Privacy Policy | Nexal AI

1. Scope and Who We Are

This Privacy Policy applies to nexalai.com, the official Nexal AI hosted service, and the official Nexal AI applications distributed through app stores (together, the "Services"). COCIVAI LLC is responsible for the personal information processed to operate those Services.

This policy does not govern an independently operated Self-Hosted deployment. The person or organization operating a Self-Hosted deployment decides how that deployment collects and uses information and is responsible for its own privacy notices, configuration, security, retention, and legal compliance. This policy also does not govern the independent practices of an AI provider, identity provider, app store, or other third party you choose to use.

2. Privacy at a Glance

Nexal AI collects account information, content you choose to store or process, service activity, and technical information needed to provide and protect the Services.
The Services are bring-your-own-key ("BYOK"). When you request an AI feature, relevant content is sent to the provider available through your provider account.
Nexal AI does not sell personal information and does not use personal information for cross-context behavioral advertising.
Nexal AI does not use private prompts, conversations, files, memory, or other private content to train a Nexal AI general-purpose AI model.
You can delete content in supported product controls, request account deletion in the applications, or contact us to exercise an applicable privacy right.

3. Information We Collect

The information we collect depends on which Services and features you use. We do not require every category listed below from every user.

Account and profile information

Email address and authentication identifiers.
Display name, profile image, and account preferences you choose to provide.
Authentication provider information when you sign in with an external provider, such as the provider name and the profile fields that provider makes available with your permission.
Locale, language, time zone, and general country setting when supplied by your device, identity provider, or account settings.

Content and instructions you provide

Prompts, messages, conversation titles, folders, and conversation history.
Files, documents, images, audio recordings, and other media you choose to upload, capture, or process.
Memory, custom context, preferences, personas, model configuration, and other instructions you ask the Services to retain.
Mini apps, agent skills, structured app data, tool inputs, tool approvals, and generated outputs associated with your account.
Feedback, support requests, and communications you send to us.

Please do not submit information that you do not have the right to use or disclose. The Services are not designed as a system of record for protected health information, government identification numbers, financial account credentials, or other regulated data requiring a separate written agreement with us.

BYOK credentials and AI request information

Provider API credentials you choose to save. Credentials are kept in encrypted, server-side secret storage and are not displayed again in full after saving.
Selected provider and model, request status, token and usage measurements, estimated provider cost, tool activity, and provider error information.
Context required to complete a request, which may include relevant conversation history, files, memory, tool results, or location information you explicitly use.

Subscription and transaction information

Subscription plan, status, purchase source, renewal or expiration date, transaction identifiers, and billing-provider customer identifiers.
Billing contact information and billing address supplied during checkout where required for payment or tax processing.

Payment card and bank-account details are entered directly with the applicable payment processor or app store. Nexal AI does not receive or store complete payment card numbers.

Device, log, and service activity

IP address, user agent, operating system, browser, device type, app version, language, and time zone.
Account, session, device, request, and trace identifiers used for authentication, continuity, security, and troubleshooting.
Feature interactions, timestamps, page or screen views, model selections, request counts, performance data, failures, and diagnostic events.
Security and audit records, including sign-in events, authorization decisions, changes to sensitive settings, tool actions, billing actions, and suspected abuse.
Push-notification token, notification permission state, delivery information, and notification interactions when notifications are enabled.

Our analytics controls are designed to record operational metadata rather than the raw text of prompts or messages. Diagnostic records may still contain information associated with your account when needed to investigate a request, security event, or support issue.

Device permissions and local information

The mobile applications may request access to camera, photo library, microphone, location, local files, and notifications. The operating system asks for permission. When you grant access and use the related feature:

Camera, photo, and file access lets you capture, select, upload, analyze, or save content.
Microphone access lets you record audio for voice interactions. Audio may be uploaded and processed to complete the feature you requested.
Foreground location access lets a feature use your current location for a request such as local search or weather. Location is not required for ordinary chat.
Notification access lets the application deliver reminders, service notices, and requested updates.

You can change permissions in your device settings. Some preferences, caches, drafts, reminder schedules, and media references are also stored locally on your device.

