← Back

Data Processing Agreement

Last updated: July 29, 2026

Scope of this Addendum

This Data Processing Agreement (the "DPA") is the addendum that applies where Nexor AI, Inc. ("Nexor") processes Customer Data on behalf of the Customer. It forms part of the Agreement and governs the Customer's instructions, security, Subprocessors, incidents, data subject rights, audit, and CCPA specific terms.

1. Scope and term

This DPA forms part of the Agreement and applies to the processing of personal data contained in Customer Data. It takes effect together with acceptance of the Agreement through payment of the implementation fee and remains in force for as long as Nexor processes that data, including during limited periods of return, backup, or legal retention.

2. Roles of the parties

The Customer is the controller and Nexor is the processor, service provider, or contractor, as applicable under governing law. Each party will comply with the obligations that apply to it. Nexor does not by itself determine the purposes of the Customer's campaigns or the legal basis for contacting End Users.

3. Details of the processing

The processing carried out by Nexor on behalf of the Customer corresponds to the following elements.

  • Subject matter: provision, security, support, maintenance, and operational improvement of the contracted Services.
  • Duration: the term of the Agreement and the limited subsequent period necessary for return, deletion, backup copies, and legal obligations.
  • Nature: collection, recording, organization, structuring, storage, consultation, semantic search, analysis, generation, transmission, authorized combination, erasure, and destruction.
  • Purpose: configuring agents through the Customer's rules, context, and knowledge; automating communications and business processes; operating integrations, catalogs, inventories, reporting, support, security, observability, and continuity.
  • Data subjects: Authorized Users, prospects, Leads, customers, subscribers, contacts, and other individuals included by the Customer.
  • Categories: identifiers, contact information, communications, recordings, transcripts, metadata, commercial data, technical data, inferences, and additional categories indicated by the Customer.
  • Sensitive data: not contemplated by default. It may be processed only where it is documented, necessary, supported by a legal basis, and subject to additional agreed measures.

4. Customer instructions and responsibilities

  • The Customer instructs Nexor to process the data in order to provide the Service in accordance with the Agreement, the configurations, the support tickets, and other compatible documented instructions.
  • The Customer represents that its instructions are lawful, that it has informed the data subjects, and that it holds the necessary rights, consents, and legal bases.
  • The Customer will determine whether a data protection impact assessment, sector authorization, prior consultation, or additional agreement is required before activating a use case.
  • Nexor will give notice where it considers that an instruction manifestly infringes the law and may suspend that instruction until it is clarified or modified.

5. Nexor's obligations

  • Process the data solely under the Customer's documented instructions, except where an applicable legal obligation requires otherwise; in that case Nexor will give prior notice where the law permits.
  • Ensure that authorized personnel are bound by confidentiality and receive adequate training.
  • Implement reasonable security measures in accordance with Section 7 and Annex B.
  • Reasonably assist the Customer with data subject rights, incidents, impact assessments, and inquiries from authorities.
  • Maintain records and information sufficient to demonstrate compliance with this DPA.
  • Not sell or share Customer Data for behavioral advertising, and not retain, use, or disclose it outside the direct relationship and the specified purposes, absent express legal authorization.

6. Confidentiality and personnel

Nexor will limit access to personnel and contractors who need the data for their functions, will apply role based controls, and will require confidentiality commitments that survive the termination of their relationship.

7. Security

Nexor will maintain a security program proportionate to the volume, sensitivity, and risk of the processing. Specific measures may evolve without materially reducing the overall level of protection during the contracted term. The areas covered and their general measures are as follows.

