Privacy Policy

Last updated: October 2026.

1. Introduction

Nexa (NexaHub) is an AI knowledge workspace for businesses. Your team puts in the things it already works from every day, whether that is documents, notes, links, or recordings, and Nexa makes all of it searchable and answerable.

This policy sets out what we collect, why, and what you can do about it. It covers the Nexa web app, our API, and any integration you choose to connect. It does not cover the other services you connect Nexa to. Those run under their own privacy policies, and it is worth reading them.

Where this policy says "workspace data", it means the content you and your team put into Nexa. That content belongs to you, not to us.

2. Information we collect

Account information. Your name, email address, and a hash of your password. If you sign in with Google, LinkedIn, or Apple, we receive the basic profile those providers return. We never see your password for any of them.

Workspace and company information. Your workspace name, who you invite, their roles and departments, how you organise collections, and which plan you are on.

Uploaded files and knowledge sources. The documents, notes, links, and audio you add. We also store what we derive from them: extracted text, transcripts, embeddings, search indexes, and the citations that let an answer point back at the page it came from.

Chat conversations and AI interactions. Your questions, the answers, which sources were cited, and any action you approved (creating a reminder, drafting an email, writing a record to a connected CRM, sending a work item to your task tracker).

Integration data. When you connect Google Drive, Microsoft 365 (SharePoint and OneDrive), Notion, Slack, a CRM, or WhatsApp Business, we receive whatever that connection is scoped to. If you select three Drive folders, we see those three folders. A Notion page is read only when it has been shared with Nexa in Notion and then selected in Nexa. When you connect a task tracker (Jira, Trello, or Linear), we receive the open issues assigned to people in your workspace (for Jira and Trello, to the person who connected it), changes to their status, and what the tracker returns when someone asks Nexa a question about tasks. When you connect your own Google Calendar, we receive your Google account's email address and nothing from your calendar beyond the events Nexa itself added. When you connect your own Zoom account, we receive your Zoom profile and your list of upcoming meetings. We also store the access token that keeps each connection alive, encrypted.

Usage and technical information. Which features get used, what gets searched, which jobs run, plus IP address, browser, device type, and timestamps. We keep server logs, and an audit trail of significant actions inside a workspace.

Cookies. Covered in section 9.

3. How we use information

We use it to run the product: store your content, answer questions with citations, transcribe audio, and carry out the automations you set up. That means extracting text, generating embeddings, indexing for search, and assembling the context an answer gets built from.

Beyond running it, we use information to keep the service working and safe. We investigate failures, measure performance, and look at which features get used so we know what to improve. We detect abuse, enforce plan limits, scan uploads for malware, and protect accounts. When you raise a support ticket we look into it, and our staff only open workspace content when solving the ticket actually requires it.

We also use account and usage information for billing and to apply the limits that come with your plan.

We do not sell your personal information. We do not use your workspace data to advertise to you.

4. AI processing

Some of Nexa's features work by sending content to the AI providers that run the underlying models. This happens when you use a feature that needs it: asking a question, transcribing a recording, reading a scanned page, generating a summary.

Only what the operation actually needs gets sent. When you ask a question, what goes out is the handful of passages relevant to that question, not your whole workspace.

We choose providers on the basis that content sent through their APIs is not used to train their general models, and we set our integrations up accordingly.

Quite a lot never reaches a provider at all, because plenty of the processing runs on our own infrastructure. Ordinary text recognition on a clear scan, for example, never leaves it.

You decide what goes in, which sources a question is allowed to draw on, and what gets deleted. An administrator can see which AI operations a workspace has used, and what they cost, from the usage screens.

5. Third-party integrations

Nexa connects to services you authorise, through OAuth where the provider supports it.

You see exactly which permissions you are granting before you approve them, and we only ever ask for the narrowest scope that will make the feature work. Access tokens are stored encrypted and used for nothing beyond the features you turned on, and we reach only the data the connection covers, meaning the folders, channels, or records you picked yourself.

These integrations do more than read, and only in these ways:

• Task trackers (Jira, Trello, Linear). A workspace connects one tracker.