Information from third parties

We may receive information from:

Identity providers, such as confirmation of authentication and profile information you authorized them to provide.
Payment processors, app stores, and subscription-management providers, such as purchase status, transaction identifiers, refunds, cancellations, and renewal information.
Infrastructure, security, analytics, customer-support, and notification providers, such as delivery status, service events, fraud signals, and diagnostic information.
AI providers, such as generated output, usage measurements, request status, and error information for requests made through your provider account.

4. How We Use Information

We use personal information to:

Create, authenticate, maintain, and secure accounts and sessions.
Store and synchronize conversations, files, memory, settings, mini apps, skills, and other content at your direction.
Send requests to your selected AI provider and return responses, tool results, and generated content.
Operate hosting, storage, databases, background jobs, notifications, and app distribution.
Process subscriptions and maintain purchase and entitlement records.
Provide support, respond to requests, and send transactional or service-related communications.
Measure reliability and feature use, troubleshoot failures, maintain continuity, and improve the safety and usability of the Services.
Detect, investigate, prevent, and respond to fraud, abuse, security incidents, unauthorized access, and violations of our Terms.
Comply with law and protect users, Nexal AI, and others.

5. AI Processing and BYOK

Nexal AI does not provide the underlying model usage included with Managed Hosting. You connect a provider account using BYOK. When you initiate an AI request, Nexal AI uses your saved credential to submit the information needed for that request to the provider and model you selected or that the feature requires.

Information sent for an AI request may include your current prompt, relevant prior messages, system instructions, selected files or media, saved memory or context, tool inputs and results, and technical request parameters. We limit the context sent to what the product determines is relevant to perform the request, but you should assume that content shown as context for a request can be processed by the AI provider.

AI providers operate under their own terms, privacy policies, retention settings, and account controls. Nexal AI does not control how a provider independently handles data under your provider account. Review those terms and settings before submitting sensitive content. Removing a credential from Nexal AI stops future use of that saved credential but does not delete information already processed by the provider.

We disclose information only as needed for the purposes described in this policy:

Hosting and infrastructure providers. Database, authentication, storage, application hosting, edge functions, background processing, email, monitoring, and security providers process information to operate the Services.
AI providers. The provider available through your BYOK account receives content and request data needed to perform the feature you requested.
Billing and app-distribution providers. Payment processors, subscription-management providers, Apple, and Google process purchases, renewals, refunds, subscription status, tax information, and application distribution.
Notification providers. A push-notification provider processes device tokens, account identifiers, contact information associated with notifications, delivery information, and notification preferences.
Analytics, support, and website providers. Providers that help us understand service performance, operate help or contact tools, and respond to support requests process technical activity and information you submit to them.
Professional advisers. Lawyers, accountants, auditors, insurers, and other advisers may receive information where reasonably necessary to provide their services.
Legal and safety disclosures. We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; protect rights, safety, and property; investigate abuse; or enforce agreements.
Business transfers. Information may be reviewed or transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate confidentiality protections.
At your direction. We disclose information when you direct us to connect a service, share content, execute a tool, or otherwise send information to a third party.

Personnel and contractors may access information only when reasonably needed for their work, such as support, security, operations, or legal compliance, and are subject to confidentiality and access controls.

7. Cookies and Local Storage

Our websites and web application use cookies and similar browser storage for authentication, security, session continuity, language, theme, preferences, and other functions you request. Blocking these technologies may prevent sign-in or cause parts of the Services to stop working correctly.

We also use limited service and website analytics to understand page usage and reliability. The official web application includes Vercel Analytics, and selected marketing help and pricing pages may load HubSpot tools. Those providers may receive technical information and set or read identifiers according to their own documentation and your browser settings. We do not use these tools for cross-context behavioral advertising.

8. Legal Bases for Processing

Where laws such as the European Economic Area or United Kingdom data-protection laws require a legal basis, we rely on:

Contract. Processing needed to create your account, provide requested features, maintain content, process a subscription, and support the Services.
Legitimate interests. Operating, securing, troubleshooting, and improving the Services; preventing fraud and abuse; communicating about the Services; and protecting legal rights. We consider the effect on users before relying on this basis.
Legal obligations. Processing required for tax, accounting, consumer protection, lawful requests, and other obligations that apply to us.
Consent. Processing where we ask for permission, such as device permissions or optional communications. You may withdraw consent through the relevant setting or by contacting us, without affecting earlier lawful processing.

