Privacy Policy

1. Who we are and what this policy covers

Nexyloop is operated by NexyGen LLC ("NexyGen", "we", "us"). This policy explains what information we collect when you visit our website or use the Nexyloop service (together, the "Service"), what we do with it, who we share it with, and the choices you have.

Nexyloop is built for businesses. When an organization uses Nexyloop, the code, conversations, files, mail, meetings and other material that its people put into the Service belong to that organization ("Customer Content"). We process Customer Content on the organization's behalf and under its instructions, as its service provider. For the information we need to run our own business (for example, account and billing records), we decide how it is used, and this policy describes how.

This policy is part of our Terms of Use. If you do not agree with it, please do not use the Service.

2. Information we collect

We collect only what we need to provide the Service:

• Account information from GitHub. When you sign in with GitHub we receive your GitHub user ID, username, name, profile picture, verified email addresses, the organizations you belong to and the repositories you can access. We do not receive your GitHub password.
• Customer Content. Messages you write in chat and in Talk, files and images you upload, designs, documents and plans created in the Service, and the source code, issues and pull requests in the repositories you connect.
• Credentials you give us. API keys, tokens and other secrets you connect so Nexyloop can build, test and deploy your products, and the access tokens from services you connect (such as GitHub, Google, Microsoft, Figma, Telegram, Vercel, Heroku, Supabase, Cloudflare and MongoDB Atlas).
• Mail and calendar, only if you connect them. See section 7.
• Meeting recordings and transcripts, only if you ask Nexyloop to record a meeting. See section 8.
• Billing information. Your plan, invoices and payment status. Card details are collected and stored by our payment processor, Stripe; we never see or store your full card number.
• Technical information. IP address, browser type, device information, pages visited, timestamps and error logs, which our hosting providers record when you use the Service, and the cookies described in section 12.
• Communications. What you send us when you contact support or give feedback.

Voice features use your browser's built-in speech recognition and voices. We receive only the text your browser produces, never the audio. Your browser's maker may process audio under its own privacy terms.

3. How we use information

We use information to:

• provide the Service: answer your questions, investigate issues, propose changes, and, only after you approve them, write code, open pull requests, build previews and deploy;
• decide who may see what, by checking your access with GitHub on every request;
• keep the Service secure, prevent fraud and abuse, and keep a record of every access decision;
• send messages you asked for or need, such as receipts, security notices and Telegram notifications you turned on;
• bill you and keep the financial records the law requires;
• fix faults and improve the reliability of the Service;
• comply with the law and enforce our Terms of Use.

We do not use Customer Content for advertising, we do not build advertising profiles, and we do not use one customer's Customer Content to provide the Service to any other customer.

4. Artificial intelligence

Nexyloop uses AI models provided by Anthropic to understand requests and to write answers, plans, designs and code. To do this, the relevant parts of your Customer Content are sent to Anthropic for processing. Anthropic processes it under commercial terms that prohibit it from training its models on that content.

We do not train AI models on your Customer Content, and we do not allow our providers to do so.

AI output can be wrong. That is why Nexyloop proposes changes and waits for a person's approval before it writes code, and why it tells you when an answer could not be confirmed.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only in these cases:

• Inside your organization. People GitHub says can access a repository can see the Nexyloop projects for that repository. Access is checked again every time, so someone removed from your organization or repository loses access immediately.
• Links you choose to share. If you create a share link, anyone with that link can see the single item it points to until it expires or you stop it.
• Service providers that process data for us under contracts requiring confidentiality and security: Anthropic (AI models), Supabase (database and file storage), Vercel (web hosting and previews), Heroku (background processing), Stripe (payments), Resend (email delivery), Recall.ai (meeting recording, only if you use it), and Telegram (notifications, only if you connect it). Other services, such as GitHub, Google, Microsoft, Figma or your hosting platforms, receive information only because you connected them and asked Nexyloop to work with them.
• Legal reasons. When we believe in good faith that the law, a court order or a valid government request requires it, or that it is necessary to protect the rights, safety or property of our users, the public or NexyGen. Where the law allows, we will tell the affected customer before disclosing Customer Content and will challenge requests that are overbroad.
• Business transfers. If NexyGen is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, subject to this policy's protections.

