Privacy Policy

Version 6.0 · Effective October 20, 2026

This Privacy Policy ("Policy") describes how Nxera Digital LLC ("Nxera," "we," "us," "our") collects, uses, discloses, retains, and safeguards information about clients, prospective clients who request a free competitive scan, the customers and plan members of our clients, website visitors, and other individuals (collectively, "you") in connection with: getnxera.com and all of its subdomains; the plan pages and member pages Nxera hosts in a client's name at getnxera.com/m/ and on custom domains (each, a "Plan Page"); the Nxera client portal and the Nxera owner app for iPhone and Android, which are the same service; Nxera's follow-ups, maintenance plans, and Texts; and any related platforms, applications, communications, and APIs (collectively, the "Services").

This Policy is incorporated by reference into the Nxera Terms of Service (the "Terms"). Capitalized terms not defined here have the meanings given in the Terms. This Policy is supplemented by the Cookie Policy (cookies and tracking technologies) and the Data Processing Addendum (B2B Processor obligations).

By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree, do not use the Services.

1. Scope and Roles

1.1 Information We Collect About You as a Client

For Nxera Clients, Nxera acts as a "controller" (or "business" under the CCPA/CPRA) of Personal Data we collect about the Client and its authorized representatives (for example your name, email, business address, payment data, and portal usage).

1.2 Information You Provide About Others

For information about other people that you provide to Nxera (your customer list and consent records, service histories, visit logs, and the records of members who enroll in your plans), Nxera acts as a "processor" (or "service provider" under the CCPA/CPRA) acting on the Client's documented instructions. The Data Processing Addendum applies to that Processing. You represent that you have a lawful basis to provide that information to Nxera.

1.3 Information We Collect About Scan Requesters

When you request the free competitive scan, Nxera acts as a controller of the business and contact details you submit and of the scan results, and may use them to follow up with you about the scan and the Services as described in Section 3.

1.4 Information We Collect on Plan Pages

A Plan Page is shown in the Client's name. Information a member or visitor enters on a Plan Page (enrollment details, messages, photos, visit requests) is collected on behalf of the Client operating that page. The Client is the controller of that data; Nxera is the processor. Members should consult the Client's own privacy notice for anything beyond what this Policy describes.

2. Information We Collect

2.1 Information You Provide Directly

Account and contact data: business name, contact name, email, phone, mailing address, time zone, language preference.
Business profile data: trade, services, service area, hours, logo, brand colors, Google review link, plan page copy, and anything you enter in your intake.
Payment data: if you buy Texts, payment method information processed by Stripe, Inc. on Nxera's own Stripe account. Nxera does not store full card numbers; Nxera receives and stores only the brand, last four digits, expiration, a Stripe customer or payment-method ID, and the Texts subscription's ID, status, and billing period. Nxera's app sells nothing and has no in-app purchases.
Texting registration data: if you buy Texts, the details the carriers require to register your business: legal business name, address, website, and the name, email, and phone of the person authorized for the business, or, for a sole proprietor, a mobile number. Nxera keeps them with your account and sends them to the texting provider for the carrier registration. An EIN you type goes to the texting provider and is not stored by Nxera.
Communications: the content of emails, portal messages, support requests, change requests, and other messages you send to Nxera or its AI assistant.
Customer data you provide about others: names, emails, phone numbers, service addresses, first and last service dates, service types, notes, tags, and the consent basis and attestation you record when you import or add a contact, including the consent each customer gave to texts.
Visit logs: the visits you log for a customer, with date, service type, and notes.
Business knowledge: the services, pricing notes, policies, and seasonal reminders you save so drafted messages are accurate.
Text message and WhatsApp consent records: when you, as a client, agree to get texts or WhatsApp messages from Nxera, we record the number, the date and time, the exact consent wording shown to you and its version, how you agreed, and the IP address and browser used. When a member ticks a text or WhatsApp box on a Plan Page or on their member page, we record the number, the date and time, the exact wording shown (with the business's name) and its version, and where the box was ticked. These records are append-only and are never edited, except that the number or address is replaced by a keyed hash, and the IP address and browser details are removed, when the related data is deleted.

