Effective date: 1 October 2026
This policy explains what personal data NexoMind collects, why, who it is shared with, how long it is kept, and how you can have it deleted. It is written under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL"). Where you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR give you the same rights, and this policy applies to you in the same way.
1. Who we are
NexoMind is operated by NexoMind FZ-LLC, a free zone limited liability company licensed by the Dubai Development Authority (Dubai Internet City), licence no. 106544, with its registered address at First Floor, In5 Tech, Dubai Internet City, Dubai, United Arab Emirates. You can reach us about anything in this policy at support@nexomind.net.
NexoMind provides an AI sales advisor that businesses in building materials, HVAC, lighting and related trades add to their website, phone line and WhatsApp number. The advisor talks with the business's customers, searches the business's own product catalog, recommends products and prepares quotes or hands the customer to a person at the business.
2. Our role: processor for businesses, controller for our own operations
When you talk to a business's advisor, whether on its website, by voice or on WhatsApp, that business is the controller of your personal data. It decides why your data is collected and how it is used, and it has its own privacy policy. NexoMind processes your data on that business's behalf and on its instructions, as its processor, under a written data processing agreement.
NexoMind is the controller for the personal data of people who visit nexomind.net, of the staff of business customers who use our dashboard, and of the data we need for billing, security and legal compliance.
If you want to exercise a right over data a business collected through NexoMind, you can contact the business or us. We pass requests to the business where it is the controller and help it answer.
3. What data we collect
We collect only what each channel needs to work.
| Channel | Personal data | How we get it |
|---|---|---|
| Web chat on a business's site | The messages you type; name, phone number, email and company name if you give them; project details such as room sizes, budget and timing; files you upload such as floor plans, mood boards and bills of quantities; which products you mark as liked; IP address, browser type and timestamps | From you, as you chat |
| Live voice (talk to the advisor) | Your speech, converted to text in real time; the transcript of the call; any details you say such as your name or phone number | From you, through your microphone, only while you keep the call open |
| Messages, images, documents and voice notes you send to a business's WhatsApp number; your phone number and WhatsApp profile name; your replies such as STOP or START | From Meta's WhatsApp Cloud API, which forwards messages sent to the business's number to NexoMind | |
| Email and other channels a business enables | The messages you send and the address you send them from | From the business's connected inbox |
| Business staff (dashboard users) | Name, email address, role, login records, and an audit log of actions taken in the dashboard | From the business when it invites you, and from your use of the dashboard |
| Connecting a WhatsApp account (business admins) | Your Facebook user identity as returned by Facebook Login for Business, the WhatsApp Business Account ID, phone number ID and the access token Meta issues | From Meta, when you complete Embedded Signup |
| nexomind.net visitors | Server access logs: IP address, pages requested, browser type, time | Automatically, from your browser |
We do not ask for and do not want payment card numbers, government ID numbers or passwords in chat. If you send them, the business can delete them, and you can ask us to.
4. Why we use your data
| Purpose | What we do | Legal basis under the PDPL |
|---|---|---|
| Run the conversation | Understand your request, search the business's catalog, recommend products, explain trade-offs, prepare a quote | Performance of the contract between you and the business, or steps taken at your request before one |
| Hand you to a person | Give the business's sales staff your conversation and contact details so they can call you back or send a quote | Performance of the contract, or steps taken at your request |
| Book meetings and follow up | Schedule the consultation you asked for; send the follow-up you agreed to on the same channel | Your consent, which you can withdraw at any time |
| Sales guidance for the business | Summarise your needs, tone and buying stage for the business's sales staff so they prepare well | The business's legitimate interest in serving you; this never produces a decision with a legal or similarly significant effect on you |
| Keep the service secure | Detect abuse, block implausible numbers, keep audit logs | Our legitimate interest in security and in meeting legal obligations |
| Improve the service | Measure which recommendations customers engage with, in aggregate, to improve ranking | Our legitimate interest; no marketing profiles are built across businesses |
| Comply with law | Keep records tax and company law require; answer lawful requests from authorities | Legal obligation |
We do not sell personal data. We do not use one business's customer data to serve another business. We do not run advertising on any surface.
5. How AI processes your messages
The advisor's replies are generated by large language models. To produce each reply, the text of the conversation, the business's catalog data and the business's instructions are sent to Anthropic (Claude models). On voice calls your speech is streamed to OpenAI, which converts it to text, generates spoken replies and returns them; NexoMind keeps the transcript, not the audio. Product search uses OpenAI embedding models.
These providers process your data only to answer the request, under contract terms that prohibit using it to train their models. Every product, price and stock status the advisor states comes from the business's own catalog record. A person at the business can take over any conversation at any time, and you can ask for a person at any point.
6. Who we share data with
The business you are talking to. It receives everything you share with its advisor; it is the controller.
Sub-processors. These companies process data for us under written contracts and only on our instructions.
| Sub-processor | What it does | Where it processes |
|---|---|---|
| Meta Platforms (WhatsApp Cloud API, Facebook Login for Business) | Delivers WhatsApp messages between you and the business; authenticates business admins who connect a WhatsApp account | Global, under Meta's terms |
| Anthropic | Generates the advisor's text replies | United States |
| OpenAI | Live voice recognition and speech, product-search embeddings, voice transcription | United States |
| Supabase | Database hosting and dashboard sign-in | Singapore |
| Railway | Application hosting | Singapore |
| Cloudflare | Website and app delivery, file storage for uploads, network security | Global edge; storage in the region Cloudflare assigns |
| Resend | Sends transactional emails such as sign-in links and invitations | United States |
We update this table when a sub-processor changes and notify business customers under their data processing agreement.
