LEGAL
Privacy Policy
Effective and last updated: 26 September 2026
Nexosk ("we", "our", or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy outlines how we collect, process, store, and safeguard information when business owners, team members, and customers interact with our reputation-management platform, AI drafting utilities, and websites (the "Service").
1. Information We Collect
A. Account and Workspace Information
When you register for Nexosk or create a workspace, we collect your work email address, authentication records (magic code tokens or Google OAuth profile identity), business legal name, public trading name, location addresses, Google Place IDs, brand assets (logos, custom brand colors), and review keyword preferences.
B. Billing and Commercial Transaction Data
When you purchase software or physical NFC/QR review cards, we collect billing contact details. Card purchases also require a recipient name, phone number and delivery address, which are visible only to the workspace owner and authorized fulfillment staff for delivery handling.
Payment Security: Payment instruments (credit cards, debit cards, UPI IDs, and any existing e-mandates) are collected and processed by our payment partners, including Cashfree Payments India Private Limited for new one-time orders and Razorpay Software Private Limited for any historical recurring authorization. Nexosk never receives, stores, or processes complete payment card numbers, CVVs, or banking PINs. We store payment-order references and status receipts. Delivery details are restricted to the purchasing owner and authorized fulfillment staff, and are not included in receipts or webhook logs.
C. Customer Feedback and Journey Data
When a patron initiates a review journey via QR code, NFC tap, or digital link, we process the customer's star rating, selected feedback topics, and optional private written comments. Contact details (email or phone number) are collected only if the customer explicitly opts in to allow the business to contact them regarding low-rating private feedback. We also log standard technical telemetry (IP-derived country/city, browser type, and timestamps) solely for fraud and abuse prevention.
D. Google User Data
If an owner connects Google Business Profile, we request access through Google's verified OAuth consent screen. Depending on enabled functionality, we may access verified location identifiers, business listing details, published reviews, reviewer display names, and owner responses. We store encrypted OAuth tokens to maintain secure synchronization.
2. How We Use Information
We process collected data strictly for legitimate business and service delivery purposes, including to:
- Authenticate workspace owners and managers securely via email OTP or Google OAuth.
- Operate branded customer feedback touchpoints and AI-assisted drafting journeys.
- Process subscription billing, renewals, trial expirations, and compliant GST invoices.
- Deliver transactional notifications (welcome messages, trial countdowns, and payment confirmations).
- Enable audited internal support operations to troubleshoot customer-reported inquiries.
- Enforce plan limits, detect abusive or fraudulent bot activity, and ensure platform security.
- Comply with applicable Indian statutory, tax, and legal obligations.
3. Google API Data and Limited Use Disclosure
Nexosk's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google user data solely to provide or improve customer-facing reputation management features.
- We do not sell Google user data to third parties under any circumstances.
- We do not use or transfer Google user data for serving personalized, retargeted, or interest-based advertising.
- We do not allow humans to read Google user data unless required for security incidents, to comply with applicable law, or with your explicit prior consent for specific technical support.
4. AI-Assisted Processing
When a customer or owner initiates an AI review draft or response suggestion, relevant context (business public name, selected feedback topics, and customer comments) is processed via Google Gemini AI APIs.
- Customer inputs are processed in real-time solely to return drafting suggestions.
- Under our commercial API arrangements, your customer data is not used to train foundational AI models.
- Customers and owners retain full authority to review, modify, or reject any generated draft.
5. Third-Party Subprocessors
We partner with vetted third-party service providers who assist in operating our infrastructure. Each subprocessor is bound by strict confidentiality and security standards:
| Subprocessor | Purpose | Entity Location |
|---|---|---|
| Razorpay Software Private Limited | Payment processing, e-mandates, recurring subscriptions, and tax invoicing | India |
| Supabase Inc. | Managed PostgreSQL database, user authentication, and storage (AWS Mumbai region) | India / United States |
| Vercel Inc. | Application hosting, edge network, and serverless execution | United States / Global CDN |
| Resend Inc. | Transactional email delivery, login OTP codes, and subscription notices | United States |
| Google LLC | Google Gemini AI drafting API and Google Business Profile OAuth synchronization | United States / Global |
6. Internal Support and Audited Operator Access
Authorized Nexosk operations and support personnel may inspect tenant metadata, subscription tiers, and quota counters solely to resolve customer-initiated support tickets, investigate billing discrepancies, or prevent platform abuse. All support actions (such as trial extensions or manual credit grants) are permanently recorded in audited system logs.
7. Data Security and Retention
We employ industry-standard administrative, physical, and technical safeguards, including HTTPS encryption in transit, AES-256 encryption at rest for sensitive OAuth tokens, and strict Row Level Security (RLS) database isolation between tenant workspaces.
We retain workspace data as long as your account remains active. If your workspace is canceled or suspended, data is preserved for at least thirty (30) days to allow reactivation before eventual de-identification or secure deletion. When an owner disconnects Google Business Profile, stored connection tokens are deleted immediately.
8. Your Rights and Data Choices
Under applicable Indian data protection laws and the Digital Personal Data Protection Act (DPDP), you have the right to access, rectify, or request deletion of your personal data held by Nexosk. You may also disconnect third-party integrations or request full workspace deletion by submitting a verified request to our data privacy team at support@nexosk.in.
9. Contact Our Data Protection Team
If you have questions, feedback, or grievance redressal requests regarding this Privacy Policy or our data practices, please contact us at:
Nexosk Data Privacy & Support
Email: support@nexosk.in
Bangalore, Karnataka, India