Privacy Policy: how Nexvork handles your data

Last updated: 23 August 2026 · Effective: 23 August 2026 · Nexvork Innovation Pvt. Ltd.

1. Who we are and our role

Nexvork Innovation Pvt. Ltd. ("Nexvork", "we", "us") is registered in Maharashtra, India. We build Nexvork, an AI CRM used on the web at app.nexvork.ai and in the Nexvork mobile app for Android and iOS, in nine editions: real estate, builders and developers, interior design, salon and spa, gym and fitness, clinics and hospitals, medical and pharmacy, AI automation and a custom edition for any other business.

We play two roles. For what you send us on nexvork.ai and for the accounts of people who log in, we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). For the leads, customers, patients and members your business keeps in its workspace ("Customer Data"), your business is the data fiduciary and Nexvork is its processor.

2. Information we collect

2.1 Information you provide

• Contact and demo requests: name, business email, phone, company, team size, industry and your message.
• Account information: name, email, mobile number, role, photo, language preference and login credentials.
• Subscription and billing: billing contact, GST number, address, invoices and wallet top-ups. Card and UPI details go to our payment gateway; we do not store full card numbers.
• Customer Data: what your team enters, imports or captures — contacts, enquiries, appointments, bookings, deals, inventory, notes, documents and custom fields. In the clinic, hospital and pharmacy editions this can include appointment, prescription and purchase history (section 12).
• WhatsApp conversations with your business number through the official WhatsApp Business API, with delivery status and opt-in records.
• Voice agent calls: recordings and transcripts, where you switch that feature on.

2.2 Information collected automatically

Device, browser and app-version details; IP address and approximate location; usage and error logs; audit logs of who created, changed or deleted a record; and cookies, storage and analytics tags on nexvork.ai (section 14).

2.3 Mobile app permissions

The app asks for a device permission only when a feature needs it — camera or photos to attach a document, notifications to deliver reminders. Change them any time in your device settings.

3. How we use information

• To run, secure and improve the website, web app and mobile app.
• To answer demo requests and support tickets in English, Hindi or Marathi.
• To send account notices, invoices, wallet alerts, the reminders you configure and marketing you agreed to receive — unsubscribe any time.
• To run the AI features in section 4 on your workspace data.
• To prevent fraud and abuse, and to meet legal obligations under Indian law.

We do not sell personal data.

4. AI features and automated processing

Nexvork includes an AI assistant (website widget and WhatsApp), an AI voice agent, lead scoring and predictions such as no-show, renewal or refill risk. They read Customer Data automatically to draft replies, score records and schedule follow-ups.

• The assistant reads only its own workspace. It can create leads, bookings, notes and tasks; it cannot delete records. Every AI action is logged with a timestamp.
• A score or prediction is a recommendation for your staff, not a decision with legal effect.
• Outside its brief — a complaint, a medical query — it hands the conversation to a named person in your team.
• Where a third-party model provider is used, only the content needed for that reply is sent, under data-processing terms. One customer's data never builds features for another.
• Voice calls are recorded and transcribed; tell callers where the law requires it.

5. WhatsApp messaging

Nexvork uses Meta's official WhatsApp Business API, so message content passes through Meta's systems under Meta's terms. Your business must collect opt-in before marketing messages and honour opt-outs; Nexvork records both and drops opted-out contacts from campaigns. Meta reviews every template.

6. Legal basis under Indian law

Under the DPDP Act we process personal data with your consent, or for the legitimate uses the Act recognises: providing a service you asked for, performing a contract, complying with law and guarding against fraud. Sensitive personal data such as passwords, financial details and health information is also handled under the Information Technology Act, 2000 and the SPDI Rules, 2011. Where consent is the basis you can withdraw it any time.

7. Sharing and sub-processors

We share information only with:

• Sub-processors running our infrastructure: cloud hosting in India, email and SMS delivery, the payment gateway, error monitoring and website analytics (Google, Meta).
• Meta, for WhatsApp messaging, telephony providers for AI voice calls, and AI model providers as described in section 4.
• Your own business: your company admin sees Customer Data and user activity in the workspace.
• Authorities, when valid legal process requires it, and an acquirer in a merger or sale of assets — users are told before any transfer.

8. Where your data is stored

Workspaces, backups and uploaded files sit on cloud infrastructure located in India. Data leaves India only where a feature requires it — WhatsApp through Meta, or an AI model provider — and only as far as the DPDP Act allows.

9. Data retention

• Contact and demo requests: up to 24 months, or earlier on request.
• Account and workspace data: your subscription plus 30 days to export, then deleted.
• Backups: rotated and fully purged within 90 days of deletion.
• WhatsApp logs, call recordings and AI logs: deleted with the workspace.
• Invoices and tax records: as long as Indian law requires.

10. Security

We use TLS in transit, encrypted storage, role-based access control, workspace isolation, audit logs, daily backups and regular security reviews. If we learn of a personal data breach affecting you, we notify you and the Data Protection Board of India as the DPDP Act requires.

11. Your rights

Under the DPDP Act and, where they apply, the SPDI Rules, you can:

• get a summary of the data we hold and how it was processed;
• correct, complete or update inaccurate data;
• ask us to erase data we no longer need for a legal reason;
• withdraw consent for marketing or other consent-based processing;
• nominate someone to exercise these rights if you cannot;
• raise a grievance with our Grievance Officer, and escalate to the Data Protection Board of India.

If your data sits inside a customer's workspace — a clinic's patient, a broker's buyer — contact that business first; it controls the record and we will help it respond.

12. Health data in clinic, hospital and pharmacy editions

13. Children's privacy

Nexvork is a business product, is not directed at children under 18, and we do not knowingly collect their data. A workspace may hold a minor's record only with verifiable parental consent obtained by that business.

14. Cookies and analytics

nexvork.ai uses strictly necessary storage (theme choice, chat assistant session) and may use Google Analytics 4, Google Tag Manager and Meta Pixel to measure site use and ad performance. The web app uses session and CSRF cookies to keep you signed in. Details and opt-outs are in our Cookie Policy.

15. Changes to this policy

We update this policy as the product, the law or our sub-processors change, and post the new version here with a new "Last updated" date. Material changes are notified at least 15 days beforehand.

16. Grievance officer and contact

To raise a privacy request or grievance, write to the Grievance Officer with the subject line "Privacy grievance". We acknowledge within 2 business days and resolve within 30, per the SPDI Rules.