Privacy Notice

1. Who we are

NEXO is operated by NORTHSTAR LABS (NEXO), Kushal Vatika, Ahinsa Marg, Jugsalai, Jamshedpur 831006, Jharkhand, India ("NEXO", "we", "us", "our").

For the personal data described in this notice, NEXO is the Data Fiduciary, the entity that decides why and how your personal data is processed, and you are the Data Principal. This notice covers the website getnexo.in, the NEXO web application, and the APIs behind them (together, the Service).

The person you should contact about anything in this notice, including to exercise your rights or raise a grievance, is set out in Section 14.

2. Words used in this notice

• Personal data, any data about an individual who is identifiable by or in relation to it.
• Processing, anything done with personal data: collecting, storing, organising, using, sharing, erasing.
• Data Principal, the individual the personal data is about. For a child, this includes the parent or lawful guardian; for a person with a disability, the lawful guardian.
• Data Fiduciary, whoever determines the purpose and means of processing. That is us.
• Data Processor, a company that processes personal data on our instructions, under contract. Section 9 lists ours.
• Contact record, a record inside NEXO about a person in your network. A contact record is personal data about that person, and it is held in your account.
• Board, the Data Protection Board of India, the authority set up under the DPDP Act.

3. What we process, why, and on what basis

The table below is the itemised description the DPDP Act requires: each category of personal data, where it comes from, the specific purpose it is processed for, and the basis we rely on. We do not use any of it for a purpose that is not listed here.

We do not knowingly collect financial account numbers, government identifiers, health data, biometric data, caste, religion or political affiliation, and we ask you not to put them into notes or custom fields. Card and bank details are entered on the payment gateway's own page and never reach NEXO's servers.

Some fields are derived rather than collected, for example a sector or city tag inferred from the employer already on a contact record, a "last interaction" date computed from your calendar, or a relevance score used to rank search results. Derived fields are treated as personal data and are covered by everything in this notice.

4. Consent, and how to withdraw it

Where we rely on consent, that consent is asked for separately, in plain language, at the point the feature is used, connecting Google, uploading a LinkedIn export, joining a community, turning on WhatsApp alerts. Nothing is pre-ticked, and declining one thing does not switch off the rest of the Service.

Withdrawing consent is as easy as giving it. You can do all of the following yourself, at any time:

Withdrawal takes effect going forward. It does not undo processing that already happened lawfully, and where a feature depends on the data you withdrew, that feature stops working, for example, the interaction timeline empties when you disconnect Google Calendar. If you would rather we did it for you, write to naman@getnexo.in and we will action it within 30 days.

5. If you are not a NEXO user but your data is in NEXO

A large part of what NEXO holds is contact records about people who never signed up, because someone in their network imported their own address book, LinkedIn connections or a community roster. We take that seriously, so:

• A contact record is visible only to the account that holds it, plus the community it was shared into if it came from a community roster. It is not published, not sold, and not made searchable to the internet.
• We do not email, message or otherwise contact someone just because they appear as a contact record. Outbound messages are sent to account holders, about their own reminders.
• We do not buy personal data from data brokers or scrape it, and NEXO no longer runs any third-party enrichment on contact records.
• If you are the person a contact record is about, you have the same rights as anyone else in Section 13. Write to naman@getnexo.in with enough detail to find the record, normally the name and email address or LinkedIn URL it would be filed under, and we will tell you what we hold, correct it, or erase it, within 30 days.

If you are the person doing the importing: you are responsible for having a proper basis to share other people's details with us, and for the accuracy of what you upload. Do not upload data you were given in confidence or under terms that forbid it. When you delete a contact, or delete your account, the records you brought in go with it.

6. Communities: what other people can see

NEXO is organised around communities, a cohort, an alumni network, a fund's portfolio, a company. Joining one is what makes you visible to the others in it, and joining is the consent: from the moment you join, and only for as long as you stay, the members of that community can find you.

Inside a community you have joined, other members can see:

• Your profile, name, photo, headline, employer, role, location, and the professional background on your profile page;
• That you are a member of that community, and any role you hold in it;
• That you are a possible route to someone they are looking for, when network search surfaces a path through you.

Other members never see:

• Your private notes, tags, reminders or important dates;
• Your calendar, your meetings, or your interaction timeline;
• Your personal contact list, or contacts you imported for yourself;
• Your searches, your billing details, or your settings.