2.2 Information Collected Automatically

Device and connection data: IP address, device identifiers, browser type and version, operating system, screen size, language, referring URL.
Usage data: pages visited, features used, links clicked, timestamps, session length, navigation paths, and portal actions such as approving, editing, vetoing, or rescheduling a message.
Website analytics: Google Analytics 4, loaded through Google Tag Manager, on getnxera.com marketing pages and on the account, intake, report, unsubscribe, welcome, status, and newsletter pages, but not on Plan Pages, member pages, or the client portal; and Vercel Web Analytics, which counts page views without cookies, on pages that use the site's main layout. Nxera reads aggregated GA4 reports through the Google Analytics Data API. Details are in the Cookie Policy.
Product analytics (PostHog), only when switched on: PostHog is off today. When Nxera switches it on, it records page views and named events; on marketing pages it also records sessions with every form input masked; in the client portal it records sessions with all text and attributes masked and images, video, and embedded frames blocked; on Plan Pages and member pages it records no sessions and keeps its data in session storage only. It does not load when your browser sends the Global Privacy Control signal.
Bot protection: Cloudflare Turnstile runs on our forms and records a challenge result; it may process your IP address and browser signals to distinguish people from bots.
Error reports: Sentry receives error reports and a sample of performance traces (about one page load in ten) from every getnxera.com page, including Plan Pages and the client portal, and error reports from the Nxera owner app. A report may include the page or screen, the browser or device, the app version, and the IP address at the time of an error, together with crash and performance diagnostics from the app.
Cookies and similar technologies: as described in the Cookie Policy.
Message delivery data: for each Customer Message sent in a Client's name, delivery, bounce, complaint, and unsubscribe events reported by our email provider, and delivery, failure, and opt-out events reported by the text or WhatsApp provider when those channels are switched on. Nxera records opens and clicks only for its own outreach emails to businesses and prospects; it does not use opens of mail sent in a Client's name for anything.

2.3 Free Competitive Scan Data

When a business requests the free competitive scan we collect the business name, city, state, trade, website, and contact email and phone submitted with the request, and we generate scan data: what third-party AI platforms (Anthropic Claude, OpenAI ChatGPT, and Google Gemini) answered when asked customer-style questions about that trade in that market, which businesses they named, public listing details for the named businesses (Google Places), and a screenshot of the requester's public website. Scan requests and results are stored as lead records. The scan form does not currently ask for consent to text messages.

2.4 Information from Third Parties

Public data sources: Google Places (business listings and public reviews), Yelp business listings, publicly available web pages, public YouTube channel data, and creator listings from Apify, used to build the free scan and to find businesses and creators who may want to hear from Nxera.
Google Business Profile: when a client connects its Business Profile, Google gives Nxera an access grant for that profile. The grant is kept in an encrypted vault and is revoked when the business is deleted.
Payment processor: Stripe (transaction status, fraud signals, basic card metadata; for maintenance plans, the connected-account status of your own Stripe account, and for each member payment, the Plan Payment Fee Stripe took for Nxera and the payment's reference).
Email provider: Resend (delivery, bounce, and complaint metadata, and open and click events for Nxera's own outreach emails).
AI platforms (OpenAI ChatGPT and Google Gemini): AI-generated responses to trade and market questions, used for the free scan and for Nxera's own research questions. These are API responses, not user conversations.
AI assistant provider: Anthropic (Claude), which drafts messages and plan designs, answers the client, sorts and summarizes incoming customer and member messages, checks drafts for review incentives, writes the morning briefing, and asks questions in the free scan. What Anthropic and the other AI providers may do with that data is described in Section 4.11.
Email verification: ZeroBounce (deliverability status of an email address), used only for Nxera's own outreach to businesses.
Text and WhatsApp providers, when switched on: delivery, failure, and opt-out events, and replies, reported by Twilio, Telnyx, or Meta (WhatsApp).

2.5 Sensitive Categories

You agree not to provide Nxera with sensitive personal data, including health, biometric, government identifier, financial-account, sexual-orientation, religious, trade-union, criminal, or children's data, except as expressly authorized in writing by Nxera. We do not knowingly request or rely on sensitive data and we are not responsible for safeguards specific to such data unless explicitly agreed. The one exception we handle is a business's federal tax ID (EIN) for text-message registration: the client types it on the registration page, it goes to the texting provider for the brand registration, and Nxera never stores it. If an EIN or anything that looks like a tax ID is typed into the assistant chat, the assistant removes it before the message is stored or read.