  • Governance: internal owners, policies, risk assessment, incident management, periodic reviews, and the progressive preparation of the compliance program toward ISO/IEC 27001 and SOC 2 Type II. Nexor does not currently claim to hold those certifications.
  • Access: least privilege, individual accounts, mandatory MFA on administrative consoles, access review and revocation, and role based access control within the application, including the superadministrator, owner, administrator, and agent profiles. Service keys remain exclusively on the server side.
  • Technical protection: TLS 1.2 or higher in transit; AES-256, or equivalent provider controls, at rest; logical segregation; Row Level Security (RLS) policies at the database layer; logging and monitoring; vulnerability management; secrets stored in an encrypted manager outside the code repository; Cloudflare WAF, request rate limiting, mitigation of automated or bot traffic, and protection against DDoS attacks; and Vercel firewall or WAF controls where applicable.
  • Continuity: daily backups of the primary data stores, point-in-time recovery where the configured infrastructure allows for it, reasonable redundancy, and recovery and continuity procedures.
  • Providers: due diligence, data protection agreements, and assessment of relevant changes. Vercel, Cloudflare, Supabase, Render, Stripe, OpenAI, xAI, Anthropic, Google (Gemini), and underlying cloud providers such as AWS may be involved, depending on the applicable service and region.
  • Development: change controls, code review or equivalent processes, secrets management, and secure development practices aimed at mitigating the risks described in the OWASP Top 10.
  • Deletion: deletion, expiration, or overwriting procedures in accordance with the Customer's documented instructions, the applicable retention, and backup cycles, with exceptions for legal obligations or documented legal holds.
  • Infrastructure: ephemeral compute on managed containers where applicable. Ordinary operations do not depend on direct SSH access to servers or on stable public server IP addresses.
  • Isolation between customers: Row Level Security (RLS) policies and segregation controls enforced in the database engine, designed so that each query accesses only the data of the corresponding customer, even where the application logic fails.
  • Artificial intelligence oversight: conversation observability, automated evaluations, internal alerts, automated health checks of the models and of deliverability, interaction logs, and a Playground environment for testing. Logs are retained in accordance with the configuration and the applicable retention policy.
  • Provider assurance: according to each provider's documentation in force, Supabase and Render maintain SOC 2 Type II; Cloudflare and Vercel maintain compliance programs that include SOC 2 Type II and ISO 27001; and Stripe operates as a PCI DSS Level 1 service provider. These certifications belong to the providers and do not constitute a certification of Nexor.

8. Subprocessors

The Customer grants Nexor a general authorization to engage Subprocessors. Nexor will:

  • Enter into agreements that impose substantially equivalent obligations.
  • Remain responsible to the Customer for the performance of its obligations.
  • Give notice of material changes through the published list or by email, with reasonable advance notice where possible.

Right to object

The Customer may object in good faith to a new Subprocessor on documented data protection grounds within 10 calendar days of the notice. The parties will seek a reasonable solution. If no commercially viable alternative exists, either party may terminate solely the affected component, with a refund of the prepaid and unused portion.

Relevant Subprocessors

The relevant Subprocessors may include:

  • Vercel: application infrastructure, Vercel AI Gateway, and security.
  • Cloudflare: WAF, request rate limiting, mitigation of automated or bot traffic, and protection against DDoS attacks.
  • Supabase: database, authentication, storage, and backups.
  • Render: managed compute and server services.
  • Stripe: billing and payments.
  • OpenAI, xAI, Anthropic, and Google (Gemini): processing of requests through artificial intelligence models.

Underlying infrastructure and current list

These providers may rely on underlying cloud infrastructure, including AWS, depending on the service and region. The list in force, together with the providers' functions and general locations, may be requested by writing to gabriel@getnexor.ai.

9. International transfers

Nexor will not carry out international transfers outside the Customer's general instructions and the locations necessary to provide the Service. Where a contractual mechanism is required, the parties agree to incorporate by reference the applicable mandatory clauses or annexes and to cooperate with risk assessments and reasonable supplementary measures.

10. Data subject requests

If Nexor receives a request directly with respect to Customer Data, it will notify the Customer and will not respond substantively absent an instruction or a legal requirement. Nexor will provide reasonable features and assistance to search, access, export, rectify, restrict, or delete data. The Customer is responsible for verifying identity, deciding the response, and meeting the statutory deadlines.

