Privacy policy

The controller of the personal data described in this policy is Nexxo Assist, an Argentine company. For any question or to exercise your rights, email us at [email protected].

This policy applies to our website and to platform accounts. For the conversations visitors have with the agents our customers install on their websites, each customer is the controller and we process that data on their behalf (as a processor), following their instructions.

• Account data: name, email, company, password (stored hashed), language and data about your team members.
• Billing data: plan, payment history and PayPal subscription identifiers. We do not store card numbers.
• Content you upload or connect: documents, catalogs, instructions, encrypted credentials for your integrations and AI provider keys.
• Conversations: visitors' messages with your agents and the data they share (for example, name, email or phone number).
• Technical data: IP address, browser, access and error logs, needed for security and operation.
• Website usage data: only if you accept analytics cookies (see the Cookie policy).

• Creating and managing your account and providing the service.
• Processing payments, issuing receipts and managing the subscription.
• Running your agents: checking your sources, generating answers and taking actions with your permission.
• Sending you service emails: account notices, charges, security and changes to the terms.
• Providing support and answering your questions.
• Preventing fraud and abuse and protecting the platform's security.
• Measuring and improving the website, only with your consent to analytics.
• Complying with legal, accounting and tax obligations.

We do not sell your personal data or use it to train AI models.

• Performance of the contract: to provide the service you signed up for, under the Terms and conditions.
• Consent: for website analytics and other optional uses. You can withdraw it at any time.
• Legal obligation: to keep accounting and tax records and respond to requests from authorities.
• Legitimate interest: for security, fraud prevention and improving the service, without affecting your rights.

We share data only with the providers we need to deliver the service, who process it on our behalf under confidentiality and security obligations:

• PayPal: processing payments and subscriptions.
• Hosting and cloud infrastructure provider: servers, databases and backups.
• Email delivery provider: service and account emails.
• Google Analytics: website usage statistics, only if you accept analytics cookies.
• The AI providers you configure (for example, OpenAI, Anthropic, Google or Groq): they receive the messages and context needed to generate answers, with your own keys and under their terms.
• The platforms you connect (stores, ERP, CRM): we exchange with them the data needed for the lookups and actions you set up.

We may also disclose data when required by law or by an order from a competent authority.

Some of these providers have servers outside Argentina (for example, in the United States or the European Union). When we transfer data to countries without an adequate level of protection under Law 25,326, we do so under contractual clauses or other safeguards required by the regulations, or with your consent.

• Account data and its content, while the account is active.
• When the account is closed, we delete it within 30 days, except backups, which rotate within up to 30 more days.
• Billing records, for as long as accounting and tax rules require (generally 10 years).
• Technical and security logs, up to 12 months.
• Your agents' conversations, while your account is active or until you delete them.

You can request access, rectification, updating and deletion of your personal data, and withdraw your consent at any time, by emailing [email protected]. We answer access requests within 10 calendar days and rectification, updating or deletion requests within 5 business days, as set by Law 25,326.

If you are a visitor of one of our customers' websites, send your request to that customer; if you write to us, we will forward it.

The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, under article 14, paragraph 3 of Law 25,326.

The AGENCY FOR ACCESS TO PUBLIC INFORMATION (AAIP), as the Supervisory Authority of Law 25,326, has the power to handle complaints and claims filed by those whose rights are affected by non-compliance with personal data protection rules. More information at argentina.gob.ar/aaip.

We apply reasonable technical and organizational measures to protect your data: encrypted connections (HTTPS), encryption of stored credentials and AI keys, hashed passwords, role-based access control and backups. No system is infallible: if an incident affects your data, we will notify you without undue delay.

The platform is not aimed at people under 18 and we do not knowingly create accounts for them. If you know a minor has given us personal data, write to us and we will delete it.

We may update this policy. If a change is significant, we will email you 30 days in advance. The effective date is shown at the top of this page. The Spanish version is binding.