2.6 Children

The Services are intended for adults (18+). Nxera does not knowingly collect Personal Data from individuals under 18. If you believe a minor has provided us Personal Data, contact info@getnxera.com and we will delete it.

2.7 Client-Provided Customer Data

Our business clients upload customer contact information (names, email addresses, phone numbers, service addresses, and service history) so we can send follow-up in their name. We process this data solely to provide those services, under the client's instructions. Every message Nxera drafts to a customer on the client's list is sent only after the client approves it, and a draft not approved by its time expires unsent (Section 4.10). The client is responsible for having a lawful basis to contact these individuals and records that basis when the contact is added. A customer's unsubscribe stops that client's marketing email to that customer. We send any one person at most one marketing or follow-up message from a client every 48 hours across email, text, and WhatsApp, apply the client's monthly cap per customer (2 by default), and do not release drafts between 8 PM and 8 AM in the client's time zone. We delete client-provided contact data when the client asks, and automatically once thirty (30) days have passed after the Services end for the client; the automatic deletion runs weekly, so it completes within thirty-seven (37) days of the end. A one-way fingerprint of any unsubscribed address is kept so the opt-out continues to be honored, and consent and opt-out records are kept with the address hashed as described in Section 5.

2.8 Member Data

When a customer enrolls in a client's service plan through a Plan Page, we collect the member's name, email, phone, service address, plan selection, language preference, marketing consent choice, text and WhatsApp consent choices, and the Stripe customer and subscription identifiers created on the client's own Stripe account. During the plan we also collect the member's messages to the client, photos the member chooses to attach, visit requests and confirmations, renewal and payment status events reported by Stripe, and the member's unsubscribe choices. We process member data as the client's processor, to run the plan and to send plan-related messages in the client's name; some of those messages are sent without per-message approval, as listed in Section 4.10. Members can update their details, request visits, and manage marketing email and their text and WhatsApp choices from their member page. When the Services end for a client, we delete its members' data, including messages, photos and attachments, visit requests, visits, plan events and the member record, within thirty-seven (37) days of the end. The exception is a member whose plan the client still bills on the client's own Stripe account: that member's record is kept until the billing ends. A one-way fingerprint of any member who unsubscribed is kept so the opt-out continues to be honored.

2.9 The Nxera Owner App

If you use the Nxera app for iPhone or Android, we also collect an install identifier the app creates for itself (not your phone's advertising identifier), your device model and app version, which label your signed-in sessions, and the push notification token your phone issues, so we can tell you about new messages, visit requests and drafts waiting for your review. Push notifications are sent through Expo; by default they carry generic words, and they include a customer's or member's name or words from their message only if you turn on "Show names on the lock screen." You can turn notifications off in your phone's settings. The app sells nothing and has no in-app purchases, so no store purchase data reaches Nxera. Face ID, Touch ID and fingerprint unlock run on your phone, and the app receives only whether the unlock succeeded. Apart from a logo and any business documents you choose to upload, the app sends only the business, customer and member information you enter, the same information the portal at getnxera.com holds.

3. How We Use Information

We use information for purposes including:

(a) Service delivery: drafting, scheduling, and sending Customer Messages in a client's name; designing plans and hosting Plan Pages; enrolling members and operating renewals, visit reminders, and failed-payment follow-up; providing customer support. (b) Account management: creating and maintaining your account, verifying identity at sign-in (your password, and the links we email to set or reset it), communicating with you about your account, and sending the briefings and review digests your settings call for. (c) Billing and fraud prevention: processing payments, retrying failed payments, detecting and preventing fraud, enforcing the Terms. (d) Transactional and operational communications: sending you receipts, billing notices, setup emails, portal claim links, review digests, security alerts, scheduled-maintenance announcements, legal notices, and similar messages. (e) Free scan and follow-up: producing the free competitive scan you requested, delivering the report, and following up about the scan and the Services by email; you can unsubscribe from follow-up at any time. (f) Marketing communications: sending product updates and other marketing content to clients and scan requesters (you can unsubscribe at any time using the link in those messages). (g) Product improvement: analyzing usage to improve features, performance, and stability. No AI model is trained on your data. (h) Analytics and reporting: generating internal analytics from GA4, Vercel Web Analytics, PostHog when it is switched on, and portal usage, and the counts shown in your portal. (i) Legal compliance: complying with legal obligations, responding to lawful requests, defending Nxera's legal rights, enforcing the Terms. (j) Business operations: corporate development, audits, financial planning, accounting, tax compliance, insurance. (k) Text messages and WhatsApp: sending texts and WhatsApp messages in a client's name, including by automated means, only to people who gave the consent described in Section 4.9, and Nxera's own texts to clients who agreed to them; and sending the automatic replies required when someone texts HELP or STOP. Consent to texts is never a condition of buying anything. Message frequency varies. Message and data rates may apply.

We process information based on the following lawful grounds (where required by law): performance of contract, our legitimate interests (operating the business, security, fraud prevention, product improvement), your consent (where applicable, for example marketing emails in some jurisdictions, text and WhatsApp messages, and the marketing choice a member makes at enrollment), and compliance with legal obligation.

4. How We Share Information

We share information only as described below. We do not sell or share Personal Data for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

4.1 Sub-processors / Service Providers

We share information with third-party providers who perform services on our behalf and are bound by contract to use the information only for those services and consistent with our instructions. The current list is published at getnxera.com/sub-processors and in the Data Processing Addendum. It names: Supabase (database, file storage, and serverless functions), Vercel (website hosting and Vercel Web Analytics), Stripe (billing for Texts, and member payments on the client's own Stripe account through Stripe Connect, with the Plan Payment Fee), Resend (email), Anthropic (the AI assistant), OpenAI (scan questions), Google (Places business listings and public reviews, the Business Profile connection, PageSpeed and Knowledge Graph lookups, Gemini for scan questions, Tag Manager and Analytics, and font delivery), Cloudflare (the Turnstile bot check and DNS lookups for domain checks), Sentry (error reports), Expo (app push notifications), ZeroBounce (email checks for Nxera's own outreach), Yelp (business listing lookups, business names only), Lob (postcards; its functions exist but no schedule runs them today), PostHog (used when switched on), and Twilio, Telnyx, and Meta (used when texting or WhatsApp is switched on).

4.2 Recipients of Customer Messages

When a Customer Message is sent, the client's business name and the content of the message appear in that message by design, and the recipient sees the content the client authorized. Email to plan members comes from the client's verified domain when it has one, and otherwise from Nxera's sending domain, in the client's name. Every marketing email carries the client's name and postal address and a visible one-click unsubscribe for that client; transactional member notices (receipts, failed-payment notices, the renewal notice, and confirmations) carry no unsubscribe link.

4.3 Public Display on Plan Pages

Information a client provides for display on its Plan Page (business name, plan names, prices, inclusions, page copy, and brand) is publicly visible to anyone who visits the page. Member data is never displayed publicly. Google reviews shown on a client's website are titled "Selected reviews from Google" and show the true Google rating and review count with a link to every review. Nxera serves no client websites while site building is paused (since October 2026).

4.4 Stripe and the Client's Own Stripe Account

For maintenance plans, a member's enrollment and payment details are processed by Stripe on the client's own Stripe account. The client, as a Stripe account holder, can see its members' payment records in Stripe under Stripe's privacy terms. Stripe takes the Plan Payment Fee for Nxera from each payment; Nxera receives the fee's amount and the payment's reference, not the member's card.

4.5 Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to: (a) comply with applicable law, regulation, court order, or other legal process; (b) protect the rights, property, or safety of Nxera, our Clients, or any third party; (c) detect, prevent, or address fraud, security, or technical issues; (d) defend against legal claims.

4.6 Business Transfers

In the event of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred to the successor or acquirer. We will require any successor to honor this Policy or provide notice and choices.

4.7 With Your Consent

We may share information for any other purpose with your express consent.

4.8 No Sale; No Cross-Context Behavioral Advertising

We do not sell Personal Data for money or other valuable consideration. We do not share Personal Data for cross-context behavioral advertising. If we ever change this practice, we will provide notice and a meaningful opportunity to opt out before the change takes effect.