11. Personal data incidents

Nexor will notify the Customer without undue delay after confirming unauthorized access to, use, disclosure, alteration, loss, or destruction of Customer Data. The notification will include, to the extent available: the nature of the incident, the categories of data and data subjects affected, the likely consequences, the measures taken, a point of contact, and relevant updates.

Investigation, cooperation, and notifications

Nexor will investigate and mitigate the incident, will preserve reasonable evidence, and will cooperate. The notification does not constitute an admission of fault. The Customer will be responsible for notifying data subjects, authorities, and third parties, unless the law imposes that obligation directly on Nexor.

12. Impact assessments and authorities

Taking into account the nature of the processing and the information available, Nexor will reasonably assist the Customer with impact assessments, prior consultations, and requests from authorities. Where the assistance exceeds ordinary support or arises from the Customer's special instructions, the parties may agree on reasonable fees.

13. Return and deletion

Upon termination of the Service, or earlier where the Customer issues a valid documented instruction, Nexor will return a standard export or delete the Customer Data within a reasonable period and in accordance with its technical capabilities.

Exceptional retention

Nexor may retain:

  • Backup copies until their ordinary overwriting.
  • Data required by law.
  • Minimum evidence for security and defense, always blocked, with restricted access and subject to this DPA.

14. Audit

Once per year, Nexor will make available the information reasonably necessary to demonstrate compliance, such as questionnaires, control summaries, security addenda, and any provider certifications or reports that are available. Nexor is preparing its program toward ISO/IEC 27001 and SOC 2 Type II, but does not currently claim to hold those certifications.

Independent audit

If the available information is not sufficient for a documented regulatory reason, the Customer may request an independent audit, upon 30 calendar days' notice, during business hours, without accessing other customers' data, subject to confidentiality and at the Customer's own cost. Additional audits may be conducted following a material incident or by order of an authority.

15. CCPA specific terms

Where the CCPA applies, Nexor will act as a service provider or contractor with respect to the personal information received from the Customer. Nexor undertakes to:

  • Not sell or share the personal information.
  • Process it solely for the specific business purposes described in the Agreement.
  • Not retain, use, or disclose it outside the direct business relationship, except as permitted by the CCPA.
  • Not combine it with information received from other persons or collected from its own interaction, except where the CCPA permits it.
  • Provide the same level of protection required by the CCPA and assist with consumer requests.
  • Give notice if it can no longer comply and allow the Customer to take reasonable measures to stop and remediate unauthorized uses.
  • Enter into equivalent terms with Subprocessors.

16. Precedence and liability

In the event of a conflict between this DPA and the Terms, the DPA prevails with respect to the processing of personal data. Liability arising under the DPA is subject to Section 18 of the Terms, unless applicable law prohibits that limitation.

Annex A. Specific instructions in the Commercial Terms

The Commercial Terms may supplement or limit: enabled channels, categories of data, hosting regions, retention, special Subprocessors, enhanced measures, authorized sensitive data, security contacts, and transfer mechanisms.

Annex B. Contacts

Each party designates the following contacts by subject matter:

  • Privacy: at Nexor, gabriel@getnexor.ai; at the Customer, the email address indicated in the Commercial Terms.
  • Security and incidents: at Nexor, gabriel@getnexor.ai; at the Customer, the security contact indicated in the Commercial Terms.
  • Legal notices: at Nexor, gabriel@getnexor.ai; at the Customer, the representative and the email address indicated in the Commercial Terms.

Contact

Inquiries regarding this DPA, data subject requests that concern Customer Data, and security notifications may be directed to the contacts indicated in Annex B. For operational matters, the Customer may use the support channels defined in its Commercial Terms.

Registered address: 1209 Orange Street, Wilmington, DE 19801, United States.