Nexa writes to it only for work a person sends there, or that came from it: it creates a new issue (a card, in Trello) with the item's title, description, checklist, due date, and attachments or priority; and when someone in Nexa finishes, reassigns, retitles or re-dates one of those linked items, Nexa makes the same change to that issue. Nexa never deletes anything in your tracker and never touches issues that are not linked to Nexa. Jira, Trello and Linear show general read and write access on their consent screens, because none of them offers a narrower permission that allows this.

• CRM (HubSpot, Salesforce, Zoho). Nexa can create, update or delete

contacts, companies, deals, tasks and notes, only when a person your admins allow asks for it in Nexa and approves the exact change first; Nexa then shows what it did. When a task linked to your CRM is finished in Nexa, it is marked completed there too.

• Slack. Nexa posts a message only when a person asks for it and approves

the exact text and channel first.

• Google Calendar. Each person connects their own calendar, for themselves.

Nexa adds an event to that calendar for each of that person's own Nexa reminders. It does not list or read their other events, and it does not change or delete events. Google shows this as access to calendar events (calendar.events), the narrowest permission that can add one.

• Zoom. Each person connects their own Zoom account. When you send Nexa's

meeting assistant to one of your meetings, your connection is what lets it join on your behalf, and the recording it makes is added to your workspace like a recording you upload.

You can disconnect any integration from your workspace settings (Google Calendar and Zoom from your own settings) whenever you want. Disconnecting revokes our access and stops the syncing. Content that was already imported stays in your workspace until you delete it, and you can delete it. Disconnecting a task tracker also closes, as cancelled, the open issues it had brought into your work list; issues Nexa created in the tracker stay there. Disconnecting Google Calendar leaves the events already added in your calendar.

Anything Nexa sends out to another service, such as a Slack message, a CRM record, an issue in your task tracker, or an event in your calendar, is covered by that service's policy from the moment it arrives.

Google user data

When you connect Google Drive, Nexa reads the files the connection gives it access to so it can index them and answer your questions with citations. When you connect Google Calendar, Nexa only adds one event for each reminder you confirm in Nexa. It does not change or delete calendar events, it does not read your other events, and no Google Calendar data is sent to an AI provider.

Nexa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the features you see in Nexa: search, cited answers, summaries, transcripts and reminders.
• We do not use Google user data, raw or derived, to create, train or improve generalized or foundational AI/ML models, and we do not allow the AI providers we use to do so.
• We do not sell Google user data, use it for advertising, or transfer it to anyone except as needed to provide those features, for security, or to comply with the law.
• Our staff do not read Google user data unless you explicitly ask us to (for example, in a support request about a specific item), it is needed for security, or the law requires it.

AI providers that may process content, including content from Google Drive, to provide these features: Google (Gemini API, paid tier), OpenAI (API), Anthropic (API) and Soniox (speech-to-text API). Under their API terms, content sent through their APIs is not used to train their models.

Zoom and meeting recording

Nexa Assistant is Nexa's meeting note-taker. It is used through the Nexa Assistant app for Zoom, and it can also be sent to Google Meet and Microsoft Teams meetings.

When it records. Nexa Assistant joins a meeting only when a signed-in Nexa user sends it there; it never joins on its own. It appears in the meeting as a visible participant named "Nexa Assistant". On Zoom it asks the host for permission to record, and if the host refuses, nothing is recorded. It leaves when the meeting ends or when the user asks it to leave from Nexa.

What it records. The meeting's audio, and a timeline of which participant was speaking when, using the names participants have in the meeting. It does not record video or the meeting chat.

What we receive from Zoom when you connect it.

• Your Zoom user id, account id, name and email, kept with the connection so we

can show which Zoom account is connected.

• Your upcoming Zoom meetings (topic, start time, length and join link), read

when you open the Capture page so you can choose one to send Nexa to. We do not store this list.

• For each meeting you send Nexa to, a one-meeting token from Zoom (an

On-Behalf-Of token, or your Zoom access key when Zoom does not issue one) so Nexa Assistant can join on your behalf. These tokens are used for that one join and not stored.

• OAuth access and refresh tokens, stored encrypted, used only for the above.

We do not read your Zoom chats, contacts or cloud recordings.

What happens to a recording. The audio is transcribed by our speech-to-text provider (Soniox) and processed by Nexa to separate speakers and to find the decisions, commitments and questions in it. The recording and its transcript are stored in your Nexa workspace, under that workspace's access rules, and kept until someone with permission deletes them (see section 7). The meeting bot runs on servers in Germany while it is in the meeting.