An introduction only exposes your details to the other side when you agree to it. A community administrator can see the membership list and administrative records for their own community, and can add or remove members, they cannot see any member's private CRM data. Leaving a community removes you from its directory, its search pool and its intro routing.

7. AI features

Several NEXO features use AI models. In every case the model is called to answer a request you made, the data sent is the minimum needed to answer it, and the result comes back to you and nobody else.

• Network scan and search. Your query, and the contact records that are candidates for it, are sent to a large language model to interpret the question and rank the results. Ranking is a suggestion, you decide what to do with it.
• Semantic search. We convert contact records into vector embeddings, numeric representations used to measure similarity, and store them in a vector database, tagged with the identifier of the account and record they belong to. Embeddings are only ever matched against records within your own scope.
• Meeting transcripts. If you connect a notetaker, transcripts are summarised into private notes, reminders and a "confirm who this was with" prompt.
• Duplicate detection. Exact matches on email, phone or LinkedIn URL are decided by plain rules with no AI involved. Only the remaining fuzzy cases, similar names at similar companies, are sent to a model, and no merge happens without your confirmation.
• Gifting and group suggestions. Suggested gifts, festivals and nudges are generated from the contact record you are looking at.

What we do not do: we do not train any AI model on your data, we do not let one account's data influence another account's results, and we do not use AI to make a decision that has a legal or similarly significant effect on anyone. Every AI output in NEXO is a suggestion in your own workspace that you can edit, ignore or delete. Model providers act as our processors and are listed in Section 9; where a provider is outside India, Section 9 says so.

8. Google user data, Limited Use

NEXO requests these Google scopes, and only these: contacts.readonly, calendar.readonly, userinfo.profile and userinfo.email. All four are read-only, NEXO cannot create, change or delete anything in your Google account.

NEXO's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Only for user-facing features. Google data is used to populate your contact list, to build the interaction timeline on a contact's profile, and to make those contacts searchable for you. Nothing else.
• No advertising. We do not use Google user data for advertising of any kind, including retargeting, personalised or interest-based advertising.
• No data brokers. We do not sell or transfer Google user data to data brokers, information resellers, or anyone else.
• No AI or ML training. We do not use Google user data to develop, improve or train generalised AI or ML models, and we do not permit our AI providers to do so either.
• No cross-account use. Your Google data is never combined with, ranked against, or made visible to another NEXO user's data.
• No human reading. We do not allow humans to read your Google user data unless (a) you have given us specific consent, (b) it is necessary for security, such as investigating abuse, or (c) we are required to by law. Any such access is limited to the minimum data needed.
• Event bodies are not read. From calendar events we read the title, attendee email addresses and timings. Descriptions, attachments, meeting links and private notes are not read or stored.

Revoking access at myaccount.google.com/permissions stops all Google syncing immediately and our stored tokens are deleted. Contact records already synced into your CRM remain yours to keep or delete, Section 10 sets out the retention rules, and Settings → Delete My Account removes everything at once.

9. Who processes data for us

We do not sell personal data and we do not share it for anyone else's marketing. We do use the service providers below, each under contract, each limited to the purpose named, and each obliged to protect the data to at least the standard in this notice.

Transfers outside India. As the table shows, some processors are outside India. The DPDP Act permits transfer of personal data outside India except to a country the Central Government restricts. We monitor that list and, if a provider we use becomes restricted, we will move the processing and update this notice.

We also disclose personal data where we are legally required to, to a court, regulator or law enforcement agency acting under a valid legal instrument, and to our professional advisers under confidentiality. If NEXO is ever merged or acquired, personal data may transfer with the business; you will be told before this notice stops applying to it.

Some third-party services we call carry no personal data at all, for example the news source behind the updates panel on your dashboard, which is queried by topic, not by user.

10. How long we keep it

We keep personal data only for as long as the purpose it was collected for is still being served, or as long as a law requires us to keep it, whichever is longer. When neither applies, we erase it.

Deleting your account from Settings → Delete My Account removes your account record and, with it, your contacts, tags, lists, notes, reminders, activities, calendar data, connector tokens, sync history, messages and jobs, and instructs deletion of your embeddings from the vector database.