Authorities and legal process. We disclose data when a law, court order or regulator with jurisdiction requires it, and we tell the affected business where the law allows.
Business transfers. If NexoMind is acquired or merges, your data passes to the new owner under this policy, and we notify business customers.
7. International transfers
NexoMind stores data in Singapore and uses AI and email providers in the United States. The PDPL allows transfers outside the UAE where the receiving country has adequate protection or where contractual safeguards are in place. We rely on written data processing terms with each sub-processor that bind it to protect the data to the standard the PDPL requires, and business customers approve these transfers in their data processing agreement with us. UAE or GCC-only hosting is available to business customers as a separate engagement.
8. How long we keep data
| Data | Kept for |
|---|---|
| Conversation transcripts, uploads and sales-guidance summaries | As long as the business sets in its retention window. If the business sets no window, until the business or you ask for deletion |
| Contact details, quotes, deals and meeting records | While the business holds an account with us, then deleted within 90 days of the account closing, unless the business exports them first |
| WhatsApp messages and media | Same as conversation transcripts; media files are stored with the conversation and deleted with it |
| Dashboard user accounts and audit logs | While the user is a member of the business's team; audit logs for the life of the business's account plus 90 days |
| WhatsApp connection data (business asset IDs, access token) | Until the business disconnects WhatsApp or closes its account |
| Server and security logs | 30 days |
| Billing and tax records | As UAE commercial and tax law requires, currently 5 years |
| 9. Security | Each business's data is isolated in its own tenant: database row-level security and application checks enforce that a business only ever sees its own records. Data is encrypted in transit (TLS) and at rest. Access by NexoMind staff is limited to named operations staff, logged, and used only for support and incident response. Sales staff at a business see only the customers assigned to them unless the business grants wider access. Uploaded files are stored per tenant and deleted when the conversation is deleted. If a breach affects your data we notify the controlling business without undue delay and within 72 hours of confirming it, and the UAE Data Office as the PDPL requires. |
10. Your rights
Under the PDPL you can ask to:
- access the personal data we hold about you and receive a copy in a common format;
- correct data that is inaccurate or incomplete;
- delete your data (see the deletion section below);
- restrict or object to processing, including any processing based on legitimate interest;
- object to automated processing that would produce a legal or similarly significant effect on you (we do not carry out such processing);
- withdraw consent at any time, for example by replying STOP on WhatsApp, which stops further messages on that channel;
- complain to the UAE Data Office, or to the data protection authority in your country of residence.
Write to support@nexomind.net. We confirm receipt within 5 business days and answer within 30 days. We may ask you to verify your identity, for example by replying from the phone number or email address the data is linked to. There is no charge unless a request is clearly repetitive.
11. Cookies and browser storage
nexomind.net and the chat surfaces set no advertising or third-party analytics cookies. The chat stores a small set of values in your browser's local storage so that you can resume your conversation, keep your product likes and remember your sound preference; clearing site data removes them. The dashboard uses a sign-in session cookie that Supabase sets to keep business staff logged in. Our hosting providers keep the server logs described above for security.
12. Children
NexoMind's services are for businesses and their trade or consumer customers. They are not directed at anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, write to support@nexomind.net and we will delete it.
13. Changes to this policy
We post changes on this page with a new effective date. For changes that reduce your rights or add a sub-processor, we notify business customers at least 30 days before they take effect.
14. Contact
NexoMind FZ-LLC, First Floor, In5 Tech, Dubai Internet City, Dubai, United Arab Emirates. Email support@nexomind.net for anything concerning your personal data.
15. Deleting your data
You can have your personal data deleted from NexoMind at any time. This applies to anyone who has talked to a business's advisor on its website, by voice, by email or on WhatsApp, to staff of a business who use our dashboard, and to anyone who signed in with Facebook Login for Business to connect a WhatsApp account.
A short version of this section is at nexomind.net/data-deletion. The two say the same thing; this section is the full one.
How to ask
- Email support@nexomind.net with the subject "Deletion request". Tell us the business you dealt with, the channel (website chat, voice, WhatsApp, email or dashboard) and the phone number or email address you used. Send the request from that same phone number or email address where you can, so we can verify it is you without asking for anything more.
- Or ask the business you talked to. It can delete your record itself from its NexoMind dashboard, which removes your data from our systems in the same way.
- On WhatsApp, replying STOP ends further messages from the business on that channel. It does not delete your history; send the email in step 1 for that.
What happens next
- We confirm receipt within 5 business days and, if needed, ask you to verify your identity.
- Where the business is the controller of your data, we forward your request to it within those 5 business days. The business confirms the deletion, or tells us of a legal reason to keep a specific record.
- We delete your data within 30 days of receiving your request. Deletion is permanent and covers your conversations and transcripts, uploaded files, contact details, quotes, deals, meeting bookings, sales-guidance summaries and, for business admins, the Facebook identity and WhatsApp access token from the signup. Each deletion is recorded in the business's audit log without your personal data.
- We email you to confirm the deletion is complete.
What we may keep, and why
- Invoices and records that UAE tax and commercial law require us to keep, for the period the law sets.
- Security and server logs, which delete themselves within 30 days.
- Copies in encrypted backups, which rotate out within 30 days of the deletion.
- Where a law or a legal claim requires us to keep a specific record, we tell you which record and why.
If you connected WhatsApp through Facebook Login for Business
Removing the NexoMind app in your Facebook settings does not reach us automatically. Email support@nexomind.net and we delete the identity we received from Meta and revoke the stored access token within 30 days. Disconnecting WhatsApp in the NexoMind dashboard revokes the token immediately.
If you are a business closing its account
Export your customers, deals and quotes from the dashboard first. We delete all your tenant data within 90 days of the account closing, and confirm in writing.