4.9 Text Messages and WhatsApp

Texts are a paid add-on a client buys on the website (Section 24.9 of the Terms); WhatsApp costs the client nothing from Nxera, and Meta bills the client for its message fees. Both are sent in the client's name, from the client's own registered text number or WhatsApp sender, and only after the client's registration is approved and Nxera has switched texting on for it. Today texting and WhatsApp are switched off for every client. Each month Nxera counts the texts a client's number sent and received, to bill texts over the included number; the count is kept with the client's account.

Consent: members tick separate, unticked boxes for texts and for WhatsApp when they sign up or on their member page. The wording names the business and says that messages may be sent by automated means, that frequency varies, that message and data rates may apply, how to use STOP and HELP, that consent is not a condition of purchase, and where this Policy is; the version and exact text are stored with the consent. For an imported customer list, the client states the consent each customer gave. Marketing texts need written consent, and a number given only for service updates is used only for service texts.
Stopping: replying STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE, OPTOUT, or the Spanish ALTO, PARAR, BAJA, CANCELAR, or DETENER) stops texts from that business; STOP ALL stops its texts and its WhatsApp messages. A plain request to stop, in English or Spanish, such as "stop texting me," counts too. One confirmation is sent and the client is told. START restarts messages. HELP answers with the business's name and contact details.
Timing and limits: marketing texts are sent only between 8 AM and 8 PM both in the client's time zone and in every time zone the recipient's area code can be in, and no number gets more than 3 marketing messages from one business in 24 hours. Every marketing text ends with "Reply STOP to opt out." Marketing WhatsApp messages are not sent to U.S. (+1) numbers.
Nxera's own texts to clients: the morning briefing, decisions waiting for you, and verification codes reach you by text or WhatsApp only after you agree on the number, with your IP address and browser recorded.
Providers: when texting or WhatsApp is switched on, Twilio (texts and carrier registration), Telnyx (texts and carrier registration, as an alternative to Twilio), and Meta (WhatsApp) receive the mobile number and the message content solely to deliver the message, and are bound by contract to use them for nothing else. They are named in the sub-processor list at getnxera.com/sub-processors.

We do not sell, rent, or share mobile numbers or text-message consent records with third parties or affiliates for their own marketing. Mobile numbers collected for text messaging are disclosed to no one other than the providers that deliver the message. Carriers are not liable for delayed or undelivered messages.

4.10 Approval First, and What Sends Without Approval

Every message Nxera drafts to a customer on a client's list (automations and the assistant's drafts) is sent only after the client approves it. A draft not approved by its time expires unsent. The client sets the approval window between 1 and 168 hours (24 by default), and review cannot be turned off. Every message the assistant drafts to members, every message to all members, offers and coupons, review requests, plan and price changes, and publishing also need the client's yes.

These messages are sent without per-message approval, and this is why:

Payment receipts to members, because they describe a charge the member already made.
The welcome mail when someone joins a plan, because it confirms the purchase and gives the member their page.
Failed-payment notices to members on day 1, 4, and 10 after a failed charge, because they tell the member their card did not go through.
The yearly renewal notice for annual plans, about 30 to 45 days before renewal, because Florida law (Fla. Stat. 501.165) requires it; no pause holds it.
Confirmations of what a member did themselves: a visit request received, a visit they booked, a cancellation or a decision to keep the plan, and a new sign-in link they asked for.
The automatic "we got your message" note when a member writes, which is on unless the client switches it off in Follow-ups, then We got your message.
The member's notice after the client answers a visit request, because the client's answer is the approval.
Replies to STOP and HELP texts, because carrier rules require them.
Visit reminders and the note before a member cancels, but only if the client ticks "Send visit reminders and the note before a member cancels without asking me." Otherwise each one waits for the client's yes.

A review request goes after each logged visit while that automation is on. The client may skip one only for a reason that is not about the customer's satisfaction (the customer asked not to be contacted, no visit happened, or it is a duplicate), and the reason is recorded. No review request can carry an incentive.

4.11 AI Providers

Anthropic (Claude) drafts messages and plan designs, answers the client, sorts and summarizes incoming customer and member messages, checks drafts for review incentives, writes the morning briefing, and asks questions in the free scan. OpenAI and Google (Gemini) are asked the scan's questions and Nxera's own research questions. They receive the business's facts, the message context, and the customer names and message text needed for the task.

Anthropic: under Anthropic's Commercial Terms (effective June 17, 2025), Section B, "Anthropic may not train models on Customer Content from Services." API inputs and outputs are deleted within 30 days, or kept up to 2 years if flagged for a usage-policy violation.
OpenAI: API data is not used to train models unless the customer opts in, and abuse-monitoring logs are kept up to 30 days.
Google Gemini API (paid services): prompts and responses are not used to improve Google products, and are logged for a limited time only to detect abuse.

Nxera does not opt in to any training. The facts Nxera keeps about a business are used only for that business and never train any model. Nothing the assistant does sends, charges, refunds, changes a live price, publishes, or deletes on its own: it saves facts the client told it, and anything else is a card the client confirms. The assistant answers at most 60 turns an hour and 300 a day for each business, within a spending cap for each business.

5. Data Retention

We retain Personal Data for as long as necessary to fulfill the purposes described in this Policy, including:

Active account data: while your account is open.
Unclaimed accounts: an account whose password is not set within fourteen (14) days of sign-up is deleted, with everything in it.
Billing and tax data: kept after your account is deleted, as required for tax and audit purposes. Stripe keeps its own billing records.
Customer Content, client-provided customer data, and member data: while your account is open and for thirty (30) days after the Services end for you, then deleted by a weekly job, so within thirty-seven (37) days of the end (sections 2.7 and 2.8). Export before then. Clients can delete their customer list from the portal at any time. A request by email to info@getnxera.com is completed within thirty (30) days. A keyed hash of any unsubscribed address (a code we can match against an address but cannot turn back into one) is kept after deletion so the opt-out continues to be honored.
Download everything: while your account is open, Download everything (Settings, then Your data, on the web or in the app) builds a file of your customers, members, plans, messages, decisions, the assistant's memory, consent records, and the activity log, and emails you a link to it that works once and expires after 24 hours. Billing records stay with Stripe. Photos, documents, and the logo are not in the file; we send them on request.
Delete everything: Delete everything (Settings, then Your data, on the web or in the app) is scheduled seven (7) days ahead, and you can cancel it during those days. Then everything is deleted except: payment and tax records; Nxera's send ledger (the subject and date of each email, with the address replaced by a keyed hash); the entries on our bounce, complaint, and unsubscribe suppression lists, with the address or number replaced by a keyed hash; and consent and opt-out records with the address or number replaced by a keyed hash, as described below. You can also delete your Nxera account in the app (Settings, then Account), with the same seven-day window.
Free scan and lead data: deleted twenty-four (24) months after the scan request, unless the requester became a client.
Customer Message content and delivery events: while your account is open and afterwards, so clients can review what was sent and so Nxera can show that its sending followed the law. Message content is deleted with the customer list, when a client asks or after the Services end as above; the send record is retained as a compliance record.
Reports: monthly and scan reports are kept in a private storage area and open only through a signed link that expires after 30 days.
Marketing and contact data: until you opt out, after which we retain a minimal suppression record to honor your opt-out.
Backups: our infrastructure providers keep rolling backups on their own schedules, and these are overwritten over time.
Logs: entries in Nxera's activity log older than twenty-four (24) months are deleted, except compliance records (data requests, consent, suppression, and deletion receipts).
Assistant conversations and decision history: messages between you and the assistant (in the portal, the app, by text or by WhatsApp) and the history of each decision card (when it was proposed, approved, edited, skipped or expired) are deleted twenty-four (24) months after they are written. Decision cards themselves, and the facts the assistant keeps about your business (its memory), are kept while your account is open and deleted with it.
Consent and opt-out records: consent and opt-out records of customers and members, and the consent records of clients and scan requesters, are kept while the related data is held. When that data is deleted, each record is kept with the number or address replaced by a keyed hash (a code we can match against a number or address but cannot turn back into one; the key is held only in our database vault) and with the IP address and browser details removed. What remains is the date and time, the wording that was shown and its version, how consent or the opt-out was given, and the keyed hash. These records are deleted four (4) years after the deletion of the related data.
Text and WhatsApp STOP lists kept by a business: a STOP a customer or member sends to a business is kept while that business is a client, with the number replaced by the keyed hash once that person's data is deleted, so STOP keeps being honored if the person is added again; it is deleted four (4) years after the business is deleted.
Texts and texting registration: the monthly count of texts and the registration details are kept while Texts or your account last; when Texts end, Nxera releases the number and deletes the carrier campaign, and the brand registration stays registered under Nxera's account with the texting provider. Everything is deleted with your account; the charges stay in Stripe's billing records.
Payment provider event records: the full content of each event Stripe sends us (a webhook payload, which can carry a name, email, and the last digits of a card) is deleted ninety (90) days after it is received; the record that the event happened, with its type and reference, is kept twenty-four (24) months.
Incoming text and WhatsApp messages: the text of a message a customer or member sends to a business, and any attachment, is deleted twenty-four (24) months after it is received, unless a legal hold keeps it longer.
Text and WhatsApp send ledger: the record of each text or WhatsApp message sent (the number, the business, the date and time, the template used, and the delivery status) is kept four (4) years; the number in it is replaced by the keyed hash once that person's data is deleted. The provider's delivery and read receipts behind it are deleted after ninety (90) days.
Nxera's own opt-out lists: an opt-out from Nxera's own email or text messages does not lapse. Once your data is deleted, the address or number on that list is replaced by the keyed hash, and the entry is kept for as long as Nxera operates so you are never mailed or texted by mistake.

