Last updated: 3 November 2026

Privacy Policy

This policy explains how Nexa handles personal information when you use Nexa accounts, workspaces, connected applications, and support. Nexa is currently in testing.

1. Who is responsible

Nexa is operated by OÜ Asius (registry code 16157235), Turu tn 34b, Tartu, 51004, Estonia. OÜ Asius is the controller for the account, service administration, and security information described in this policy. Contact person: Karel Nagel, nagelkarel@gmail.com.

If an organization uses Nexa to process personal information for its own business, that organization determines the purposes of that processing. Contact your organization about its workspace content and access rules. Any agreed data processing terms also apply.

2. Information we handle

• Account information: your email address, name, optional profile picture, organization memberships, access permissions, and account settings. If you set a password, Nexa stores a password hash, not the password itself.
• Sign-in and security information: provider account identifiers, authentication records, session identifiers, security settings, and activity needed to protect the service. Requests may generate technical logs containing IP addresses, browser information, timestamps, and errors.
• Workspace content: messages, email threads and attachments sent to Nexa, files, source code, project settings, and information you or your organization make available through connected services.
• Service records: support correspondence, deployment and audit records, resource usage, and AI usage and cost records.

3. Google and GitHub sign-in

When you choose Google sign-in, Nexa requests basic identity permissions: your Google account identifier, verified email address, and basic profile information such as your name. Nexa uses these to authenticate you, create your account when needed, or link you to an existing Nexa account with the same verified email address. Google sign-in does not request access to Gmail, Google Drive, contacts, or calendars.

When GitHub sign-in is available and you choose it, Nexa receives your GitHub account identifier, name or username, and verified email addresses for the same purposes. Signing in with GitHub is separate from authorizing repository access.

Nexa stores the provider identifier linked to your Nexa account, your email address, and account profile information. Provider access tokens obtained for sign-in are used temporarily to retrieve your identity and are not retained as connected-service credentials. Nexa does not receive your Google or GitHub password.

When you use Nexa to sign in to a connected application, Nexa shares your Nexa account identifier, email address, name, and optional profile picture with that application so it can identify you. That application’s own privacy information also applies to its use of your account information.

Nexa uses Google sign-in data to provide account and authentication features, not for advertising or training general-purpose AI models. Nexa’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

4. Why we use information

We use information to provide the service you request, manage accounts and permissions, run authorized automations and deployments, provide support, measure resource usage, and diagnose problems. We also use security and audit information to prevent abuse, investigate incidents, and protect users and the service.

Where the GDPR applies, the relevant legal bases are performing a contract or taking steps at your request, our legitimate interests in running and securing the service, and complying with legal obligations. Where processing requires consent, you may withdraw that consent without affecting earlier lawful processing. Choosing a connected sign-in provider is optional; other available sign-in methods remain available.

5. AI features and connected services

Using an AI feature sends your messages and the context needed for the task, such as relevant files, conversation history, and tool results, to the model service. Nexa currently routes model requests through OpenCode Go to the selected model provider, including DeepSeek or Z.ai. The provider and model can change as the available models change. These services process the submitted content under their applicable terms and privacy policies.

Connecting Cloudflare, GitHub, or another service authorizes the access shown in that service’s consent or permission flow. Nexa uses the connection to perform the tasks you or your organization authorize. A sign-in connection alone does not authorize access to hosting accounts or repositories.

6. Who receives information

Cloudflare provides Nexa’s hosting, storage, and infrastructure. Authentication providers receive the requests necessary to complete their sign-in flows. AI providers receive the content described above when AI features are used. Connected services receive information needed to carry out authorized tasks.

Workspace information is available to people and applications permitted by your organization’s access settings. Authorized operators may access information when needed for support, maintenance, or security. We may also disclose information when required by law or to address fraud, abuse, or threats to people or systems. Nexa does not sell personal information or use Google sign-in data for advertising.

7. Storage, security, and international processing

Nexa uses encrypted network connections, access controls, password hashing, and encryption for stored integration credentials. No service can guarantee complete security.

Nexa and its providers may process information outside your country, including outside the European Economic Area. The locations and protections depend on the provider and service used. Where required, international transfers must rely on an applicable legal mechanism, such as an adequacy decision or standard contractual clauses. Contact us for information about the providers and transfer arrangements relevant to your use.

8. Retention and deletion

Account and workspace records are retained while they are needed to provide the service. During testing, account and workspace content does not have a fixed automatic expiry. You may request deletion by emailing us. We will assess the request, verify your identity when necessary, and explain any records that must remain for legal obligations, security, or another person’s rights.

Sign-in sessions normally expire after 30 days; short-lived sign-in codes and authorization records expire sooner. Expired authentication records are periodically cleaned up. Deleting an active record may not immediately remove every backup or audit record. Retention in connected third-party services is governed by those services and the relevant organization’s settings.

9. Cookies and local storage

Nexa uses essential cookies for sign-in, remembering accounts on a device, and protecting authentication flows. Browser storage also keeps interface preferences and application state. These public information pages do not set advertising or analytics cookies. You can clear browser cookies and storage, which may sign you out or reset preferences.

10. Your choices and rights

You can edit available profile settings, sign out, and remove remembered accounts from your device. You can revoke Google access in your Google Account connections or GitHub access in your GitHub application settings. Revoking provider access does not by itself delete your Nexa account or its stored information.

Depending on applicable law, you may request access, correction, deletion, restriction, or portability of your personal information, object to processing based on legitimate interests, and withdraw consent where it applies. Send requests to nagelkarel@gmail.com. You may also complain to your local data protection authority; in Estonia this is the Estonian Data Protection Inspectorate.

11. Changes and contact

We will update this page when our practices change and revise the date above. Material changes affecting existing users will be brought to their attention through the service or contact details available to us. For privacy questions, contact nagelkarel@gmail.com.