Telling the people in the meeting. Everyone in the meeting can see Nexa Assistant in the participant list, and Zoom shows its own recording notice once the host allows recording. You are responsible for telling the people in your meetings that Nexa is recording, and for obtaining any consent the law that applies to them requires.

Disconnecting. You can disconnect Zoom from Nexa at any time (Resources → Zoom → Disconnect), which revokes our access at Zoom immediately. If you remove the app in Zoom instead (App Marketplace → Manage → Added Apps), Zoom notifies us and we delete the tokens we hold for your account. Recordings already in your workspace stay there until you delete them.

6. Data storage and security

Your data lives on managed cloud infrastructure. We apply the security measures you would expect of a business SaaS product:

• traffic encrypted with HTTPS/TLS, and sensitive stored values such as

integration tokens encrypted at rest;

• workspace isolation, so a workspace's content is reachable only by its members,

with role and collection permissions inside it;

• malware scanning on uploads;
• audit logging of significant actions;
• internal access restricted to staff who need it for a specific reason.

No system is perfectly secure, and we are not going to claim otherwise. If a breach affects your data, we will tell affected customers without undue delay.

7. Data retention and deletion

We keep your workspace data for as long as your account is active and you keep it there.

Deleting individual content. Remove a file, note, link, or conversation from the app at any time. Deleting a source also removes what we derived from it: the extracted text, the embeddings, the search index entries.

Deleting your account. Go to Settings and choose Delete account. You do not have to email anyone and you do not have to explain why.

You are signed out on every device straight away, but nothing is deleted for 14 days. Your files, chats, notes and CRM stay exactly where they are for that whole period. Sign in again at any point before the 14 days are up and the deletion is simply cancelled. Nothing has to be rebuilt, because nothing was taken apart, so your account is exactly as you left it.

Once the 14 days pass it is permanent. Your files come out of storage, your workspace data is deleted, and your name, email and password are erased from our records.

If you own a company workspace, deleting your account deletes the whole company, including its files, chats, notes and CRM, and everyone in it loses access immediately. The app tells you this and asks you to type the company name before anything is scheduled.

What we keep afterwards, and why. We keep a record that the account existed and closed: the date, how long you were with us, roughly what you used, the plan you were on, and the reason you gave if you gave one. We use it to understand why people leave. Your email and name are removed from that record after 180 days, and what is left cannot be traced back to you. Invoices and payment records are kept, without your identity attached, for as long as tax and accounting law requires. Support conversations are kept in the same anonymised form.

Making a request another way. If you cannot reach the app, email support@nexahubs.co from the address on your account and we will handle it.

Integration data. Disconnecting a service stops the syncing. Deleting the imported content removes it from your workspace.

One caveat on timing: backups run on a rolling schedule and get overwritten in the normal course of things, so deleted content can survive briefly in a backup before it cycles out. Server logs are kept for a limited period for security and debugging.

If you connect a service with its own required deletion route, such as Meta/WhatsApp Business, you can ask us to delete the data received through that integration at support@nexahubs.co. We handle those requests under this section.

8. Your rights

Depending on where you live, you may have the right to ask us to:

• give you a copy of the personal information we hold about you;
• correct anything that is wrong;
• delete your personal information;
• export your information;
• stop or limit certain processing;
• withdraw your consent, where we relied on it.

Email support@nexahubs.co to exercise any of these. We will ask you to confirm who you are first, and we will respond within a reasonable period.

If you use Nexa through your employer's workspace, your employer controls that workspace's data. We may pass your request to them, and we will help them act on it.

9. Cookies and analytics

We use cookies to keep you signed in, to remember preferences such as language and theme, and to understand in aggregate how the product is used so we can improve it. The essential ones are needed for the app to function. You can block cookies in your browser, but parts of Nexa will stop working if you do. We do not use advertising cookies.

10. Changes to this policy

We will update this policy as the product changes. The date at the top always reflects the current version. If a change is significant, we will give you reasonable notice in the product or by email before it takes effect.

11. Contact

Questions about this policy, or a request about your data:

support@nexahubs.co