When we no longer need Personal Data, we will delete or de-identify it, except where retention is required by law, necessary for legal claims, or otherwise within an exception in this Policy.

6. Your Rights and Choices

Depending on your jurisdiction, you may have rights regarding your Personal Data.

6.1 Universal Rights

You may always:

Update your account information through the portal or by emailing info@getnxera.com.
Delete everything with Delete everything (Settings, then Your data, on the web or in the app) or your account in the Nxera app (Settings, then Account), each of which runs after a seven-day window you can cancel, or by emailing info@getnxera.com.
Unsubscribe from marketing communications using the link in any marketing email. Transactional and account messages cannot be unsubscribed from while you remain a Client.
Stop follow-up about a free scan using the unsubscribe link in any scan email.
As a member of a client's plan, update your details, manage marketing email and your text and WhatsApp choices, or ask the client to close your plan from your member page; you may also contact info@getnxera.com and we will route your request to the client.
Download your data with Download everything (Settings, then Your data), as described in Section 5.
Stop text messages at any time by any reasonable means. Replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE, or OPTOUT (or ALTO, PARAR, BAJA, CANCELAR, or DETENER) to any text always works, STOP ALL also stops WhatsApp messages, a plain request such as "stop texting me" in English or Spanish works, and so does an email to info@getnxera.com. Reply HELP to any text for help.

6.2 California (CCPA/CPRA)

California residents have rights to: (a) know the categories and specific pieces of Personal Data we have collected about you, the sources, the purposes, and the categories of recipients; (b) delete Personal Data, subject to legal exceptions; (c) correct inaccurate Personal Data; (d) opt out of sale or sharing (we do not sell or share, but the opt-out right exists); (e) limit use of sensitive personal information (we do not knowingly collect sensitive personal information for purposes that would trigger this right); (f) non-discrimination for exercising these rights.

To exercise CCPA rights, email info@getnxera.com with subject line "CCPA Request" and your account email and a description of the request. We will verify your identity (typically via the email on file) before fulfilling the request. We will respond within 45 days, with a possible extension as permitted by law. You may designate an authorized agent in writing. Where we hold your data as a client's processor, we will forward the request to the client and assist it in responding.

6.3 Other US States

We extend equivalent rights (access, deletion, correction, portability, opt-out of sale/sharing) to residents of all U.S. states with applicable comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, Rhode Island, and any others as they take effect). Same email contact and procedure as Section 6.2.

6.4 International Rights (Future)

Nxera currently provides Services to U.S. clients. If we expand internationally, we will publish jurisdiction-specific rights and procedures (including GDPR rights for the EU/UK and PIPEDA rights for Canada) at that time. We will not enroll non-U.S. clients before those procedures are in place.

