Privacy Policy

Who we are

Nexley AI (“Nexley”, “we”) is the data controller for the account data of the business owners who sign up, and a data processor acting on a business owner’s behalf for the messages their customers send to their Nexley. We are a UK data controller subject to the UK GDPR and the Data Protection Act 2018. Contact: hello@nexley.ai.

What we collect

• Account data - your name, email, phone, business details, and authentication identifiers (we use passwordless magic-link / Apple sign-in; we never store a password).
• Content you create - messages you send your Nexley, photos you capture (receipts, job-site images), contacts, estimates and notes you store.
• Your customers’ messages - when a customer messages your Nexley (via Slack, WhatsApp, Instagram or the web chat), we process that message and any contact details it contains, on your behalf, so the AI can reply.
• Diagnostics - crash and error reports, and basic usage events, to keep the app working. These are not used to track you across other apps or for advertising.

How we use it & our lawful basis

• To provide the service (generate AI replies, extract data from photos, manage your inbox) - lawful basis: performance of our contract with you.
• To keep it secure and reliable (rate-limiting, error tracking, content moderation of AI output) - lawful basis: our legitimate interests in a safe, working service.
• To meet legal obligations (financial records, responding to data-rights requests) - lawful basis: legal obligation.

We do not sell your data, and we do not use your data or your customers’ data to train AI models.

AI processing

Your Nexley is powered by large-language-model providers. The text of a message (and, for photo capture, the image) is sent to those providers to generate a reply or extract data. AI output shown to your customers is scanned by an automated moderation step and can be reported in-app for review. Before your Nexley is enabled, the app shows a consent screen naming the AI provider; you can decline.

If you connect Slack

Slack is connected by installing a private Slack app - created from a manifest we provide - in your own Slack workspace. Your business remains the Slack customer under its own agreement with Slack; Nexley processes, on your behalf, the messages that app receives - the message content and attachments, together with the workspace member IDs and display names Slack attaches to each message. We keep a copy of those conversations - a message ledger on your dedicated server and a communications log in our database - so your Nexley has context and you have a record. Slack Technologies (a Salesforce company) processes this data on its own infrastructure in the United States - see “International transfers” below.

If you connect Instagram or WhatsApp

You can connect your business’s own Instagram professional account or WhatsApp Business number. We then receive, through Meta’s official APIs, the direct messages and comments your customers send to that account, the sender’s username or phone number and display name, and your account’s basic profile and posts (so a comment can be matched to its post). Your Nexley uses this only to reply automatically on your behalf, to pass anything it cannot handle to you, and to show you your own conversation history. We do not use it for advertising, sell it, share it with other businesses, or use it to train AI models. You can disconnect the account at any time; to have the data deleted, delete your account (Settings → Delete account) or email hello@nexley.ai.

Who we share it with (sub-processors)

We share data only with the providers needed to run the service, each under a data-processing agreement. We name the ones that process the content of your messages; for the rest we give the category, and customers can ask us for the named list at any time (see “Changes & contact”):

• Our AI provider - the large-language model behind Nexley (message text).
• OpenAI - automated moderation of AI output, and, if you use the Voice feature, live voice processing: your microphone audio during a voice call, its transcription, your business name, your first name, your Nexley’s name, the questions and answers spoken during the call, and an extract of your recent messages with your Nexley from the last 7 days - across the dashboard, Slack and WhatsApp - so the call can carry on from where your messages left off. Voice is off unless switched on for your account.
• Anthropic - if you use the Voice feature and ask your Nexley to look at your screen or camera, the image of that screen or camera frame is sent to Anthropic to be described, together with your question about it. Nothing is sent unless you ask, and no image is retained after the description is returned. This is separate from the voice processing above and happens only for that request.
• Cloud hosting, database and authentication providers - the platforms that run the dashboard and our API, host your dedicated instance, and store your account data, contacts and messages. UK and EU regions.
• Stripe - subscription billing (handled by Stripe; we never see full card details).
• An integration authorisation broker - brokers your connected-integration authorisations and custodies the OAuth tokens (Gmail, Calendar, etc.) your Nexley uses, so that we never hold them ourselves; we keep only a connection reference.
• Google (Analytics) - visitor analytics on our marketing site nexley.ai, only if you accept the cookie banner there (see “Cookies and analytics” below).
• A push-notification provider - mobile push notifications (device token only).
• An error-diagnostics provider - crash and error reports (EU region).
• Twilio / WhatsApp - message delivery for the channels you connect.
• Meta Platforms (Instagram and WhatsApp) - message and comment delivery when you connect Instagram or WhatsApp.
• Slack Technologies (a Salesforce company) - message delivery when you connect Slack; processes data in the United States (see “International transfers” below).

