Privacy

NEXO Spain is operated by WP Media LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. For any privacy question, or to exercise the rights described below, write to [email protected]. The operating company is registered in the United States; the application and its database run on servers in the European Union, in Amsterdam.

For an account: your email address, your language preference, and the case you build up — the questions you ask, the answers given, and the facts you enter in a guided procedure. For a purchase: the transaction record from our payment provider. We never ask for, and you must never enter, your Cl@ve or digital-certificate credentials, banking passwords or one-time codes.

When you ask for a NEXO Expert call or for professional help, we keep your request: the service and, for professional help, the area; your preferred language; the guide it relates to, if you chose one; your description of the situation; for an Expert call, the days and times that suit you; and the moment you agreed to this. We use it to answer you, arrange the call or introduce a professional, and keep track of the request. For professional help, we share your description with the professional only after you have confirmed that introduction. The description and preferred times are encrypted when stored, the email we receive about a new request contains no details of your situation, and your request is not sent to the AI provider. The request is kept while your account exists and is deleted with it, or earlier if you ask us at [email protected]. For a paid call, the payment and booking record, without your description, is kept for six years after payment for accounting purposes. The lawful basis is taking steps at your request before a contract and performing it (GDPR art. 6(1)(b)), and, for the payment record, a legal obligation (art. 6(1)(c)).

Answers are generated by OpenAI models — currently gpt-4o-mini for text and text-embedding-3-small for search — working against a knowledge base of official sources that a human has verified. Your question text is sent to OpenAI to produce the answer. Your data is not used to train any model. A data-processing agreement with the AI provider is being put in place; until it is signed this is an interim arrangement, disclosed here rather than left unsaid.

The first questions can be asked without signing in, and those are deliberately built to identify nobody. No raw IP address and no cookie token is ever stored. Instead the service keeps a one-way, purpose-separated cryptographic pseudonym, and an IPv6 address is generalised to a /64 block before that pseudonym is derived. Those rows expire by themselves — thirty days for a session, twenty-four hours for the rate-limit bucket — and no conversation is saved. The text of each question is kept, with email addresses, phone numbers and document numbers removed, and with nothing that links it to you or to your other questions. It is deleted twelve months after the question was asked.

Saved conversations are kept while your account exists and are deleted with it, or earlier if you ask us. They may be used to improve NEXO's answers. Account and case data are kept while the account exists. Deleting your account from your account page is carried out immediately. A deletion request sent to us is carried out 48 hours after we confirm it by email, so it can still be cancelled if it was a mistake. Payment records are kept for as long as tax law requires.

Railway hosts the application and database in the European Union. OpenAI generates answers and search embeddings. Tavily runs the web search behind unverified answers, and receives a redacted query with contact details such as email addresses stripped out before it is sent. Resend delivers sign-in emails. Stripe processes payments and shows its own checkout page, so card details never reach us. Cloudflare measures visitor numbers, and receives the page address, your IP address and your browser's user agent in order to do it. Google Analytics measures how the site is used, but only for visitors who accept it; it receives the page address, your IP address, your browser's user agent and the identifiers in its own cookies, and keeps event data for 14 months. Transfers outside the European Economic Area rely on standard contractual clauses or an adequacy decision.

You may request access to your data, correction, erasure, restriction, portability, and you may object to processing or withdraw consent where consent is the basis for it. Write to [email protected]. If you are in Spain you may also complain to the Agencia Española de Protección de Datos (aepd.es), and elsewhere in the European Union to your national supervisory authority.

Strictly necessary cookies are always on: one to keep you signed in, one to remember your language, and one that carries the anonymous-question session. There is no advertising cookie, and NEXO runs no advertising. Visitor numbers are measured with Cloudflare Web Analytics, which sets no cookie and stores nothing on your device. Google Analytics is different — it sets its own cookies, _ga and _ga_ followed by the property identifier — so it is not loaded at all until you accept it, and rejecting it or ignoring the banner leaves it unloaded. You can change your answer at any time from “Cookie settings” at the foot of any page.

This service is not directed at children under 14 and their data is not knowingly processed.

This policy will change as the product does. The date at the top of this page always shows when it last changed, and registered users are told about material changes.