6.5 Limits and Exceptions

We may decline a request where: (a) we cannot verify your identity; (b) the request is excessive, repetitive, or manifestly unfounded; (c) fulfilling the request would violate a legal obligation, infringe another person's rights, or compromise an active investigation; (d) the data is necessary to complete a transaction, protect against fraud, comply with law, or for our legitimate business interests as permitted by law. We will explain any denial in writing.

7. Cookies and Similar Technologies

See the Cookie Policy for details on cookies and tracking technologies, including the strictly-necessary, functional, and analytics cookies and storage we use (including Google Analytics 4 through Google Tag Manager, Vercel Web Analytics, and PostHog when it is switched on), and your choices.

We do not currently respond to "Do Not Track" browser signals because there is no industry consensus on how to interpret them. We do not log the Global Privacy Control ("GPC") signal. When your browser sends GPC, PostHog does not load. We do not sell or share Personal Data, so GPC changes nothing else.

8. Security

We implement and maintain administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, and destruction, including:

Encryption: TLS 1.2 or higher in transit; encryption at rest provided by underlying cloud infrastructure (Supabase, Vercel).
Access controls: access to production systems is limited to Nxera personnel who need it; every client action is limited to the client's own business; clients sign in to the portal with email and password and an HttpOnly session cookie that ends within 30 days on the web, and through rotating bearer sessions tied to your device, with a Face ID, Touch ID, fingerprint or passcode lock whenever your phone has a screen lock, in the Nxera app; members open their page with a signed link; sessions are stored hashed on our servers.
Network and platform security: bot mitigation on forms through Cloudflare Turnstile; webhooks from our providers are accepted only with a valid signature.
Activity log: sends, decisions, data requests, member and list deletions, and most settings changes are recorded.
Backups and recovery: database backups kept by Supabase.
Personnel: confidentiality obligations for anyone who works on Nxera's systems.
Vendor risk management: Sub-processors selected with consideration of security and data-protection commitments.
Incident response: we investigate suspected Personal Data breaches and give the notices the law requires.

No security system is impenetrable. Despite our safeguards, we cannot and do not guarantee absolute security. You are responsible for safeguarding your account credentials and sign-in links and notifying Nxera of suspected unauthorized access (Section 2.4 of the Terms).

In the event of a data breach affecting your Personal Data, we will provide notice as required by applicable law.

9. International Data Transfers

We are based in the United States. Our database and file storage are in the United States. Some providers in the sub-processor list deliver pages or messages through global networks, so data may pass through other countries on the way. By using the Services, you consent to the transfer, processing, and storage of your information in the United States, which may have different data-protection laws than your jurisdiction. If we expand internationally, we will rely on lawful transfer mechanisms (for example Standard Contractual Clauses) for any cross-border transfer that requires them.

10. Third-Party Links

The Services may link to third-party websites, apps, or services (including Google review pages, Stripe-hosted checkout and billing pages, and links a client places in its messages). Nxera is not responsible for the privacy or security practices of those third parties. We encourage you to review their privacy policies before using them.

11. Plan Page Visitors and Members

Visitors to a Plan Page at getnxera.com/m/ or on a client's custom domain, and members who enroll there, should consult the privacy notice of the Client operating that page for anything beyond what this Policy describes. Nxera processes data on behalf of the Client; the Client decides which plans are offered and what messages are sent. For questions about a specific Plan Page, contact the Client directly using the contact details on the page, or contact info@getnxera.com and we will route your question.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. We will post the updated Policy on getnxera.com with a new version and effective date. We email active clients about material changes before they take effect. Your continued use after the effective date constitutes acceptance of the updated Policy.

13. Disputes

Any dispute arising out of or relating to this Policy is subject to the dispute-resolution provisions in Section 16 of the Terms, including binding individual arbitration, class-action waiver, and the one-year limitations period.

14. Contact

For questions, requests, or complaints about this Policy or our privacy practices:

Nxera Digital LLC, Privacy 390 NE 191st St STE 59620 Miami, FL 33179 info@getnxera.com

This Privacy Policy was last updated on October 20, 2026. Version 6.0.