Privacy policy

Nexio AI is a tool for small trades businesses, run by Nexio AI. It stores the contact details of your customers, your quotes and invoices, and the emails sent and received about them. This page explains what is collected, why, who else handles it, how long it is kept, and what you can do about it.

1. Who this covers

There are two kinds of people in this policy. You, the business that holds the account: the owner who signs up and any team members the owner invites. And your customers, whose details you enter so you can quote and invoice them. For your own account details, Nexio AI is the controller. For your customers' details, you are the controller: you decide what is stored about them, and we process it on your behalf and on your instructions. Your customers do not have accounts with us.

2. What we collect

• Account details. Your name, email address and profile picture. Sign-in, passwords and two-step verification are handled entirely by Clerk, our authentication provider. Nexio AI never sees or stores your password.
• Business details. Your trading name, address, phone, logo, currency, tax settings and the labour and material rates you save in your price book.
• Customer records. Names, email addresses, phone numbers, addresses and notes you enter about the people you work for, and whether they have asked not to be contacted.
• Jobs, quotes, invoices and payments. Line items, amounts, due dates, the payments you record by hand, and the status of each document. When a customer opens a quote or invoice link, we record that it was opened and when.
• Uploaded files. Invoices you upload so their details can be read, and any proof of payment you upload when paying for a plan by bank transfer. The original file is kept with the record it produced.
• Email. The content of every message sent on your behalf, every reply a customer sends back, and delivery events such as bounces and spam complaints.
• Usage and billing. Your plan, how many AI actions and emails you have used against your limits, and the references of payments you make to us. Card details are entered on WiPay's own page and never reach us.
• Activity history. A log of actions in your account (a quote sent, a payment recorded, a follow-up approved), so you can see what happened and when.
• Technical data. If a page fails in your browser, an error report with the page address, browser type and your account id. Our hosting and backend providers also keep short operational logs, which can include IP addresses.

3. How it is used, and the lawful basis

We use your data only to run the service for you: to store and show your records, to send quotes, invoices and follow-ups you have approved, to read replies and file them against the right customer, to draft text with AI, to apply plan limits, to take payment for your plan, and to keep the service secure and deliverable.

• Contract. Most processing is needed to provide the service you signed up for.
• Legitimate interests. Security, abuse prevention, error reports, and protecting the email reputation every account shares.
• Legal obligation. Responding to lawful requests and keeping records the law requires of us.

We do not sell your data, we do not use your customers' details for our own marketing, and we do not use your data to train AI models.

4. Email sent on your behalf

Quotes, invoices and follow-ups leave through Resend, our email provider, from an address on the mail.nexioai.site sending domain with your business name on it. Replies come back through Resend to reply.nexioai.site so they can be filed against the right customer. Nothing is sent to a customer unless you press send or approve it. Delivery records, bounces and spam complaints are kept so we can protect the sending reputation that keeps your messages out of junk folders, and a customer who complains is not emailed again.

Nexio AI does not take payments between you and your customers. They pay you directly, however you have arranged it.

5. AI processing

Some features send text or images to AI models through the Vercel AI Gateway, which routes each request to a model provider. By default that is OpenAI, with Google and Amazon as fallbacks when it is unavailable. Those features are:

• drafting a quote or invoice from your description;
• reading an uploaded invoice, only when you press "Read it with AI";
• drafting follow-up messages for quotes and invoices that have gone quiet;
• sorting a customer's reply (for example a question, a dispute, or a claim that they have paid) so it reaches you with the right alert.

What is sent is the minimum the task needs, such as the job description, a document image, or the invoice details and the customer's name and reply. AI output is always a draft. A person approves every message before it is sent, and the AI never marks an invoice paid, agrees a discount or answers a complaint on its own.

Uploaded invoices are first read on your own device, in your browser. The reading software is downloaded to your browser from jsDelivr, a public file delivery network; the document itself is not sent to jsDelivr.

6. Who else handles it

We use these service providers (sub-processors). Each receives only what it needs for its job:

• Clerk: sign-in, passwords, two-step verification and sessions.
• Convex: the database, file storage and backend that run the service.
• Vercel: hosting of the website and app.
• Vercel AI Gateway, and the AI model providers it routes to: AI drafting and reading, as described above.
• Resend: sending email and receiving replies.
• WiPay: card payments for Nexio AI plans, only when card payment is offered. Bank transfers go directly to our bank.
• jsDelivr: delivers the invoice reading software to your browser. It receives a normal web request, not your documents.

We also disclose data where the law requires it.

7. International transfers

Our providers operate internationally, so your data may be stored and processed in the United States and other countries outside your own. Where the law requires it, we rely on the providers' standard contractual safeguards for these transfers.

8. The rights of your customers

You are responsible for having a lawful reason to hold the details of your customers and to email them, which for people you are actively quoting or invoicing is normally straightforward. If one of your customers asks you to correct or delete their details, you can do it in the app, and you can mark a customer as not to be contacted. If they contact us directly, we will pass the request to you.

9. Your rights

• Access and portability. Settings, then Data, then "Export my data" downloads everything in your account as one JSON file.
• Correction. Edit anything that is wrong in the app, or ask us.
• Deletion. Settings, then Data, then "Delete account" erases your business and everything in it, and removes your sign-in.
• Objection and restriction. Ask us to stop or limit a particular use of your data.
• Complaint. Complain to your local data protection authority if you think we have got something wrong.

For anything you cannot do in the app, email support@nexioai.site from the address on your account.

10. Retention

Your records are kept for as long as your account exists. When you delete your account, access stops immediately and your data is erased from our live systems promptly, normally within minutes. Copies in our providers' backups roll off on those providers' own schedules. Export files are deleted an hour after they are made. Browser error reports are kept for 30 days. Invoices are your own business records and you may need to keep them for tax, so export them before you delete your account.

11. Security

Data is encrypted in transit and at rest. Every record is scoped to the account that created it, so no other account can read your customers, prices or invoices. Public quote and invoice links use long random tokens and show only what the customer needs to see. No system is perfectly secure; if we discover a breach that affects you, we will tell you without undue delay.

12. Cookies

We use only the essential cookies Clerk needs to keep you signed in. There are no analytics, advertising or tracking cookies. Your light or dark display choice is kept in your browser's local storage, not in a cookie, and never leaves your device.

13. Children

Nexio AI is for businesses and is not meant for anyone under 18. We do not knowingly collect data about children.

14. Changes

If this policy changes in a way that matters, we will email the address on your account before the change takes effect. The date at the top shows when the current version took effect.

15. Contact

Questions and requests go to support@nexioai.site.