Privacy Policy

1. Two kinds of data, two roles

• Account data about you as a Nexora user (your name, email, phone, business details, billing). For this data we decide how it is used, so we are the Data Fiduciary.
• Customer data your business brings into Nexora: your contacts, their WhatsApp messages, lead details and files. We process it only on your instructions to provide the service, so for this data your business is the Data Fiduciary and we act as your Data Processor. You are responsible for having a lawful basis (such as consent or opt-in) to message your contacts.

2. What we collect

• Account and profile: name, email address, phone number, password (stored only as a secure hash), workspace and team member details.
• Business information: company name, industry, products, prices and policies you enter in the Business Brain so the AI agent can answer for you.
• WhatsApp and messaging data: your connected WhatsApp Business number, contacts (names, phone numbers, tags, custom fields), message content, media, templates, broadcasts, flows and delivery status.
• Leads and integrations: data you sync from connected tools, such as Google Sheets rows, store orders and abandoned carts, and the access tokens needed to keep those connections working.
• Calls: where you use calling, call details such as numbers, time, duration and status.
• Payments: plan, invoices, wallet top-ups and transaction references. Card, UPI and bank details are entered on and stored by our payment gateway (Razorpay); we never see or store full card numbers.
• Usage and device data: log-in times, IP address, browser and device type, pages used, errors, and push-notification subscriptions if you allow alerts.

3. How we use it

• To provide Nexora: send and receive WhatsApp messages, run your AI agent, inbox, broadcasts, flows and follow-ups.
• To create and secure your account, including one-time passwords and fraud prevention.
• To bill you, run the ₹1 trial and autopay, and send receipts and payment reminders.
• To provide support, send service notices and, where you have agreed, product updates (you can opt out of marketing at any time).
• To keep the service reliable, fix problems and improve features, using aggregated or de-identified data where possible.
• To comply with law and respond to valid requests from authorities.

We do not sell personal data, and we do not use your customer data to train AI models for anyone else.

Nexora Leads Finder browser extension

• The extension runs only on Bing Maps pages (bing.com/maps). When you press Start it reads the business listings shown for your search (name, address, phone number, website, category, rating, opening hours and map position) and keeps them in your own browser storage.
• Nothing is sent to us until you press Send to Nexora on the Find leads page. Then the listings go to your own Nexora workspace, where you review them before adding any as contacts.
• The extension does not read your browsing history, other websites, passwords or personal files, has no analytics or advertising, and does not sell or share data with anyone else.
• Uninstalling the extension removes its stored data from your browser.

4. AI features

When the AI agent is on, the relevant conversation, your Business Brain brief and related context are sent to our AI provider (Google Gemini) to write a reply, and optionally to a translation service to detect or translate language. The AI follows the brief you write; it is not retrained on your data. AI replies can be wrong, so review your settings and use the hand-over options to let your team step in.

5. Who we share data with

We share personal data only with service providers that help us run Nexora, under contracts that limit their use of it, and only as much as each needs:

• Meta Platforms (WhatsApp Business Platform) and our WhatsApp Business Solution Provider AiSensy, to send and receive WhatsApp messages and manage templates.
• Google: Gemini (AI replies), Cloud Translation, and Google Sheets when you connect it.
• Razorpay, for payments, autopay and refunds where applicable.
• Twilio, for calling features.
• Resend, for account and service emails.
• Google Analytics and Meta Pixel, on our public website only, for visit statistics and ad measurement.
• Vercel and our cloud database provider, for hosting and storage.

We may also disclose data if required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business (in which case this policy will continue to apply).

6. Where data is stored

Nexora is hosted on servers in Singapore, and some providers above process data in other countries. Where data leaves India we rely on the safeguards the law requires and on providers’ contractual protections.

7. How long we keep it

• Account and customer data: while your account is active. After you close your account we delete or anonymise it within 90 days, unless you ask us to export it first.
• Billing and tax records: as long as Indian tax and accounting law requires (generally 8 years).
• Security logs: up to 12 months.

8. Security

We use encrypted connections (HTTPS), hashed passwords, access controls by role, and provider-level encryption at rest. No system is perfectly secure; if a personal data breach affects you, we will notify you and the authorities as the DPDP Act requires.

9. Cookies and local storage

Inside the Nexora app we use only a strictly necessary session cookie to keep you signed in, and your browser’s local storage for preferences such as theme and layout.

On our public website (the home page, guides, legal pages and sign-up) we may also use Google Analytics to understand visits, and the Meta Pixelto measure and improve our ads on Facebook and Instagram. These set cookies and share visit data (such as pages viewed, clicks on “Start ₹1 trial” or “Try our AI on WhatsApp”, device and approximate location) with Google and Meta. They are never loaded inside the logged-in app. You can block them with your browser’s cookie or tracker settings, or opt out via Google’s Analytics opt-out add-on and Facebook’s ad preferences.

10. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how it is processed;
• ask us to correct, complete, update or erase it;
• withdraw consent you have given (this does not affect processing already done);
• nominate another person to exercise these rights if you die or are unable to;
• raise a grievance with us, and then with the Data Protection Board of India.

Email info@nexorawa.com from the address on your account. We reply within 30 days. If you are a contact of a business that uses Nexora, please contact that business first; we will help them respond.

11. Deleting your data

To delete your Nexora account and its data:

• Email info@nexorawa.com with the subject “Delete my data” from your account email, and include your workspace name.
• We confirm the request, then delete your account, contacts, messages and connected-app tokens within 30 days (backups roll off within a further 30 days).
• Billing records we must keep by law are retained only for that purpose.

Disconnecting your WhatsApp number or Google account inside Nexora stops further syncing immediately.

12. Children

Nexora is a business tool and is not meant for anyone under 18. We do not knowingly collect children’s data.

13. Grievance Officer

For any privacy question or complaint, contact our Grievance Officer, Santhosh, at info@nexorawa.com, or write to Indo Grow, 1/115, Udyog Mandir No. 1, 1st Floor, B.K. Road, 7/C Pitamber Lane, Mahim (W), Mumbai - 400016, Maharashtra, India. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

14. Changes to this policy

We may update this policy as Nexora changes. We will post the new version here with a new date, and tell you by email or in the app before significant changes take effect. See also our Terms of Service.