Privacy Policy

This Privacy Policy explains how Kononko Technologies, LLC ("Nextora", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit our websites, create an account, or use the Nextora platform (the "Service"). It also describes the rights you have over your personal data.

We have designed Nextora to be privacy-respecting by default and to align with the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA).

It is important to distinguish two situations:

• When we handle data about you as a visitor or account holder, such as your name, email, and how you use the Service, we act as the data controller and this Policy applies directly.
• When our customers use the Service to manage their own contacts, leads, and communications, that content ("Customer Data") may contain personal data of third parties. For that data we act as a data processor on behalf of the customer, who is the controller. Our handling of Customer Data is governed by our agreement with the customer and our Data Processing Addendum. If your data was entered into Nextora by one of our customers, please direct privacy requests to that customer.

Information you provide

• Account and profile data: name, work email, company name, role, and password.
• Billing data: the account owner’s email address and billing country, which we keep in our account system, and the plan, status and billing history of your Subscription. Card and other payment details are collected at checkout by Stripe and Link; we do not receive or store full card numbers.
• Content you submit: contacts, deals, messages, files, and automations you create in the Service (Customer Data).
• Communications: messages you send to our support, sales, or feedback channels.

Information we collect automatically

• Usage data: features used, actions taken, pages viewed, and timestamps.
• Device and log data: IP address, browser type, operating system, and diagnostic logs.
• Cookies and similar technologies: as described under "Cookies" below.

Information from third parties

When you connect an integration (for example, an email or messaging provider), we receive data from that provider as needed to deliver the feature you enabled. We may also receive limited information from authentication or anti-fraud providers.

When you connect Gmail, Nextora reads senders, recipients, subjects, message bodies, timestamps and message/thread identifiers to display and synchronize email conversations in the CRM. You can send messages and replies you compose through the connected Gmail account. Google account and profile information identify and label the connection.

When you connect Google Calendar, Nextora reads the calendar list and event data so you can choose calendars for synchronization and manage meetings in the CRM. The integration supports creating, changing and deleting events in calendars where you have the required access. Imported email and events are stored in Nextora to provide these features.

When enabled CRM AI features run, Nextora may process contact-linked email excerpts to identify customer questions, objections and commitments, and calendar information to prepare meeting briefs. Relevant content may be sent to the AI model provider configured for the workspace. Resulting summaries and excerpts may be stored in the CRM.

Nextora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Data obtained through Google Workspace APIs is not used to develop, improve or train generalized AI or machine-learning models.

Disconnecting an integration, revoking Nextora's access in your Google Account and requesting deletion of information already stored in Nextora are separate actions. To request deletion of Google-derived information held in Nextora, contact [email protected].

We use personal data for the following purposes, relying on the legal bases indicated (under GDPR):

• To provide, operate, and maintain the Service, performance of our contract with you.
• To authenticate users, secure accounts, and prevent fraud and abuse, legitimate interests and legal obligation.
• To process billing and manage subscriptions, performance of contract and legal obligation.
• To provide support and respond to your requests, performance of contract and legitimate interests.
• To improve and develop the Service, including analysing usage trends, legitimate interests.
• To improve the setup assistant from setup conversations you choose to share: if you tick “Share this conversation and the setup log with the Nextora team” at the end of the voice setup, people on our team read the conversation text and the setup log to find bugs and make the assistant better, consent, which you can withdraw at any time by contacting us.
• To notice when a setup conversation went badly, so that we can apologise and add AI credits to your workspace: an AI decision model checks the conversation inside your workspace, and without your consent to share it only the result reaches us, legitimate interests.
• To send service and security notices, performance of contract and legitimate interests.
• To send marketing communications, where permitted, consent, which you can withdraw at any time.
• To comply with legal obligations and enforce our terms, legal obligation and legitimate interests.

We do not sell personal data, and we do not use Customer Data to train AI models without the customer's instruction or consent.

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand how it is used.

• Strictly necessary cookies enable core functionality such as authentication and security; these cannot be switched off.
• Functional cookies remember your settings and preferences.
• Analytics cookies help us measure and improve performance; we use privacy-respecting analytics and set these only with your consent where required.

Where required by law, we ask for your consent before setting non-essential cookies, and you can manage your preferences at any time through the cookie banner or your browser settings.

We share personal data only as necessary and never sell it. Categories of recipients include:

• Subprocessors and service providers that host infrastructure, send email, or provide analytics and support tools, under contracts that require them to protect the data and use it only on our instructions.
• Integrations you choose to connect, to the extent needed to deliver the feature.
• Professional advisers, auditors, and authorities where required to comply with the law, enforce our terms, or protect rights, property, and safety.
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this Policy.

A current list of our subprocessors is available on request and is maintained as part of our Data Processing Addendum.

Payments

Payments for subscriptions and AI credit top-ups are processed by Stripe and by Link (Stripe), which sells them as reseller and merchant of record. For the payment data they process, such as card details, billing address, tax details, fraud checks and receipts, Stripe and Link act as independent controllers, and their own privacy notices apply: https://stripe.com/privacy et https://link.com/privacy. We receive from them what we need to run your Subscription, such as the plan and payment status, but not full card numbers.

We and our service providers may process data in countries other than your own. Where we transfer personal data outside the European Economic Area, the United Kingdom, or other regions with data-transfer restrictions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum.

Workspace servers and backups are hosted in the European Union. AI features send the content needed for a request to the AI model provider, which may process it outside the EU under the safeguards above.

We keep personal data only for as long as necessary for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

Account data is retained for the life of your Account. After your Account is closed, you may export your Customer Data for 30 days, after which we delete or anonymise it in the ordinary course, except where longer retention is required by law (for example, for tax or accounting records). Backups are deleted on a rolling schedule.

Setup conversations you choose to share are kept for 180 days and then deleted.

We apply technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and of stored integration credentials;
• role-based access controls and the principle of least privilege;
• a dedicated server and database for every paid workspace;
• an audit log of sign-ins, record changes and permission grants.

No method of transmission or storage is completely secure, but we work continuously to protect your data and to respond promptly to any incident, including notifying affected customers and regulators where required by law.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• data portability, receive your data in a structured, machine-readable format;
• withdraw consent at any time, where processing is based on consent;
• opt out of marketing communications and of any "sale" or "sharing" of personal data as defined under US state laws;
• lodge a complaint with your local data-protection authority.

To exercise these rights, email [email protected]. We will respond within the timeframe required by applicable law, and we will not discriminate against you for exercising your rights. If your data was provided to us by a Nextora customer (where we act as processor), we will refer your request to that customer.

The Service is intended for business use and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective" date above and, where appropriate, notify you by email or through the Service. We encourage you to review this Policy periodically.

If you have questions about this Policy or how we handle your personal data, contact our privacy team at [email protected], or write to Kononko Technologies, LLC, Privacy Office.