6. How we keep client information confidential

Keeping one client's work away from everyone else is the most important thing we do. In particular:

• Access is decided by GitHub, not by us. Every time someone opens a project, Nexyloop asks GitHub whether that person can still see the repository. If GitHub cannot be reached or the answer is unclear, access is denied.
• Only verified email addresses count when matching people to organizations.
• Keys and tokens are encrypted before they are stored, are never shown again in full, and are masked wherever they are displayed.
• Every access decision is recorded in an audit log.
• NexyGen personnel access Customer Content only when needed to provide support you requested, to investigate a fault or a security incident, or to comply with the law. Such access is limited to a small number of authorized people bound by confidentiality obligations.
• We never use one client's Customer Content to answer, design or build for another client.

7. Mail and calendar (Google and Microsoft)

If you connect Gmail, Outlook or Google Calendar, Nexyloop reads messages in the threads you label for it, creates drafts and manages its own label in your mailbox, and reads your calendar to find meetings. Nexyloop never sends email on your behalf: replies are saved as drafts for you to review, change and send yourself. Nexyloop never creates, changes or deletes calendar events.

Nexyloop's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the features you turned on; we do not transfer it except as needed to provide those features, for security, or to comply with the law; we do not use it for advertising; we do not use it to train generalized AI or machine-learning models; and no person reads it unless you ask us to, it is needed for security or to comply with the law, or it has been aggregated and anonymized. We apply the same rules to data from Microsoft.

You can disconnect your mailbox or calendar at any time in Nexyloop or in your Google or Microsoft account settings.

8. Meeting recordings

If you ask Nexyloop to record a meeting, a recorder joins the call under a name that says it is recording, so everyone in the meeting can see it in the participant list. It joins only Google Meet, Zoom and Microsoft Teams. Our recording provider, Recall.ai, captures the meeting and produces a transcript, which we store.

A transcript can be read by the person who asked for the recording and by people invited to the meeting whose verified email address matches the invitation. Nobody else in your organization can read it.

Some laws, including Florida's, require the consent of everyone in a conversation before it is recorded. You are responsible for telling participants and obtaining any consent the law requires.

9. Security

We protect information with encryption in transit (TLS) and at rest, encryption of stored credentials, access controls, isolated environments for building and testing code, and audit logging. No system is perfectly secure. If a security breach affects your personal information, we will notify you and the authorities as the law requires.

10. How long we keep information

We keep Customer Content and account information while your account or your organization's subscription is active. When you ask us to delete your account, or after your organization's subscription ends, we delete or anonymize Customer Content within 30 days, except where we must keep it longer to comply with the law, resolve disputes or enforce our agreements. Backups are overwritten on a regular schedule. Billing records are kept for as long as tax and accounting laws require.

Disconnecting a service removes Nexyloop's access to it straight away.

11. Your choices and rights

You can ask us to tell you what personal information we hold about you, to give you a copy, to correct it or to delete it, by writing to admin@nexygen.io. We will verify your identity before acting and will respond within 45 days. If your information is part of an organization's Customer Content, we may refer your request to that organization and help it respond.

California residents. Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing. We do not sell or share personal information, and we do not use sensitive personal information for any purpose that would give you the right to limit it. The categories of information we collect are listed in section 2, their sources are you, your organization and the services you connect, and the purposes are listed in section 3. We will not treat you differently for exercising your rights. You may use an authorized agent, whom we will ask for proof of authority.

We do not respond to "Do Not Track" signals, because we do not track you across other websites.

12. Cookies

We use only the cookies the Service needs: one that keeps you signed in and one that remembers your language. We do not use advertising cookies, and we do not use third-party analytics or tracking cookies. Our payment processor, Stripe, may set its own cookies on payment pages to prevent fraud.

13. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

14. Where information is processed

NexyGen is based in the United States, and we and our service providers process information in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the United States.

15. Changes to this policy

We may update this policy. If a change is material, we will notify you by email or in the Service at least 30 days before it takes effect. The date at the top shows when it last changed.

16. Contact us

NexyGen LLC, Florida, United States. Email: admin@nexygen.io.