Privacy Policy
Updated September 20, 2026.
1. Scope & data roles
This policy covers the NexaFile AI website, accounts, workspaces, support, billing and connectors. Users decide which documents are submitted and for what purpose; NexaFile operates the service according to configured settings and granted permissions.
2. Data we process
Account, company and member information; documents and metadata; analysis outputs; audit and security logs; support tickets; security recovery case references and approval records; billing references; and technical data required to operate the service.
3. Private AI
Private/self-hosted AI is an Enterprise option under a separate agreement; that mode can use a dedicated model instead of a third-party GenAI API. NexaFile does not claim that SaaS data never leaves the customer company.
4. Purposes
General service data is processed for document analysis, search, exports, collaboration, security, abuse prevention, support, service notices and billing. Google Workspace API data is used only for the specific user-facing function requested by the user, never for advertising, profiling, data brokerage, unrelated purposes, generalized product improvement or training generalized AI or ML models.
NexaFile processes only the content needed for the feature you request and applies data-minimization safeguards before sharing necessary content with a service provider.
Google Workspace API Data & Limited Use
NexaFile’s use and transfer of information received from Google Workspace APIs complies with the Google API Services User Data Policy, including Limited Use. Google Workspace user data is used only for user-requested, user-facing NexaFile functionality.
NexaFile does not sell Google Workspace user data, use it for advertising, or use raw, aggregated, anonymized or derived Google Workspace data to create, train or improve generalized machine-learning or artificial-intelligence models.
When a user explicitly connects Google Drive and selects documents, NexaFile may send only the necessary content to the configured AI API provider to perform the requested analysis. The current provider is OpenAI API. NexaFile does not opt into API data-sharing for generalized model training, and uses the non-storage option where supported.
5. Connectors & subprocessors
When you connect Drive or a cloud service, NexaFile accesses data within the granted permissions and the files you select. OneDrive supports personal and Microsoft 365 accounts. SharePoint requires a Microsoft 365 organization account and delegated read-only Sites.Read.All/Files.Read permissions; your tenant may require administrator consent. App consent does not grant an employee access to SharePoint sites: their own account must already have site permission. NexaFile does not request Microsoft write access.
6. Retention, deletion & export
Based on workspace configuration, plan or contract; Owners can delete the workspace in product. After you confirm and select Delete now, NexaFile immediately erases live data within the scope shown. This action cannot be undone. Legally required records and backups follow separate lifecycles.
Only the Owner may delete the entire workspace. After confirmation, this immediately erases live data and disables member accounts, cloud connections and access. Export anything you need and review your billing obligations before deleting. After you confirm and select Delete now, NexaFile immediately erases live data within the scope shown. This action cannot be undone. Legally required records and backups follow separate lifecycles.
7. Security & incidents
The service is designed around tenant isolation, least privilege, encryption in transit, access controls, audit logging, rate limiting and incident handling. No system can promise absolute security.
8. International privacy rights
Requests to access, correct, delete, export or object to processing are handled under applicable law and the parties’ controller and processor roles. A DPA, SCCs or other international transfer mechanism may be offered where appropriate for business customers.
9. Retention transparency
| Data group | Retention principle |
|---|---|
| Documents and AI outputs | Based on workspace configuration, plan or contract; Owners can delete the workspace in product. |
| Security and audit records | Retained as needed for security, abuse prevention and applicable legal obligations. |
| Backup | May remain until technical expiry and are not used to arbitrarily restore user-deleted data. |
| Billing records | According to the Merchant of Record, payment provider and applicable legal obligations. |
10. Privacy requests
Send requests to [email protected] with the account, workspace, requested right and relevant country or region. NexaFile may require proportionate identity verification. Deadlines and exceptions follow applicable law; there is no single deadline across all data roles and regions.
11. Cookies and measurement
The service uses cookies and sessions required for authentication, security and language. Product or website measurement depends on the active operating configuration.
12. Roles, legal bases and regional requests
For account, billing, security and service-operation data, NexaFile generally determines the purposes needed to provide and protect the service. For business-workspace documents, the customer generally determines the purpose and NexaFile follows valid instructions. Legal bases may include contract, legitimate interests, consent and legal obligations, depending on the region.
13. Children, browser signals and complaints
The service is not directed to children, and users must not knowingly submit children’s data without lawful authority. Do Not Track does not automatically change processing because no uniform standard exists; displayed cookie choices and applicable legal rights remain available. Where permitted, users may complain to the competent data-protection authority.
