Privacy Notice

• Account information: name, email, account identifier, authentication information and profile preferences, including timezone. We use these to create and secure accounts and personalise the service (contract performance and legitimate interests in security).
• WhatsApp information: your linked phone number, sender and message identifiers, messages, delivery statuses and linking attempts. We use this to verify account linking, respond to requests, deliver eligible reminders and prevent misuse (contract performance and legitimate interests in fraud prevention).
• Workspace and AI content: prompts, conversation context, outputs, notes, tasks, reminders, expense amounts/categories/dates, drafts and approval records. We use these to provide requested features and user-authorised actions, including sending necessary context to AI processing services (contract performance). Do not include information you lack permission to share.
• Subscription information: plan, subscription status, transaction references, billing periods and AI usage counts. We use these to administer access, usage limits, support and accounting (contract performance and legal obligations). Paddle processes payment details under its own privacy notice; Nexo does not store full payment-card details.
• Technical and security information: device/browser information, IP addresses where received, request metadata, errors, workflow activity and audit records. We use these to operate and secure the service, diagnose failures and improve reliability (legitimate interests).
• Support messages and privacy requests: information you send when asking for help. We use it to respond and resolve requests (contract performance, legitimate interests and legal obligations, as applicable).

If we introduce optional marketing or non-essential tracking, we will seek consent where required and allow you to withdraw it. Gmail, Calendar and Drive are not currently connected.

We share only necessary data with hosting, authentication, database and operational service providers (including Lovable Cloud), AI processing providers used to generate replies or execute your requested tools, and WhatsApp/Meta for messaging. Prompts and relevant conversation or workspace context may be processed by AI services to fulfil your request.

We share subscription and purchase information with Paddle, our Merchant of Record, for sales, subscription management, payments, tax compliance and invoicing. Paddle acts under its own Privacy Policy.

Data may also be shared with professional legal or accounting advisers where necessary, and authorities when required by law or to protect rights and security. We do not sell your personal data.

Stored conversation messages and raw WhatsApp inbox payloads, linking challenges and attempts older than 30 days are removed by daily cleanup; deletion may occur at the next scheduled run. The 30-day rule does not apply to every workspace or audit record.

Workspace records are retained while needed to provide your account and can be deleted through supported dashboard or WhatsApp actions. Account, subscription, support and audit records are kept only as long as necessary for their purpose, legal obligations, security and dispute resolution. We delete or anonymise personal data when no longer needed; limited copies may persist temporarily in backups or where law requires retention. Contact us to request account-level deletion.

Depending on your country, you may request access, correction, deletion, restriction or portability of personal data, object to processing based on legitimate interests, and withdraw consent where processing relies on it. You may complain to the relevant data protection authority. We verify identity before disclosing or changing account data and respond within applicable legal deadlines; for UK/EEA requests, normally within one month.

For privacy requests or rights-holder complaints, contact Nexochat through Nexo’s WhatsApp Business channel at +1 711-437-2961. Identify your request and account email, but do not send passwords or payment-card details. Automated chat is not a guarantee that a privacy request has been resolved.

We use appropriate technical and organisational measures, including encryption in transit, access controls, account verification and server-side credential handling. No service can guarantee absolute security.

Our service providers may process data outside your country, including outside the UK or EEA. Where UK/EEA data-protection law applies, international transfers require appropriate safeguards, such as applicable adequacy decisions or standard contractual clauses and additional measures where necessary. You can ask us for information about safeguards relevant to your data.

Nexo uses essential browser storage to maintain sign-in sessions and interface preferences. Some interface controls may store an essential preference cookie. These support authentication and expected operation. No optional advertising or analytics-cookie feature is currently configured in the application.

You can clear cookies and local storage or restrict them in your browser settings; this may sign you out or reset preferences. If optional analytics or marketing cookies are introduced, we will update this notice and provide consent choices where required.

We may update this notice when our service or legal obligations change. Material changes will be communicated through the service. The effective date above identifies the current version.