9. Retention

We retain information for the shortest period reasonably necessary for the purpose for which it was collected, taking account of the nature of the information, the sensitivity and risk of keeping it, product functionality, user instructions, security needs, and legal obligations.

Account information and account content are generally retained while your account is active and until you delete the content or request account deletion.
Saved provider credentials are retained until you replace or delete them, or until the associated account is deleted.
Subscription, transaction, tax, and accounting records are retained as required to document transactions, comply with law, resolve disputes, and prevent fraud.
Security, audit, diagnostic, and analytics records are retained for a period reasonably necessary to protect the Services, investigate incidents, measure reliability, and meet legal obligations, after which they are deleted or de-identified.
Deleted information may remain temporarily in restricted backups until those backups are overwritten through the ordinary backup cycle.

We may retain information longer when necessary to comply with law, preserve evidence, exercise or defend legal claims, investigate abuse, or enforce agreements. When practical, retained information is limited, isolated, or de-identified.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Depending on the information and system, these safeguards include encrypted network transport, encrypted secret storage for provider credentials, access controls, server-side authorization, restricted service credentials, audit records, input validation, and monitoring.

No service can guarantee absolute security. You are responsible for protecting your account, device, sign-in method, and provider credentials; using a unique password where applicable; and notifying us promptly if you believe your account or credential has been compromised.

11. Your Choices and Rights

You can manage many choices through account, application, browser, device, provider, and app-store settings. These include editing profile information, deleting supported content, removing a saved provider credential, disabling notifications, revoking device permissions, managing cookies, and canceling a subscription.

Depending on where you live and subject to legal exceptions, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information; to object to or restrict certain processing; to withdraw consent; and to appeal a decision on a request. You may also have the right to complain to your local data-protection or consumer-protection authority.

Send requests to support@nexalai.com. We may need to verify your identity and authority before acting. An authorized agent may submit a request where applicable law permits, but we may require proof of authorization and direct confirmation from the account holder. We will not discriminate against you for exercising an applicable privacy right.

12. Account and Data Deletion

You can initiate account deletion from account settings in the official applications. To request deletion outside the application, email support@nexalai.com from the address associated with your account and state that you want your Nexal AI account deleted.

Account deletion is intended to delete or de-identify the account and personal content associated with it, except information we must retain for a legitimate reason disclosed in this policy, such as transaction records, security records, fraud prevention, or legal compliance. We may retain a minimal record of the deletion request and its completion.

Cancel any active Managed Hosting subscription through the service where you purchased it before deleting your account. Deleting the application or deleting your Nexal AI account does not by itself instruct Apple, Google, or another billing provider to stop recurring charges. If you need immediate account deletion while a subscription remains active, contact support so we can process the deletion request and explain how to stop future billing.

Account deletion does not automatically delete information already processed by your AI provider, identity provider, app store, or another independent third party. Submit a separate request to that third party where necessary.

13. International Processing

COCIVAI LLC is based in the United States. We and the providers that support the Services may process information in the United States and other countries, which may have different data-protection laws than your country. Where applicable law requires safeguards for an international transfer, we use an appropriate legal mechanism or require the relevant provider to do so.

14. Children

The Services are general-audience services and are not directed to children under 13. We do not knowingly collect personal information from a child under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it as required. Users under the age of legal majority where they live must have permission from a parent or legal guardian to use the Services.

15. Sale and Targeted Advertising

Nexal AI does not sell personal information for money. Nexal AI does not share personal information for cross-context behavioral advertising or use it for targeted advertising across unrelated services. We do not currently offer an opt-out link for those practices because we do not engage in them. If our practices change, we will update this policy and provide any controls required by applicable law before using information in that way.

16. Changes to This Policy

We may update this policy to reflect changes in the Services, providers, law, or our practices. We will post the revised policy and update the date above. If a change materially affects how we use personal information, we will provide additional notice when required, such as through the Services or by email.

17. Contact Us

Questions, privacy requests, and complaints may be sent to:

COCIVAI LLC
Attn: Nexal AI Privacy
1401 Pennsylvania Ave, STE 105, BOX 1805
Wilmington, DE 19806, United States
support@nexalai.com
(302) 265-0152

If you are not satisfied with our response, you may have the right to contact the privacy, data-protection, or consumer-protection authority where you live.