For voice specifically: before anything is sent we replace email addresses, phone numbers, postcodes, and card, account and sort-code numbers found in your messages. Contact details we read out to you during a call are masked further, including your customers’ surnames - except a name you say yourself during the call, which we speak back to you in your own words.

How long we keep it

• Captured photos: source image deleted after 30 days; extracted data kept while your account is active.
• Chat attachments: up to 90 days.
• Conversation history (Slack, WhatsApp, web chat): kept while your account is active - stored on your dedicated server and in our database - then deleted with your account.
• Account & business data: for the life of your account, then deleted within 14 days of account deletion.
• Financial records: retained as required by UK law (up to 6 years).
• Diagnostics / error logs: 14 days. Moderation reports: up to 1 year.
• Voice calls: we do not record or store the audio. The transcript of a call is saved to your chat history and kept while your account is active.

International transfers

Some of our sub-processors (including our AI providers, Slack and Stripe) process data in the United States. Where personal data leaves the UK we rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, and otherwise on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so your data keeps the same level of protection as it has under UK GDPR.

Cookies and analytics

Our marketing site (nexley.ai) uses Google Analytics 4 to understand how people find and use the site. It is switched off until you say yes: analytics storage is denied by default, and the banner on your first visit is what turns it on. Choose Reject and no analytics cookies are ever set.

If you accept, Google Analytics sets cookies (named “_ga”) that give your browser a random identifier, and we see: the pages you view, the site or ad campaign that referred you, your approximate location (derived from your IP address by Google, which we never see in full), your device and browser, and how you interact with the page - how far you scroll, whether you play the video, and clicks on our phone, WhatsApp, review and book-a-demo links. We do not use it for advertising, and advertising personalisation is switched off. Our lawful basis is your consent (Regulation 6 of PECR and Article 6(1)(a) UK GDPR). This analytics data is kept for 14 months.

To change your mind, clear this site’s data in your browser and the banner will ask you again. You can also install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.

The Nexley app and dashboard (nexley.co.uk) do not use Google Analytics. They use a cookieless analytics tool that does not track you across sites, plus the strictly necessary cookies that keep you signed in. Neither needs a consent banner.

Direct marketing (B2B outreach)

Nexley AI Limited (company no. 17217484, registered office 66 Paul Street, London EC2A 4NA) sends business-to-business marketing email to limited companies and LLPs in the UK trades. Contact details for this come from publicly accessible business listings (for example Google Maps business profiles) and the Companies House register, and we verify corporate status before sending — under PECR we do not send marketing email to sole traders or partnerships. Our lawful basis is legitimate interests (Art 6(1)(f): marketing a trade-relevant service to trading businesses).

You can object at any time, and the right is absolute: reply “stop” to any email, use the unsubscribe link it carries, or email hello@nexley.ai. We then suppress your address permanently and delete the contact details we hold from our marketing lists. We keep no marketing data about you beyond name, business name, role/contact email and the public listing it came from, and we never sell it.

Your rights

Under UK GDPR you can request access to, correction of, export of, or deletion of your personal data, and you can object to or restrict certain processing. You can delete your account and all associated data from within the app (Settings → Delete account), or export your data (Settings → Data export). To exercise any other right, email hello@nexley.ai. You also have the right to complain to the ICO (ico.org.uk).

Requests from public authorities

We only disclose personal data to a public authority (for example the police, a regulator or a court) where we are legally required to. For every such request we:

• review it to confirm it is lawful, comes from an authority with the power to make it, and follows the proper legal process;
• challenge or refuse a request we consider unlawful, too broad or not properly made, taking legal advice where needed;
• disclose only the minimum data needed to answer it;
• keep a record of the request, our response, the legal reasoning and who was involved.

Where the law allows, we tell the affected business before we disclose anything. Data we receive from Instagram, Facebook or WhatsApp is handled the same way.

Children

Nexley AI is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes & contact

We’ll update this page and the date above when this policy changes materially. Questions or requests: hello@nexley.ai.