firms: the attorneys evaluating or handling your claim, including their case-management systems (e.g., Salesforce).
• Lead purchasers: if your qualified claim is placed with another licensed law firm or its authorized intake partner, your intake information and consent records are transferred to them for that purpose only. You will be told which firm represents you.
• Service providers under contract: hosting (Vercel), database and file storage (Supabase), text messaging (Twilio), email (Resend), e-signature, AI review (Anthropic), analytics. They may use your data only to provide services to us.
• Partners/affiliates: only whether a referred lead qualified and its stage — never contact or health details.
• Legal: to comply with law, court orders, or to protect rights and safety; in a merger or sale, subject to this policy.

We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use sensitive personal information for any purpose other than those described here.

8. Your rights by state

Residents of states with comprehensive privacy laws have the rights described below. We extend these rights to all U.S. residents regardless of state.

• California (CCPA/CPRA): right to know, delete, correct, and port your information; to limit use of sensitive personal information; to opt out of sale/sharing (we do not sell or share); and not to be discriminated against for exercising rights. Authorized agents may submit requests. Consumer Health Data: we do not sell it.
• Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island (comprehensive privacy acts): rights to access, correct, delete, obtain a copy, and opt out of targeted advertising, sale, and profiling in furtherance of significant decisions. Sensitive data (including health data and data of known children) is processed only with your consent, which you may withdraw. Where required (e.g., Colorado, Connecticut, Virginia, Texas), you may appeal a denied request by replying to our decision; we respond within 45 days (extendable once by 45 days).
• Washington (My Health My Data Act) and Nevada (SB 370): consumer health data is collected and shared only with your consent, is not sold, and you may access, delete, and withdraw consent. Our Consumer Health Data Privacy notice is this Section 5 and Section 8.
• Florida (Digital Bill of Rights): rights to access, delete, correct, and opt out of sale or targeted advertising; we do not sell.
• Illinois (BIPA): we do not collect biometric identifiers. ID photos are used only to verify identity and are not processed biometrically.
• Nevada, Vermont, Oregon (data broker laws): we are not a data broker; we collect information directly from you.
• All states: you may opt out of marketing calls and texts at any time (STOP), and we honor Global Privacy Control signals for opt-out of sale/sharing.

To exercise any right: email intake@nss-x.com with "Privacy Request" in the subject, text STOP to any message, or write to 3110 1st Ave N, St. Petersburg, FL 33713. We verify requests using the contact details on file and respond within 45 days. We will not deny service or change pricing because you exercised a right.

9. Security and retention

Data is encrypted in transit (TLS) and at rest, stored on access-controlled infrastructure in the United States, with role-based access, audit logs of every access to a claim record, and MFA for staff. We retain intake and consent records for the life of the litigation plus the period required by law (typically 7 years) because they may be evidence; partner and investor records for 7 years after the relationship ends; and unqualified inquiries for 2 years unless you ask us to delete them sooner. In the event of a breach affecting your data we will notify you and regulators as required by your state's breach-notification law.

10. Cookies and tracking

We use strictly necessary cookies (session, security, partner attribution) and privacy-respecting analytics. We do not load third-party ad pixels on intake pages. You can block cookies in your browser; the intake form will still work.

11. Changes and contact

We will post changes here with a new "Last updated" date and, for material changes affecting claimants, notify you by email or text. Questions: intake@nss-x.com · 3110 1st Ave N, St. Petersburg, FL 33713.

This policy was prepared for NSSX's intake operations and should be reviewed by counsel before launch and whenever state law changes.