Legal
Data Processing Agreement
Last updated: 11 August 2026
1. Roles
For customer workspace content (conversations, tasks, CRM records, and related operational data), your organisation is the controller (or equivalent) and Nexora is the processor. For account administration data we need to run the product (billing contacts, login identifiers), Nexora may act as an independent controller as described in our Privacy Policy.
2. Purpose of processing
Nexora processes personal data only to provide the Operational Intelligence Platform: ingest authorised channel messages, run the Proprietary Intelligence Engine, create and display operational artefacts, send notifications, and secure the service. We do not process customer content for unrelated advertising.
3. Security measures
We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, audit logging (including intelligence engine invocation events), vulnerability management, and employee access on a need-to-know basis. See Security for a public overview.
4. Sub-processors
We engage the following sub-processors to deliver the service. We remain responsible for their performance under this agreement.
| Sub-processor | Purpose | Location |
|---|---|---|
| 360dialog | WhatsApp Business API connectivity and message delivery | EU / as disclosed by 360dialog |
| Supabase | Authentication, database, and related backend infrastructure | As configured for the Nexora deployment region |
| Railway | Application hosting and runtime infrastructure | As configured for the Nexora deployment region |
| Resend | Transactional email delivery | As disclosed by Resend |
5. International transfers
Where personal data is transferred across borders, we use appropriate safeguards as required by applicable law, including contractual commitments with sub-processors.
6. Assistance & deletion
We will reasonably assist with data subject requests directed to your organisation, security incident notification, and deletion or return of personal data after termination, subject to legal retention requirements and backup cycles.
7. Contact
Privacy and processing inquiries: privacy@nexora.ai.