1. What we collect

• Account data: name, email, password (hashed), and company profile information provided when a Customer registers.
• Business content: data a Customer enters or uploads to configure their AI employees — company description, product/service knowledge, pricing, and similar operational content.
• Conversation data: messages exchanged between a Customer's End Users and their AI employees over connected channels (WhatsApp Business Platform, Instagram, email), including message text, timestamps, and sender contact identifiers (phone number, email address, or platform-scoped ID), so a conversation can be answered and its history kept.
• Records created from conversations: leads, appointments, quotes, and support tickets that a Customer's AI employee creates as a result of a real conversation.
• Usage data: feature usage, message volume, and error logs used to operate and improve the platform.

2. How we use it

Data is used to operate the platform a Customer configured: generating and sending replies, booking appointments, tracking leads and deals, drafting quotes, and surfacing operational insights back to the Customer. We do not sell personal data, and we do not use End User conversation data to train third-party foundation models.

3. Third-party processors

To provide these features, relevant data is processed by:

• Anthropic (Claude API) — to generate AI replies, summaries, and analysis from conversation and business content.
• Meta Platforms, Inc. — WhatsApp Business Platform and Instagram, when a Customer connects those channels, to send and receive messages on the Customer's behalf.
• Google LLC — for "Continue with Google" sign-in, when used.
• Resend — for transactional and connected-inbox email sending.
• Tavily — for real web-search grounding used by market-intelligence features (this processes search queries, not End User conversation content).
• Cloudflare — for R2 object storage of uploaded media, and for the network layer in front of the platform (DNS, TLS termination, and the secure tunnel that carries traffic to it). The application and its database run on infrastructure operated by NEXORA itself, not on a third-party application host.

Each provider processes data solely to deliver the feature it powers, under its own data-processing terms.

4. Data retention

Data is retained for as long as a Customer's account is active, so conversation history and business records remain usable. A Customer or End User may request deletion as described below; deleted data is removed from active systems and any remaining backups age out on our standard backup cycle.

5. Your rights

You may request access to, correction of, or deletion of your personal data by contacting us at [email protected]. An End User who no longer wants to be contacted by a Customer's AI employee can also simply say so in the conversation, or contact that business directly — NEXORA acts as the messaging processor on the Customer's behalf, and the Customer remains the data controller for its own End User relationships.

6. Security

Passwords are hashed, secrets and access tokens are stored server-side and never exposed to the browser, and access to Customer data is scoped to that Customer's own account.

7. Contact

Questions about this policy: [email protected].