11. How we protect it

We take reasonable security safeguards to prevent personal data breaches, including:

• No passwords to steal. NEXO does not store passwords at all, you sign in with Google, with LinkedIn, or with a one-time code sent to your email or WhatsApp.
• Encryption in transit. All traffic between your browser, our servers and our providers runs over HTTPS/TLS.
• Data kept in India. The application and its database run on managed AWS infrastructure in the Mumbai region.
• Access control. Every API request is authenticated and scoped to your account; administrative surfaces are separately gated, and access to production systems is limited to the small number of people who need it.
• Read-only, revocable integrations. Connector permissions are the narrowest that make the feature work, and you can revoke them without our help.
• Platform hardening. Security headers, a strict cross-origin policy, rate limiting on public and AI endpoints, signature verification on inbound webhooks, and logging of access and administrative actions so unauthorised access can be detected and investigated.

No system is perfectly secure. We cannot guarantee absolute security, but we do commit to reviewing these safeguards, to fixing what we find, and to telling you if something goes wrong, see the next section.

Your part: keep your email, LinkedIn and WhatsApp accounts secure, since they are how you get into NEXO. Never share a one-time code with anyone, including anyone claiming to be from NEXO, we will never ask for one.

12. If there is a breach

If personal data is exposed, lost or accessed without authorisation, the DPDP Act requires us to tell both you and the Data Protection Board of India. We will:

• notify every affected person, without delay, describing what happened, what data was involved, the likely consequences, what we have done about it, and what you should do;
• notify the Board without delay with the facts as we know them, and follow up with the full account within the time the law allows;
• contain the incident, and record what happened and what we changed so it does not happen again.

13. Your rights

Under the DPDP Act you have the following rights, and we honour all of them:

• Right to access. Ask us for a summary of the personal data we hold about you, what we are doing with it, and the identities of the other Data Fiduciaries and Data Processors it has been shared with, Section 9 is the standing answer to the last part.
• Right to correction and completion. Ask us to correct anything inaccurate or misleading, complete anything incomplete, or update anything out of date. Most of it you can edit yourself on your profile.
• Right to erasure. Ask us to erase your personal data, unless a law requires us to keep it. Settings → Delete My Account does this immediately and permanently.
• Right to withdraw consent. Withdraw any consent at any time, as easily as you gave it, see Section 4.
• Right to grievance redressal. Complain to us about how we handle your data or your rights, and get an answer, see Section 14. You must use this before approaching the Board.
• Right to nominate. Nominate another individual to exercise your rights on your behalf if you die or become incapacitated. Write to us with the nominee's name and contact details and we will record it against your account.

How to exercise them. Email naman@getnexo.in from the address on your NEXO account, or from an address we can verify, saying what you want. We may ask for enough information to be sure it is you, we will not ask for more than that. We acknowledge within 72 hours and respond within 30 days. There is no charge.

The Act also asks Data Principals to do their part: give accurate information, do not impersonate anyone else, and do not file false or frivolous complaints.

14. Grievance redressal

We have designated a Grievance Officer to answer questions about this notice and to resolve complaints about how NEXO processes personal data.

Put Grievance in the subject line. We acknowledge within 72 hours and aim to resolve within 30 days, and in any event within the maximum period allowed by law. If you are not satisfied with our response, or we do not respond, you may complain to the Data Protection Board of India in the manner it prescribes.

15. Children and guardianship

NEXO is for working professionals and is not directed at anyone under 18. We do not knowingly create accounts for children, and we do not carry out behavioural monitoring or targeted advertising directed at children, we do not run advertising at all.

If you are a parent or lawful guardian and believe a child has given us personal data, write to naman@getnexo.in and we will erase it promptly. The same applies to a lawful guardian acting for a person with a disability, who may exercise every right in Section 13 on their behalf.

16. Cookies and local storage

NEXO uses the minimum browser storage it needs to work. We do not use advertising cookies and we do not allow third parties to track you across other websites from NEXO.

• Essential. Your sign-in token and session, so you stay logged in, and small preferences such as which account or community you last had open. Blocking these stops NEXO from working.
• Analytics. A session identifier and product-usage events, used to count sessions and see which features are used. These are pseudonymous and are not used to build an advertising profile.

You can clear browser storage at any time from your browser settings; this signs you out.

17. Changes to this notice

We update this notice when the product changes or the law does. The "last updated" date at the top always reflects the current version. If a change materially affects how we process your personal data, we will tell you by email or in the app before it takes effect, and where the change needs your consent we will ask for it rather than assume it.

18. Contact us

• By email: naman@getnexo.in
• By post: NORTHSTAR LABS (NEXO), Kushal Vatika, Ahinsa Marg, Jugsalai, Jamshedpur 831006, Jharkhand, India

This notice is published in English. If you would prefer it in Hindi or another language listed in the Eighth Schedule to the Constitution of India, write to us and we will provide it.