Privacy Policy

Who we are

Nexley AI (“Nexley”, “we”) is the data controller for the account data of the business owners who sign up, and a data processoracting on a business owner’s behalf for the messages their customers send to their Nexley. We are a UK data controller subject to the UK GDPR and the Data Protection Act 2018. Contact: hello@nexley.ai.

What we collect

• Account data - your name, email, phone, business details, and authentication identifiers (we use passwordless magic-link / Apple sign-in; we never store a password).
• Content you create - messages you send your AI Employee, photos you capture (receipts, job-site images), contacts, estimates and notes you store.
• Your customers’ messages - when a customer messages your Nexley (via Slack, WhatsApp or the web chat), we process that message and any contact details it contains, on your behalf, so the AI can reply.
• Diagnostics - crash and error reports, and basic usage events, to keep the app working. These are not used to track you across other apps or for advertising.

How we use it & our lawful basis

• To provide the service (generate AI replies, extract data from photos, manage your inbox) - lawful basis: performance of our contract with you.
• To keep it secure and reliable (rate-limiting, error tracking, content moderation of AI output) - lawful basis: our legitimate interests in a safe, working service.
• To meet legal obligations (financial records, responding to data-rights requests) - lawful basis: legal obligation.

We do not sell your data, and we do notuse your data or your customers’ data to train AI models.

AI processing

Your Nexley is powered by large-language-model providers. The text of a message (and, for photo capture, the image) is sent to those providers to generate a reply or extract data. AI output shown to your customers is scanned by an automated moderation step and can be reported in-app for review. Before your Nexley is enabled, the app shows a consent screen naming the AI provider; you can decline.

If you connect Slack

Slack is connected by installing a private Slack app - created from a manifest we provide - in your ownSlack workspace. Your business remains the Slack customer under its own agreement with Slack; Nexley processes, on your behalf, the messages that app receives - the message content and attachments, together with the workspace member IDs and display names Slack attaches to each message. We keep a copy of those conversations - a message ledger on your dedicated server and a communications log in our database - so your Nexley has context and you have a record. Slack Technologies (a Salesforce company) processes this data on its own infrastructure in the United States - see “International transfers” below.

Who we share it with (sub-processors)

We share data only with the infrastructure providers needed to run the service, each under a data-processing agreement:

• Anthropic - the Claude model behind Nexley (message text).
• OpenAI - automated moderation of AI output, and, if you use the Voice feature, live voice processing: your microphone audio during a voice call, its transcription, your business name, your first name, your AI Employee’s name, and the questions and answers spoken during the call. Voice is off unless switched on for your account.
• Supabase - database + authentication (account data, contacts, messages). EU region.
• Amazon Web Services - per-customer compute, UK (London) region.
• Vercel - hosts the dashboard + API.
• Stripe - subscription billing (handled by Stripe; we never see full card details).
• Composio - brokers your connected-integration authorisations and custodies the OAuth tokens (Gmail, Calendar, etc.) your Nexley uses; we hold only a connection reference.
• Google (Analytics) - visitor analytics on our marketing site nexley.ai, only if you accept the cookie banner there (see “Cookies and analytics” below).
• OneSignal - push notifications (device token only).
• Sentry - crash/error diagnostics (EU region).
• Twilio / WhatsApp - message delivery for the channels you connect.
• Slack Technologies (a Salesforce company) - message delivery when you connect Slack; processes data in the United States (see “International transfers” below).

For voice specifically: we replace your customers’ surnames, phone numbers and postcodes before anything is sent - except a name you say yourself during the call, which we speak back to you in your own words.

How long we keep it

• Captured photos: source image deleted after 30 days; extracted data kept while your account is active.
• Chat attachments: up to 90 days.
• Conversation history (Slack, WhatsApp, web chat): kept while your account is active - stored on your dedicated server and in our database - then deleted with your account.
• Account & business data: for the life of your account, then deleted within 14 days of account deletion.
• Financial records: retained as required by UK law (up to 6 years).
• Diagnostics / error logs: 14 days. Moderation reports: up to 1 year.
• Voice calls: we do not record or store the audio. The transcript of a call is saved to your chat history and kept while your account is active.

International transfers

Some of our sub-processors (including Anthropic, OpenAI, Slack and Stripe) process data in the United States. Where personal data leaves the UK we rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, and otherwise on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so your data keeps the same level of protection as it has under UK GDPR.

Cookies and analytics

Our marketing site (nexley.ai) uses Google Analytics 4 to understand how people find and use the site. It is switched off until you say yes: analytics storage is denied by default, and the banner on your first visit is what turns it on. Choose Reject and no analytics cookies are ever set.

If you accept, Google Analytics sets cookies (named “_ga”) that give your browser a random identifier, and we see: the pages you view, the site or ad campaign that referred you, your approximate location (derived from your IP address by Google, which we never see in full), your device and browser, and how you interact with the page - how far you scroll, whether you play the video, and clicks on our phone, WhatsApp, review and book-a-demo links. We do not use it for advertising, and advertising personalisation is switched off. Our lawful basis is your consent (Regulation 6 of PECR and Article 6(1)(a) UK GDPR). This analytics data is kept for 14 months.

To change your mind, clear this site’s data in your browser and the banner will ask you again. You can also install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.

The Nexley app and dashboard (nexley.co.uk) do not use Google Analytics. They use Vercel Analytics, which is cookieless and does not track you across sites, plus the strictly necessary cookies that keep you signed in. Neither needs a consent banner.

Direct marketing (B2B outreach)

Nexley AI Limited (company no. 17217484, registered office 66 Paul Street, London EC2A 4NA) sends business-to-business marketing email to limited companies and LLPs in the UK trades. Contact details for this come from publicly accessible business listings(for example Google Maps business profiles) and the Companies House register, and we verify corporate status before sending — under PECR we do not send marketing email to sole traders or partnerships. Our lawful basis is legitimate interests (Art 6(1)(f): marketing a trade-relevant service to trading businesses).

You can object at any time, and the right is absolute: reply “stop” to any email, use the unsubscribe link it carries, or email hello@nexley.ai. We then suppress your address permanently and delete the contact details we hold from our marketing lists. We keep no marketing data about you beyond name, business name, role/contact email and the public listing it came from, and we never sell it.

Your rights

Under UK GDPR you can request access to, correction of, export of, or deletion of your personal data, and you can object to or restrict certain processing. You can delete your account and all associated data from within the app (Settings → Delete account), or export your data (Settings → Data export). To exercise any other right, email hello@nexley.ai. You also have the right to complain to the ICO (ico.org.uk).

Children

Nexley AI is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes & contact

We’ll update this page and the date above when this policy changes materially. Questions or requests: hello@nexley.ai.