Privacy Policy
Last updated: [DATE]
This policy explains how Nexource SRL handles personal data about you when you visit nxr.ai, contact us, create an account, or use the Hosted Service as a customer.
1. Who we are
The controller of your personal data is:
Nexource SRL Baia Mare, Romania Trade register number J2003000263246 Tax identification code RO15281435 Email: [privacy@nxr.ai]
2. What this policy covers — and what it doesn't
This policy covers personal data we decide how to use: data about website visitors, people who contact us, account holders, Editors, and billing contacts.
It does not cover the data our customers store in the Apps they build on nxr.ai — for example, their clients' contact details, invoices, or course participants' records. For that data, our customer is the controller and we act only as their processor, under our Data Processing Agreement at [nxr.ai/dpa]. If your data is held in an App built by one of our customers, contact that customer to exercise your rights.
This policy also does not cover the self-hosted version of nxr.ai. When you run the software yourself, we receive no personal data from your installation [unless you enable optional telemetry — describe, or delete this clause].
3. What we collect and why
Visiting our website
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser and device information, pages visited | Operating and securing the website | Our legitimate interest in running a secure website (Art. 6(1)(f) GDPR) |
| Aggregated, cookieless analytics collected through Clicky in its privacy-friendly mode: pages visited, referring site, browser and device type, approximate country | Understanding how the website is used, so we can improve it | Our legitimate interest in understanding and improving our website (Art. 6(1)(f)) |
Contacting us
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, company, phone number, and the content of your message | Responding to your enquiry and, where relevant, discussing a commercial relationship | Steps taken at your request before entering into a contract (Art. 6(1)(b)), or our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
Creating an account and using the Hosted Service
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, password (stored hashed) | Creating and securing your account | Performance of our contract with you (Art. 6(1)(b)) |
| Account activity: login times, feature usage, errors | Operating, securing, supporting and improving the service | Performance of contract (Art. 6(1)(b)) and our legitimate interest in improving the service (Art. 6(1)(f)) |
| App Structure: table and field names, relationships, role names, screen and template configuration — not the data values inside them | Improving AI suggestions for all customers | Our legitimate interest in improving the service (Art. 6(1)(f)). You can opt out at any time — see section 9 |
| Support conversations | Resolving your requests | Performance of contract (Art. 6(1)(b)) |
Paying for the service
| Data | Purpose | Legal basis |
|---|---|---|
| Billing name, company, address, VAT number, invoices and payment history | Billing, invoicing and accounting | Performance of contract (Art. 6(1)(b)) and compliance with tax and accounting law (Art. 6(1)(c)) |
We do not store full payment card details. Card payments are processed by [payment provider].
Marketing
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Sending product updates and news | Your consent (Art. 6(1)(a)), or, for existing customers, our legitimate interest in telling you about similar services (Art. 6(1)(f)). You can unsubscribe at any time using the link in every email |
4. AI processing and training
We do not use your personal data, or any data stored in your Apps, to train artificial intelligence models, and our AI provider does not use it to train theirs.
When AI features of the Hosted Service are used, the relevant content is sent to our AI provider, Anthropic PBC, through the Claude API, solely to generate the requested output. Details of this processing, including retention and transfer safeguards, are set out in our Data Processing Agreement.
5. Who we share your data with
We do not sell your personal data, and we do not share it with third parties for their own marketing.
We share personal data only with:
- Service providers who process it on our behalf, under contracts requiring them to protect it and use it only on our instructions:
- Amazon Web Services — hosting and storage
- Anthropic PBC — AI features
- [Payment provider] — payment processing
- Twilio Inc. (SendGrid) — sending account, transactional and notification emails
- Google Ireland Limited (Google Workspace) — our company email
- Roxr Software Ltd (Clicky) — cookieless website analytics
- [Any other tools — e.g. support or error monitoring]
- Professional advisers such as accountants and lawyers, under confidentiality obligations.
- Public authorities, where required by law.
- A buyer or successor, if we are involved in a merger, acquisition or sale of assets, in which case we will notify you.
6. International transfers
We store data in [the European Union — AWS eu-central-1 (Frankfurt)].
Some of our service providers process data outside the European Economic Area, in particular in the United States. Where this happens, we rely on an appropriate safeguard: an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it, or the European Commission's Standard Contractual Clauses. You can request details of the safeguard for a particular transfer by contacting us.
7. Cookies, analytics and spam protection
Essential cookies. We use cookies necessary for the website and the Hosted Service to work, such as keeping you logged in. These do not require consent.
Analytics. We use Clicky, provided by Roxr Software Ltd, in its privacy-friendly mode to understand how visitors use our website. In this mode Clicky sets no cookies and does not track you as an individual; we see only aggregated information such as which pages are popular and where visitors come from. Because no cookies are set and no personal profile is built, we do not ask for consent. You can object to this processing at any time by contacting us (see section 9).
Spam protection. Our forms are protected by a self-hosted mechanism that runs a small computation in your browser. It sets no cookies, involves no third party, and sends no personal data outside our own servers.
8. How long we keep your data
| Data | Retention |
|---|---|
| Enquiries that don't lead to a contract | [12 months] after last contact |
| Account data | For the life of your account, then deleted within [30] days of account closure after the export period |
| Account activity and security logs | [90 days / 12 months] |
| Website analytics (Clicky) | [Set in Clicky's data retention settings — specify] |
| App Structure used for product improvement | [specify — or until you opt out] |
| Billing and invoice records | As required by Romanian accounting and tax law — [currently 5 / 10 years; verify with your accountant] |
| Marketing consent and preferences | Until you unsubscribe, plus a record of your opt-out so we don't contact you again |
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data, where there is no legal reason for us to keep it;
- restrict our processing in certain circumstances;
- receive your data in a portable format, and have it transmitted to another controller;
- object to processing based on our legitimate interests — including the use of your App Structure for product improvement — and to direct marketing at any time;
- withdraw consent at any time, where we rely on consent, without affecting processing that took place before.
To exercise any of these rights, email [privacy@nxr.ai]. We will respond within one month.
You also have the right to complain to a data protection supervisory authority. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro. You may also complain to the authority in the EU country where you live or work.
10. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, including encryption in transit, access controls, and restricting access to personnel who need it. A description of our measures is included in our Data Processing Agreement.
11. Children
The Hosted Service is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 16.
12. Changes to this policy
We will update this policy when our practices change. The date at the top shows when it was last updated. Where changes are significant, we will notify account holders by email.
13. Contact
Questions about this policy or your personal data: [privacy@nxr.ai]
Nexource SRL, Baia Mare, Romania