NEXIRTNEXIRT
Talk to us
Legal

Privacy Policy

Last updated 2026-10-06.

What we collect

  • Contact form: your name, company, email, budget range, timeline, message, and the plan or service you picked on the way.
  • How you found us: campaign tags (utm_*), the referring page and the first page you landed on, kept for your browser session and sent with a form or checkout.
  • NEXIRT Copilot: the messages you and the assistant exchange (see below).
  • Client portal accounts: your name, email, company and role, and what you do in the portal (requests, messages, files).
  • Payments: your name, email, billing address, plan and payment status. Card details go straight to Stripe; we never see or store your full card number.
  • Newsletter: your email address and your subscription status.
  • Abuse protection: request metadata (IP address, user agent, Turnstile result) when you use a form or the assistant.
  • Site analytics: which pages you view, how far down a page you scroll (25/50/75/100%), which buttons you click, where you arrived from (campaign tag or referring site), a rough screen-size bucket (small, medium or large), and a random session id that lives only in your browser tab and is gone when you close it. Our analytics are first-party (sent only to NEXIRT), set no cookies and record no IP address, account or contact details. If your browser sends Do Not Track or Global Privacy Control, none of it is sent. The client portal is not tracked.

NEXIRT Copilot conversations

When you use the assistant, your messages are sent to Anthropic to generate a reply. The conversation is stored for 30 days and then deleted automatically. During that time NEXIRT engineers read conversations to follow up, answer what the assistant couldn't and improve it. Messages are encrypted in transit and at rest, and they are readable by our engineers and by Anthropic while it writes a reply. We do not use your conversations to train AI models, and Anthropic processes them under its commercial terms, which exclude training on them. If you ask the assistant to have someone contact you, the details you give become an enquiry (see how long we keep it below). Please don't share passwords, health information or payment details in the chat.

NEXIRT staff mailbox (Google, admin only)

NEXIRT can connect its own staff mailbox to a private admin page so we can list, search, open, send and organise real mail, including mail Google filed under Spam or Trash. NEXIRT is the operator, Google is the source and Amazon Web Services runs the back end. The permission lets the page read mail, send mail as the mailbox or one of its verified aliases, mark mail read or unread, star it, archive it, move it to Spam or a label, and move it to Trash. None of that happens on its own: each change or send is made only when a signed-in admin presses a button. Delete only moves mail to Trash, where Google keeps it for 30 days; the page never permanently deletes mail. Mail is read from Google when an admin opens the page and is not copied into NEXIRT storage. The one exception is a draft an admin writes on that page: NEXIRT saves its recipients, subject and body (a reply includes the text it quotes) in its own database. Only NEXIRT admins can open it, never clients. It stays until the admin sends or deletes it and does not expire on its own (if removing it fails, NEXIRT retries the next time the admin opens Mail in that browser); a deleted draft remains in encrypted database backups for up to 35 days. Files an admin attaches to such a draft are saved in NEXIRT's own storage (Amazon S3, encrypted) until the message is sent, then removed with the draft; any left behind are deleted automatically 30 days after they were uploaded. An email's own HTML is shown in a locked frame that cannot run scripts or submit forms; the page lets the email load images from the sender's servers unless the admin blocks them for that message. NEXIRT keeps the saved Google permission in AWS Secrets Manager, a connection record, page bookmarks that stop working after 15 minutes, and an audit log that records what was done (read, send, mark, move, trash), the message id, and for a send only how many recipients and which domains, never the message text, subject, search text or addresses. This mailbox is not available to clients, to Copilot or other AI features, to advertising, to social posts or to AI training. An admin can disconnect at any time, which revokes the permission at Google, or remove it from the Google account permissions page.

Why we collect it

To reply to you, deliver and bill the work you ask for, run your portal account, prevent abuse and understand which pages help people find what they need. We don't sell, rent or trade your information, and we don't use it for advertising.

Who processes it for us

We use these service providers (sub-processors), each only for the purpose listed:

  • Amazon Web Services: Hosting, databases, sign-in (Cognito) and email (Amazon SES), in US regions.
  • Anthropic: Generates NEXIRT Copilot replies from the conversation you send.
  • Stripe: Payments, invoices, subscriptions and the billing portal.
  • Cloudflare: Turnstile bot protection on forms and the assistant.
  • Google: Source of the NEXIRT staff mailbox, read and managed through the Gmail API only when an admin presses a button (see below). Not used for visitors or clients.

How long we keep it

  • Copilot conversations: 30 days.
  • Enquiries (contact form and assistant): kept so we can follow up and keep a record of our conversation, until you ask us to delete them. Submissions we identify as spam are deleted automatically.
  • Client and portal records: for the engagement, plus any period agreed in your contract.
  • Payment and invoice records: as long as tax and accounting law requires.
  • Site analytics events and daily totals: 90 days, then deleted automatically.
  • Security audit logs: about 13 months.

Your rights

Email contact@nexirt.com and we'll tell you what we hold about you, and correct, export or delete it. Some records (such as invoices) we have to keep by law; we'll say which. Depending on where you live you may have further rights, and we honour them.