Data and privacy in NexiAgent assistants

Who is responsible for what

For the website, your account and billing, NexiAgent is the data controller of your data. When the assistants process the personal data of your end customers on your behalf, NexiAgent is a data processor and your company is the controller. Your company defines the purposes and limits of that processing. NexiAgent complies with the GDPR and Portuguese data protection law (Law No. 58/2019).

Where the data is and who processes it

• OVHcloud — hosting of the application and database, in France.
• NexiChat — the artificial intelligence behind the assistants; it is ours and runs on servers in the European Union.
• Telnyx — telephone network for call answering.
• Cloudflare (R2) — storage for the files you upload to the knowledge base.
• Amazon Web Services (SES) — email delivery from Sweden.
• Stripe and PayPal — payments; InvoiceXpress — certified invoices.

NexiAgent does not sell personal data. Some providers (for example, payment and email processors) may process data outside the EU, notably in the United States; in those cases legally recognised safeguards apply, such as European Commission adequacy decisions or the Standard Contractual Clauses.

What is stored about the service

For customers with active assistants, operational metrics and logs (number of interactions, success rate, average duration, cost and summaries) are stored, linked to the account, to show analytics and for billing. Card details are not stored by NexiAgent: payment is processed by Stripe or PayPal.

Artificial intelligence

The assistants can make mistakes, and their outputs should be reviewed before being relied on for important decisions. No decisions producing legal or similarly significant effects are made based solely on automated processing (Article 22 GDPR).

How long it is kept

• Account and profile — while the account is active; after closure it is deleted or anonymised, unless a legal retention obligation applies.
• Contact messages — up to 24 months after the last contact.
• Website analytics data — anonymised or aggregated within a maximum of 26 months.
• Invoices and accounting records — for the period required by Portuguese tax law.
• Support requests — as long as needed for follow-up and for evidentiary purposes.

How it is protected

• Encryption of data in transit (HTTPS) and at rest.
• Role-based access control: each user sees only their own data.
• Two-factor authentication available on the account.
• Database hosted in the European Union, with backups.
• If a data breach poses a risk to your rights, the supervisory authority is notified within 72 hours.

Your rights

You can ask to access, correct or delete your data, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. Write to [email protected]; you will get an answer within the legal time limit. You can also complain to the Portuguese authority (CNPD) or to the supervisory authority in your EU country. Under the Terms of Service, business customers can request the Data Processing Agreement (DPA) from [email protected].

The full text is in the Privacy Policy.