Summary
For the content you upload and the conversations your chatbots have with your visitors, you are the controller and Nexuro AI is your processor. This addendum is part of our Terms of Service and applies whenever we process personal data on your behalf. For data we collect about you as a customer (account, billing), see our Privacy Policy.
1. Scope and Roles
- Customer (controller): decides what data is uploaded, crawled, and collected through its chatbots, and is responsible for having a lawful basis and telling its visitors.
- Nexuro AI (processor): processes that data only to provide the Service, following your documented instructions (your use of the product and these terms).
2. Details of Processing
- Purpose: storing and indexing your knowledge sources, retrieving relevant passages, and generating answers for your chatbots.
- Data subjects: your team members, and the people whose information appears in your sources or who chat with your bots.
- Types of data: content of documents and web pages you provide, text embeddings derived from it, chat messages entered by visitors, and usage counters.
- Duration: for as long as your workspace is active, and until deletion as described below.
3. Our Commitments
- We process customer data only on your instructions and do not use it for our own purposes or to train public models.
- Anyone authorized to process the data is bound by confidentiality.
- We do not sell customer data.
- We help you respond to data subject requests and to regulator inquiries, taking into account the nature of the processing, and tell you promptly if we receive a request that relates to your data.
- We notify you without undue delay after becoming aware of a personal data breach affecting your data.
4. Security Measures
- Tenant isolation enforced in the database with PostgreSQL row-level security, scoped by workspace and chatbot.
- Vector search is always filtered to the workspace and chatbot making the request; embeddings are never sent to browsers.
- Encryption in transit; storage provided by our database host, with encryption at rest.
- Authenticated access to the dashboard, least-privilege secrets handling, and rate limiting on public endpoints.
- We do not log prompts, visitor questions, or customer content in application logs.
5. Subprocessors
You authorize us to use the following categories of subprocessors to deliver the Service:
| Category | Purpose |
|---|---|
| Database, authentication and storage (Supabase) | Hosting workspace data, embeddings, and sign-in |
| Application hosting (Vercel) | Running the website, dashboard, and APIs |
| AI model providers (such as OpenAI, Anthropic, Groq) | Generating embeddings and chat responses from retrieved passages |
| Transactional email (Resend) | Sending account, verification, and notification emails |
| Payments (Dodo Payments) | Checkout and subscription billing as merchant of record; does not receive chatbot content |
We require subprocessors to protect data at a level comparable to this addendum. If we add or replace a subprocessor that handles customer content, we will notify customers in advance by email or dashboard notice so you can object on reasonable data protection grounds before the change takes effect.
6. International Transfers
Data may be processed in countries other than your own, including the United States. Where required, transfers rely on an approved mechanism such as Standard Contractual Clauses, which are deemed incorporated into this addendum for transfers from the EEA, UK, or Switzerland.
7. Deletion and Return of Data
- Deleting a source, chatbot, or workspace in the dashboard removes its text chunks and embeddings from our database.
- On termination of the account, we delete customer data from active systems, and it expires from backups on their normal rotation.
- You can export or remove your sources at any time before deletion. We may retain data where a law requires it.
8. Audits and Requests
On reasonable written request, and no more than once a year unless there has been a breach, we will give you the information needed to show our compliance with this addendum. A signed copy of this addendum, or a security questionnaire, can be requested here: