Privacy Policy

1. Who we are

Nexa is a messaging service operated by Nexa Solution (“we”, “us”), available at https://www.nexa-solution.online. We decide how and why your personal data is processed, which makes us the data controller for the service.

For any privacy question or request, write to support@nexa-solution.online.

2. What we collect

Category	What it includes
Account	Your name, email address, a salted hash of your password (never the password itself), profile photo if you add one, status, and whether your email is verified. If you sign in with Google we receive your name, email address and profile picture from Google.
Messages	The text you send, replies and reactions, when a message was sent, edited, read or deleted, and whether it was an automatic reply.
Files	Photos, documents and voice notes you attach, with their file name, size and type.
Connections	Invitations you send or receive (the email address invited and any note you add), who you are in a conversation with, the people you have blocked, and the conversations you have marked as favourites.
Settings	Theme, language, notification and sound choices, auto-reply text, and privacy settings.
Activity	Whether you are online and when you were last active.
Technical	Your IP address and basic request details, which reach our servers with every request and may be kept in short-lived server logs. We use the IP address to limit repeated sign-in, sign-up and code attempts.

We do not ask for your phone number, contacts, location, or payment details, and we do not run advertising or third-party analytics trackers in the app.

3. How we use it, and on what basis

Purpose	Legal basis, where one is required
Creating your account, signing you in, and delivering and syncing your messages and files.	Performing our contract with you (the Terms).
Sending service emails: verification, password reset, account closure and recovery codes, and invitations.	Performing our contract with you.
Keeping the service secure: rate limits, blocking, checking new passwords against known breaches, and investigating abuse reports.	Our legitimate interest in a safe, working service.
Desktop notifications, the microphone for voice notes, and Google sign-in.	Your consent, given through your browser or Google, which you can withdraw there at any time.
Complying with the law and responding to lawful requests.	Legal obligation.

We do not sell your personal data, and we do not use your conversations for advertising or to build advertising profiles.

4. Security and encryption

Nexa is not end-to-end encrypted. Messages and files are encrypted while they travel between your device and our servers (HTTPS/TLS), and they are stored on our servers so they can be delivered and shown on all your devices.

In practice this means:

Other internet users and network operators cannot read your messages in transit.
We and the service providers listed below can technically access stored messages and files. We access them only when needed to operate the service, fix a fault, respond to an abuse report, or comply with the law.
Attachments are stored with a media storage provider and delivered through links that are hard to guess. Anyone who has such a link can open the file, so treat shared files accordingly.
Passwords are stored only as salted hashes, and API access requires a signed session token.

No online service can promise perfect security. If we learn of a breach that is likely to put you at risk, we will tell you and the relevant authorities as the law requires.

5. Who we share data with

The other person in a conversation sees the messages and files you send them, your name, and, depending on your privacy settings, your profile photo, online status and read receipts.

We also rely on service providers that process data on our behalf:

Hosting and database providers, which run the servers and the database that store accounts and messages.
Cloudinary, which stores profile photos and message attachments.
Google, for website hosting and, if you choose it, Google sign-in.
An email delivery provider, which sends our service emails to your address.
Have I Been Pwned, to check whether a new password has appeared in a known breach. Only the first five characters of a hash of the password are sent, never the password or your identity.
A sound-effects CDN, from which your browser downloads the notification sounds you choose.

We may disclose data when the law requires it, or to protect the rights and safety of our users. If the service is ever transferred to another operator, this policy continues to apply to your data until you are told otherwise.

6. International transfers

Our providers may store and process data in countries other than your own. Where the law requires safeguards for such transfers, we rely on the appropriate legal mechanisms for them.

7. How long we keep it

Data	Kept for
Account, messages, files and settings	As long as your account is open.
A message you delete	Its text and attachments are removed straight away for everyone in the conversation. A “message deleted” placeholder stays in its place.
A deactivated account	180 days, then permanently deleted unless you recover it.
An account you asked us to delete	30 days, then permanently deleted unless you cancel by recovering it.
Invitations	7 days, then removed automatically.
Verification, closure and recovery codes	10 to 15 minutes.
Password reset links	1 hour.
Server logs	A short period, for security and troubleshooting.

8. Deactivating and deleting your account

Settings → Account offers two separate actions. Each is confirmed with a one-time code sent to your email.

Deactivate account

A pause. You are signed out and cannot sign in, new people cannot find you in search, and nobody can send you messages. Your data stays as it is. You can recover the account at any time within 180 days. If you do not, it is permanently deleted at the end of that period.

Delete account

A request for permanent deletion. The account is closed immediately in the same way, and is permanently deleted 30 days later. During those 30 days you can change your mind by recovering the account.

How recovery works

Sign in with your email, choose account recovery, and enter the code we send you. The account returns exactly as you left it. Recovery is not possible after permanent deletion.

What permanent deletion removes

Your name, email address, password, profile photo, status and all settings.
Every message you sent, in every conversation, including the copies the other person could see. Each one is replaced by a “message deleted” placeholder, and its attachments are deleted from storage.
Your reactions, your invitations, your favourites and your block list.

What may remain

Messages that other people sent to you stay in their accounts. They see the conversation with “Deleted user” in place of your name.
Anything a recipient saved, downloaded or copied before deletion is outside our control.
Backups kept for disaster recovery may hold deleted data for a limited time after it is removed from the live service. We do not use backups to restore deleted accounts or messages.
We may keep specific records longer where the law requires it, or where they are needed to resolve a dispute or investigate abuse (a “legal hold”). Server logs expire on their own schedule.

After permanent deletion your email address is free to be used for a new account.

9. Your choices and rights

See and correct your name, photo and settings in Settings at any time.
Control visibility of your online status, profile photo and read receipts in Settings → Privacy.
Delete individual messages in a conversation, or your whole account in Settings → Account.
Block anyone from their profile panel.
Request a copy of your data, ask us to correct or erase it, or object to or restrict how we use it, by emailing support@nexa-solution.online from the address on your account. We reply within 30 days.

Depending on where you live, the law may give you further rights. If you believe we have mishandled your data, please contact us first. You also have the right to complain to the data protection authority in your country.

10. Cookies and browser storage

Nexa does not set advertising or analytics cookies. To work, the app keeps the following in your browser’s local storage on your own device:

Your sign-in session token and a copy of your profile, so you stay signed in.
Your theme and language choices.
A snapshot of your conversation list, so the app opens quickly.
The ids of recently announced messages, so several open tabs do not notify you twice.

Signing out removes the session and the cached data. If you use Google sign-in, Google may set its own cookies under its privacy policy.

11. Children

Nexa is not intended for anyone under 13, or under the minimum age of digital consent in their country if that is higher. We do not knowingly collect data from children below that age. If you believe a child has created an account, contact us and we will remove it.

12. Changes to this policy

When we change this policy we update the date at the top of the page. For changes that affect how your data is used, we will also tell you in the app or by email before they take effect.

13. Contact

Nexa Solution · support@nexa-solution.online