This Privacy Policy explains how Nexioli (“Nexioli”, “we”, “us”) processes personal data in connection with the Nexioli website, product, and related services (the “Service”).

Controller for account and website data: Nexioli

• Trade name: Nexioli
• Registered address:
  Lyra 733328 NH DordrechtThe Netherlands
• Privacy contact: privacy@nexioli.com

For email content and other customer data you connect to Nexioli (for example Gmail messages and customer contact details inside those messages), you are the controller and Nexioli acts as processor on your instructions, except where we process data for our own account administration, security, or legal obligations.

This Policy applies to:

• Visitors of our marketing website
• People who create a Nexioli account or use the dashboard
• Personal data contained in connected inboxes, knowledge sources, and related product features, to the extent we process that data to provide the Service

It does not replace your own privacy notice to your end customers. You are responsible for telling your customers how you use Nexioli and for having a lawful basis to process their data.

Depending on how you use the Service, we may process:

• Account data: name, email address, authentication details, MFA phone number (where used), company profile, role, and billing-related identifiers when payment is enabled
• Usage and device data: log data, IP address, browser type, approximate location derived from IP, pages viewed, and product interaction events needed to operate, secure, and improve the Service
• Connected inbox data: email metadata and content you authorize us to access (subjects, bodies, attachments where processed, senders, recipients, labels/history needed for sync), send-as aliases, and sync/watch status
• Knowledge and settings: company description, tone preferences, guardrails, website/FAQ content, uploaded documents, and related embeddings or search indexes we create to draft replies
• AI and review data: draft replies, confidence scores, approvals, rejections, edits, and emergency-stop / audit events
• Support communications: messages you send to us (for example via hello@nexioli.com)

We do not intentionally collect special categories of personal data, but email and knowledge content you connect may contain such data. You control what you connect and upload.

We process personal data for the following purposes:

• Provide the Service (contract): create accounts, authenticate users, sync connected inboxes, generate AI draft replies, operate Review Queue and related features, and provide customer support
• Secure the Service (legitimate interests / legal obligation): detect abuse, prevent fraud, enforce MFA where required, maintain logs, and protect systems and users
• Improve the product (legitimate interests): understand feature usage and fix bugs using product analytics that are not Gmail message content. We do not sell personal data, and we do not use Google Workspace API data to train or improve generalized AI models
• Communicate with you (contract / legitimate interests / consent where required): service notices, security alerts, and (only if permitted) product updates
• Comply with law (legal obligation): tax, accounting, and responding to lawful requests

Where we rely on legitimate interests, we balance those interests against your rights. You may object as described below.

Nexioli uses large language models to draft suggested customer-support replies and related in-product assistance. We call OpenAI’s API directly (currently chat completions and embeddings). We do not use ChatGPT consumer products, AI aggregators, or model hubs for Gmail or other Google Workspace content.

• AI outputs are suggestions. They can be incomplete, inaccurate, outdated, or inappropriate
• By default, drafts are held for human review in the Review Queue before sending
• If you enable optional automatic sending, you instruct Nexioli to send without a per-message human approval, and you remain responsible for those communications
• Inbox content is sent to OpenAI only to generate a draft or embedding for that company’s use of the Service — not to train Nexioli’s own models and not to train OpenAI’s foundational or generalized models (OpenAI’s API data-usage terms; we do not opt in to training)
• You should not rely on Nexioli as legal, medical, financial, or other professional advice

Nexioli’s Gmail integration uses Google Workspace APIs (Gmail) so a business can connect a support inbox, read customer mail, and send replies they approve. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In particular:

• We do not transfer Gmail / Workspace user data to third parties for advertising, or to train, improve, or create generalized or foundational AI/ML models
• OpenAI processes prompts and outputs solely as our processor to provide draft replies and embeddings for the connecting company’s tenant
• We do not sell Workspace user data
• Human review, storage in the customer’s Nexioli workspace, and sending mail the customer instructs us to send are uses of the data to provide the user-facing features of the Service

We share personal data only as needed to run the Service, including:

• Infrastructure and hosting: Google Cloud / Firebase
• Connected inbox: Google (Gmail API), only after the account owner grants OAuth access
• AI drafting: OpenAI API (paid API / platform usage), for chat completions and embeddings
• Website analytics (if you accept analytics cookies): Google Analytics 4, on the public site only
• Transactional email: Resend, for product notices such as needs-human alerts
• Payments (when enabled): Stripe
• Professional advisers and authorities when required by law or to protect rights

Subprocessors act on our instructions and under appropriate contractual protections. We do not sell personal data or share it for third-party advertising.

We primarily aim to process data in the EU/EEA where practicable. Some providers may process data in other countries (including the United States). Where we transfer personal data outside the EEA/UK, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (or equivalent), plus supplementary measures where needed.

We keep personal data only as long as needed for the purposes above, including to provide the Service, resolve disputes, and meet legal retention duties. Typical patterns:

• Account data: for the life of the account, then a reasonable wind-down period after deletion/closure
• Connected inbox sync and drafts: while the integration is active and as needed for product history you keep in the Service
• Security and audit logs: for a limited period appropriate to security and abuse prevention
• Billing records (when applicable): as required by tax and accounting law

You can disconnect integrations and request deletion as described in “Your rights”.

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, secret management for tokens, and MFA for customer accounts. No method of transmission or storage is perfectly secure. See also our Security page for a product-level overview.

If you are in the EEA/UK (or otherwise entitled), you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data in certain cases
• Restrict or object to processing
• Data portability
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens)

To exercise these rights, email privacy@nexioli.com. We may need to verify your identity. If you are an end customer of a Nexioli user, contact that company first — they are typically the controller of your email content.

We use necessary cookies and similar technologies to run authentication, security, and core site functionality. If you accept analytics cookies, we use Google Analytics 4 (measurement ID G-8NXQ7Z25YQ) on the public website to understand traffic and improve the site. We do not load that analytics on the signed-in product. Where required by law, we will ask for consent before non-essential cookies. You can change your choice via Cookie settings in the footer. Blocking necessary cookies may break login or core features.

The Service is directed at businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will take appropriate steps.

We may update this Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Material changes may be communicated by email or in-product notice where appropriate.

Questions about this Policy: privacy@nexioli.com. General support: hello@nexioli.com.