Privacy Policy – NexaCore

1. WHO WE ARE

NexaCore is an AI startup from Kazakhstan. We build an AI agent platform for businesses: agents sell, answer customers and find new ones in the company's channels, with all work visible in a single dashboard.

• Legal entity: ТОО Nexa Core Tech
• Registered address: Almaty Region, Republic of Kazakhstan
• Contact email: ai@nexa-core.tech
• Website: https://nexa-core.tech

If you have any questions about this Privacy Policy, please contact us at ai@nexa-core.tech.

2. DATA WE COLLECT

We may collect the following categories of personal data:

2.1 Information you provide directly

• Name, company name, job title
• Email address, phone number, country/region
• Company and task details, messages, and attachments sent via website forms, email, or messengers
• Billing and invoicing details (for clients), such as invoicing address, contact person, taxpayer details (if applicable)

2.2 Information collected automatically

When you visit our website, we may automatically collect:

• IP address and approximate geolocation
• Browser type, device type, operating system, language settings
• Pages visited, time and date of visit, referring URL
• Cookies and similar tracking technologies (see Section 6)

2.3 Information from third parties

We may receive information from:

• Analytics providers (e.g., Google Analytics, Yandex Metrica)
• Advertising platforms (e.g., Google Ads, Meta Ads)
• Payment service providers and banks
• Social networks, if you interact with our profiles or sign in through third-party services

3. HOW WE USE YOUR DATA

We use personal data for the following purposes:

• To respond to inquiries, run demos and prepare proposals for connecting AI agents
• To run pilots, provide access to the platform and perform contracts with clients
• To configure agents, provide technical support and communicate about the platform
• To issue invoices, process payments, and manage accounting and tax reporting in Kazakhstan and other applicable jurisdictions
• To improve our website, services, and user experience
• To perform analytics and marketing activities (where permitted by law and with your consent where required)
• To comply with legal obligations under the laws of the Republic of Kazakhstan and other applicable regulations
• To prevent fraud, security incidents, and misuse of our services

4. LEGAL BASES FOR PROCESSING (GDPR AND KAZAKHSTAN LAW)

For users from the European Economic Area (EEA), the United Kingdom, and other jurisdictions with similar data protection laws, our legal bases include:

• Performance of a contract – when processing is necessary to perform a contract with you or to take steps at your request before entering into a contract
• Legitimate interests – for business development, analytics, service improvement, and security, provided these interests are not overridden by your rights
• Consent – for certain marketing activities, cookies, or where otherwise required by law
• Legal obligation – when processing is required to comply with tax, accounting, and regulatory requirements

For users in Kazakhstan, we process personal data in accordance with the applicable laws of the Republic of Kazakhstan on personal data and its protection, relying on:

• Your consent, where required
• The necessity to perform a contract or pre-contractual steps
• Compliance with Kazakhstani law and regulatory obligations

5. HOW WE SHARE YOUR DATA

We may share your data with:

• Service providers and contractors (e.g., hosting providers, email services, analytics providers, CRM systems, payment processors, cloud infrastructure providers) strictly for the purposes described in this Policy
• Providers of the AI models we use to run the agents — to the extent necessary to provide the services
• Team members involved in configuring and supporting the platform, bound by confidentiality and data protection obligations
• Professional advisors (lawyers, accountants, auditors), when reasonably necessary
• Authorities and regulators in Kazakhstan or other jurisdictions, if required by law, court order, or to protect our rights

We do not sell your personal data to third parties.

6. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to:

• Enable core website functionality and security
• Analyze traffic and usage patterns
• Improve performance, localization, and user experience
• Support marketing and remarketing campaigns (for example, via Google or social networks)

You can manage cookies via your browser settings or, where available, our cookie banner. Disabling certain cookies may affect how our website functions.

If we use third-party analytics (e.g., Google Analytics), these third parties may also collect information as described in their own privacy policies. You may opt-out from some analytics providers via their specific opt-out tools or via your browser.

7. INTERNATIONAL DATA TRANSFERS

Since NexaCore works with international clients and service providers, your personal data may be transferred to and processed in countries outside your country of residence, including:

• Member States of the EU/EEA
• United Kingdom
• United States
• Other countries where our partners or infrastructure providers are located

Where required by law (e.g., under GDPR), we implement appropriate safeguards, such as:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs) with our vendors
• Technical and organizational measures to protect your data

8. DATA RETENTION

We retain personal data only as long as necessary for:

• Providing our services and managing our relationship with you
• Complying with legal, accounting, and tax obligations in Kazakhstan and other applicable jurisdictions
• Resolving disputes and enforcing our agreements

After the relevant retention period expires, we will delete or anonymize personal data in a secure manner.

9. DATA SECURITY

We apply reasonable technical and organizational measures to protect personal data, including:

• Secure communication channels (e.g., HTTPS)
• Access controls and authentication mechanisms
• Limiting access to personal data on a need-to-know basis
• Regular updates, backups, and security monitoring where applicable

Nevertheless, no method of transmission or storage is completely secure. You use our website and services at your own risk, and we encourage you to take appropriate measures on your side (strong passwords, up-to-date software, etc.).

10. YOUR RIGHTS

Depending on your jurisdiction, you may have some or all of the following rights:

• Right of access – to obtain confirmation whether we process your personal data and to get a copy
• Right to rectification – to correct inaccurate or incomplete data
• Right to erasure – to request deletion of your data in certain cases
• Right to restriction of processing – to request restriction under specific circumstances
• Right to data portability – to receive your data in a structured, commonly used format (where applicable)
• Right to object – to object to certain types of processing, including direct marketing
• Right to withdraw consent – where processing is based on your consent

To exercise your rights, contact us at ai@nexa-core.tech. We may need to verify your identity before responding.

If you are located in the EEA, UK or another jurisdiction with a supervisory authority, you also have the right to lodge a complaint with your local data protection authority. In Kazakhstan, you may contact the competent state authority responsible for personal data protection.

11. CHILDREN'S PRIVACY

Our website and services are not directed to children under 16 (or lower age as defined by local law). We do not knowingly collect personal data from children. If you believe that a child has provided us personal data, please contact us and we will take steps to delete such data.

12. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. You should review their privacy policies separately.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last Updated" date at the top indicates the latest revision. Your continued use of our website or services after any changes means you accept the updated Policy.

14. CONTACT

For questions about this Privacy Policy or our data practices, please contact: