NexoSphere
Draft, pending legal review. This document describes NexoSphere's actual data-handling but has not yet been finalised by a qualified legal professional for the Philippines (Data Privacy Act) or the UAE (PDPL). It is provided for transparency and is not yet a binding legal notice. Policy version 2026-08-23-draft.

Privacy Policy

Last updated 22 August 2026

This policy explains what personal data NexoSphere ("we") collects, why, who we share it with, and the rights you have over it. NexoSphere is a business operating network for the Philippines and the United Arab Emirates. For your own company's data you control on the platform, you are the controller and we are your processor; for your individual account we are the controller.

1. Data we collect

  • Account & profile — name, work email, password (stored only as a bcrypt hash), headline, location, avatar, and the companies you belong to.
  • Content you create — posts, reels, videos, comments, private direct messages, documents, and workspace records.
  • Business records — customers, invoices, quotations, orders, payroll and tax data your company processes through the platform.
  • Verification data — identity and business-verification documents you upload (e.g. government ID, KYB documents).
  • Virtual-assistant monitoring — where you consent and clock in as a VA, activity levels and periodic webcam/screen snapshots for the client who engaged you. This is collected only with your explicit, per-session consent and can be declined.
  • Financial — referral and commission records, payout requests, and payout-method status. Card and bank details are handled by our payment/payout providers, not stored by us.
  • Technical — IP address and device/browser information used for security (e.g. login rate-limiting), and a single UI-preference cookie.

2. Why we use it, and our lawful basis

  • To provide the service (accounts, messaging, marketplace, workspace, payments) — performance of our contract with you.
  • Security, fraud prevention and abuse limiting — our legitimate interests.
  • Legal and tax compliance (e.g. retaining financial records) — legal obligation.
  • Optional AI features, product analytics and marketing — your consent, which you can withdraw at any time. Marketing and analytics are off by default.

3. Who we share it with (sub-processors)

We do not sell your personal data. We share it only with the service providers that run the platform, under data-processing terms:

  • Neon — managed PostgreSQL database (hosted in the Singapore region).
  • Vercel — application hosting and file/blob storage for your uploads.
  • Upstash — ephemeral key store for rate-limiting and session controls.
  • AI provider (Anthropic, via an AI gateway) — processes the text you submit to AI features to generate a response.
  • LiveKit — real-time audio/video transport for calls and the boardroom.
  • Email and web-push providers — to deliver notifications you have enabled.
  • Payment and payout providers — to process marketplace payments and referral/VA payouts.

4. International transfers

The platform is hosted in the Singapore region, and some sub-processors operate in other countries (including the United States). Where data moves across borders, we rely on the providers' standard contractual protections. The specific hosting region for your data is recorded in your account settings.

5. How long we keep it

We keep personal data only as long as needed for the purpose it was collected. In particular: consent-based VA monitoring snapshots are purged after 90 days; security audit records after about 2 years; read notifications after 90 days; presence data after 30 days. Financial and tax records are retained for the period the law requires. When you delete your account (below) we erase your personal data and files, and anonymise records a counterparty still needs.

6. Your rights

Subject to the PH Data Privacy Act, the UAE PDPL and, where applicable, the GDPR, you can:

  • Access / export your personal data — download a copy from Settings → Security → Download your data.
  • Erase your account and data — Settings → Security → Delete your account.
  • Rectify inaccurate data — edit your profile, or contact us.
  • Withdraw consent for marketing, analytics or AI processing at any time in your settings.
  • Complain to your data-protection regulator (the National Privacy Commission in the Philippines, or the UAE Data Office).

7. Security

We protect your data with encryption in transit, hashed passwords, tenant isolation, access controls, rate-limiting and session revocation. No system is perfectly secure; if a breach affects your data we will notify you and the relevant regulator as required by law.

8. Children

NexoSphere is a business platform intended for adults. It is not directed at anyone under 18, and we do not knowingly collect their data.

9. Changes & contact

We will post any material change here and update the date above. Questions or requests: contact your workspace administrator, or reach us through the contact options on our site. (A dedicated privacy contact address will be published on finalisation.)