Privacy policy

This policy explains how Nexorai handles personal data on nexorai.dev and in the emails we send to businesses. It covers what the contact form collects, why we use it, how long we keep it, who processes it, the cookies we use (none), the site analytics we run and the rights you have.

This English text is a translation provided for convenience. The French version is the authoritative version of this policy.

Who we are

Nexorai is an engineering studio established in Tunisia. We work remotely with clients worldwide. For anything in this policy, write to hello@nexorai.dev.

What the contact form collects

The form asks for:

• your name and work email address (both required);
• your company name (optional);
• the service you are interested in (required), and optionally your budget and timeline;
• your message (required).

The form also records the language of the page you used. It sends the source of the enquiry (site-form by default), any UTM campaign parameters present in the address (source, medium, campaign, term, content) and the first page you visited. That information is kept in your browser's session storage (see “Cookies and local storage”) and then stored with the enquiry so we can understand where it came from. It is not used to profile you. Please do not put sensitive personal data (health, political opinions, religion, biometric data, and so on) in the message; if you do, we will delete it.

Your IP address is used in memory by the serverless function for a short time to rate-limit the endpoint and block abuse. It is not written to our database. A hidden anti-bot field and the time taken to complete the form are used only to detect spam; a very fast but valid submission is flagged for review rather than discarded.

If you email us directly instead, we receive whatever you include in that email.

Why we use it, and our legal bases

• To answer your enquiry and prepare a proposal. We use your details to reply, ask any necessary questions and, if you want to go ahead, discuss a project. Legal basis: steps taken at your request before entering into a contract (GDPR Article 6(1)(b)).
• To manage the enquiry and our records. We keep a record of the request and our reply so that we can follow up consistently and handle any later question. Legal basis: our legitimate interest in running our business and keeping reasonable records (Article 6(1)(f)).
• To keep the form and the site secure. We use rate limits and spam checks to protect the endpoint and our inbox. Legal basis: our legitimate interest in preventing abuse (Article 6(1)(f)).
• To honour your choices and legal obligations. If you ask us to stop contacting you, we keep your address on a suppression list so that we can comply. Legal basis: our legal obligation to respect your objection (Article 6(1)(c)).
• To understand how the site is used. We count page views and interactions to see which pages and services interest visitors, and to fix slow or confusing pages. Legal basis: our legitimate interest in improving our site (Article 6(1)(f)). You can object at any time — see “Site analytics”.

We do not add contact-form addresses to a marketing list, and we do not sell or rent personal data.

Business contact data we use for outreach

One of the things we build is websites for small businesses. To find businesses we may be able to help, we look at publicly listed companies, review their current website and, where we believe a better site would help, send one short email to say so. We gather this information from places where businesses publish it so that customers can reach them: public business directories and maps (including Google Maps), the business's own website, and public company pages on social networks such as LinkedIn and Facebook.

From those sources we may hold the business name, address and phone number; its website and the public technical and design characteristics of that website; a generic contact address such as info@ or contact@; and, where a business publishes them, the name, role and work email address of a person to contact. We do not collect home addresses, personal (non-work) email addresses, or sensitive categories of data.

Legal basis: our legitimate interest in finding clients for our services (GDPR Article 6(1)(f)). We send one introductory email and, if we hear nothing, a small number of brief follow-ups over the following weeks, then stop. We have documented the assessment behind this and will share it on request. If you object or unsubscribe, we stop immediately and keep your address only on the suppression list.

Email open and click tracking

Our outreach emails may include a small image and tracked links that tell us whether an email was opened or a link was clicked. We use this only to understand whether our outreach is relevant. If you would rather we did not, disable image loading in your email client or reply and tell us; we will stop contacting you. The unsubscribe and link-tracking endpoints on this site exist for this purpose.

Site analytics

We measure how the site is used with Umami, an open-source analytics tool that we host ourselves at umami-droply.vercel.app. It is the only script the site loads from another domain, and it is our own deployment, not an advertising network. Umami sets no cookies, does not build a profile and cannot follow you to other websites.

