Privacy notice
NEX AI
Recognisable contact details are removed. The filter can miss details. Remove any remaining personal data from your input.
Controller and privacy contact
[OWNER TO COMPLETE / LEGAL REVIEW REQUIRED] [OWNER TO COMPLETE / LEGAL REVIEW REQUIRED] [OWNER TO COMPLETE / LEGAL REVIEW REQUIRED]
Scope and status
This notice describes the implemented private development version. Missing information is clearly marked. Before public operation, review the controller details, processor agreements, storage locations, transfers and retention periods. This is not a GDPR certification.
Local test
Local test: data is stored on this computer in the development database and file storage. The application does not encrypt this primary storage. Device protection and disk encryption are separate requirements. Hosting providers, regions and agreements must be settled before publication.
Hosting and security
The app is prepared for Cloudflare Workers, D1 and private R2 files; this does not confirm an active deployment or storage region. The application stores HMAC counters instead of raw IP addresses for abuse prevention (GDPR Art. 6(1)(f), balancing assessment before real operation). Document hosting agreements, countries, access and log retention before publication.
Enquiries and contacts
For an enquiry we store your name, one chosen contact (email, phone or messenger), brief, desired result, deadline and optional files. Pre-contractual steps at your request use GDPR Art. 6(1)(b); business contacts may require Art. 6(1)(f) after review. No marketing. Telegram is not contacted automatically. AI processing requires an enabled provider and separate permission. Access is limited to authorised administrators with a second factor. Files stay locked until scanner clearance; a subsequently commissioned scanner receives file contents.
NEX AI
When AI is enabled, only the entered text and clarification answers are sent to the disclosed provider after separate permission. Personal information included in that text is also sent. Files and separate contact fields are excluded. AI drafts may contain errors and require confirmation. To prevent duplicate calls, the derived response is cached encrypted: valid for one hour, deleted during maintenance or a later AI request. The original narrative is not stored in this cache. Provider retention must be reviewed separately.
Chat and voice processing
Demo responses require no external AI. Conversation stays in memory in the open browser until cleared or the page closes. Live AI sends your message and up to twelve earlier messages to the disclosed provider only after separate consent, GDPR Art. 6(1)(a). Microphone capture starts only after your action and browser permission. Up to 2 minutes of audio is sent for transcription after separate consent; this application does not persist original recordings. You can review the transcript before sending. Cloud speech output also requires consent; optional system speech may use your device vendor’s services. No biometric identification. Consent can be withdrawn in settings at any time without affecting earlier lawful processing.
Current provider configuration
AI: Groq https://console.groq.com/docs/your-data Speech-to-Text / Text-to-Speech: Groq Whisper https://console.groq.com/docs/your-data File scanner: Configured — [add operator, location and contractual basis]
Cookies, local settings and spam checking
No analytics or advertising trackers are embedded. Necessary security cookies: nex-session, 24 hours, and nex-mfa, maximum 8 hours and invalid after 15 minutes idle; HTTPS uses the __Host- prefix, HttpOnly and Secure. Sites also manages platform sign-in [verify platform cookie names, durations and provider disclosures]. Your explicitly selected design is stored locally as nex-color-mode until changed or removed. Optional permissions last only this session. Necessary device access: TDDDG §25(2)(2); personal security data: GDPR Art. 6(1)(f). Turnstile loads only for suspicious activity after separate permission, GDPR Art. 6(1)(a) and TDDDG §25(1) where applicable; alternatively retry later or contact us directly.
Retention periods
Unaccepted enquiries and files: technical retention 90 days from creation. Accepted projects are not automatically erased; after this period their purpose and retention need manual review. This is not indefinite retention. Security data: 90 days. Closed privacy requests: 90 days after closure. Encrypted backups: 7 days. Automatic erasure requires running maintenance. Define statutory requirements for contract records separately before real operation.
Recipients and international transfers
Hosting/platform providers, commissioned AI, voice and scanning services where enabled, and authorised administrators receive only the necessary data. Document processor arrangements under GDPR Art. 28 and, where applicable, the transfer basis under Art. 44 et seq. (for example an adequacy decision or standard contractual clauses and supplementary measures) before activation. [Add providers, countries, subprocessors, provider retention and how to obtain safeguards.] A consent dialogue does not replace this assessment.
Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability (GDPR Art. 15–20). You may object to legitimate-interest processing under Art. 21 and withdraw consent for the future. You can complain to a supervisory authority under Art. 77. [Add competent authority and contact.] Use the privacy contact or erasure request form. Identity and legal exceptions are reviewed; submitting a request does not automatically delete anyone’s records. Responses are generally due within one month, with a justified extension where permitted. No automated decision with legal effect under Art. 22.
Privacy settings
No analytics or advertising are active. AI and microphone are permitted separately when used; rejecting them leaves text and demo available.
Request about your data
Use the contact from your enquiry where possible. We verify identity through that contact; do not upload an ID copy. Requests do not automatically delete data. We normally respond within one month.