For each visit, Umami records the page address, the site you arrived from, your browser, operating system, device type, language and screen size, and an approximate location derived from your IP address (country, region and city). Your IP address itself is not stored. It also records anonymous interactions: which links, buttons and page sections you use, how far you scroll, when you open a question in the FAQ, and how quickly the page loads (Core Web Vitals). What you type in the contact form is never sent to analytics. We only record that the form was started, submitted, rejected or abandoned, the field names involved, the service chosen and the budget and timeline ranges.

We use this to understand which pages and services interest visitors and to fix slow or confusing pages. Legal basis: our legitimate interest in improving our site (GDPR Article 6(1)(f)). We do not use analytics for advertising, profiling or automated decisions, and we do not share the data with anyone else.

How to opt out. Analytics is on by default, and you can turn it off for this site at any time: disable analytics (you can enable it again later). The choice is stored in your browser's local storage under nx-analytics and stays on your device. We also honour the DNT (Do Not Track) and Global Privacy Control signals: when your browser sends one, the Umami tracker sends nothing.

Who processes the data

We do not sell or rent personal data. The site and its functions run on providers that act on our instructions under data-processing terms:

• Vercel Inc. hosts the static site, the serverless functions (including the contact-form endpoint) and our self-hosted Umami analytics instance.
• Supabase provides the Postgres database, hosted in the European Union, that stores contact submissions, the suppression list and campaign events.
• OVH provides our email mailbox and SMTP service, used to receive enquiries and send our replies and outreach.

The site does not embed Google Maps, Google Fonts or any Google script. Public Google Maps business listings may be one of the sources we consult when researching a company for outreach, as described above; that is public business information, not a website integration. If you click the booking link, you go to Calendly, a separate service with its own privacy policy; we receive the booking details you choose to share there. Some providers may process data outside the European Union or the United Kingdom; where they do, we rely on the safeguards in their data-processing terms.

Our own working systems are operated from Tunisia.

How long we keep it

• Contact-form messages: 24 months from submission, then deleted by an automated retention job. A notification copy is also delivered to our OVH mailbox; we delete it on the same 24-month schedule.
• Businesses we have looked at but never contacted: deleted within 12 months.
• Businesses we have contacted: anonymised 24 months after our last message, unless we are in a conversation with you.
• Suppression list: kept for as long as needed to honour an opt-out, in a form that identifies the email address only.
• Email open and click events: kept in the website database only until they are collected by our internal system, then deleted.
• Site analytics: up to 24 months, then deleted.

Cookies and local storage

nexorai.dev sets no cookies. Your light or dark preference is stored in your browser's local storage under the key nx-theme; it stays on your device and is not sent to us. Campaign parameters, the source of the enquiry and the first page you visited are kept in your browser's session storage under the key nx-attribution for the lifetime of the tab; they are sent with the form if you submit it and disappear when the tab closes. If you use the analytics opt-out, that choice is stored under nx-analytics, also on your device. The only third-party requests are the analytics script and its measurements, loaded from our own Umami instance (see “Site analytics”), and the link you choose to open if you click the booking link (Calendly) or another external link.

Your rights

Where the GDPR or UK GDPR applies, you have the right to:

• ask what personal data we hold about you and receive a copy;
• ask us to correct, delete or restrict it;
• receive the data you gave us in a portable format;
• object to processing based on our legitimate interests;
• object to direct marketing at any time — this right is absolute;
• withdraw any consent you have given (we do not rely on consent for the processing described here);
• complain to a supervisory authority: in France the CNIL, in the UK the ICO, in Tunisia the Instance Nationale de Protection des Données Personnelles (INPDP), or the authority in your own country.

To exercise any of these rights, email hello@nexorai.dev. We answer within one month. Use the unsubscribe link in any email, reply "no thanks", or write to us if you want us to stop contacting you; we stop immediately and add your address to the suppression list.

Data protection contact

Data protection contact: hello@nexorai.dev. This address handles privacy requests and questions about this policy. If we designate a Data Protection Officer, their details will be published here.

Changes to this policy

We update this page when our practices change and revise the date at the top. See also our Legal notice and our Terms of use.