Privacy policy

What we collect

Account details: name, email, phone number and language.

Activity: QR codes you scan, offers you claim, places you save and bookings you make.

Payments are handled by Stripe. We never see or store your full card number.

Technical data: device type, approximate country and cookies described in our cookie policy.

Why we use it

To run the service (show the right venue, process bookings, send confirmations).

To pay commissions to the venue and representative that introduced a booking. This is why we record which QR code you scanned.

To keep the service secure and to meet legal and tax obligations.

Who we share it with

The operator of an experience you book receives your name, email, phone number and group size.

Venues see anonymous scan counts and the redemption codes of offers you use there. When you claim an offer you can choose to share your name and email with that venue; this is off unless you tick it.

When you use "Ask a question" on a venue or experience page, that venue or operator receives your name, email, phone number (if given) and message so they can reply. When you message a business on the Marketplace, that business receives your name and email.

A venue never receives your personal details because you booked someone else's experience through its QR code. It only learns that a booking was made, so it can be paid its commission.

Service providers: Supabase (hosting and database), Stripe (payments), Resend (email), Vercel (hosting), Anthropic (the AI assistant, only if you use it). They process data only on our instructions.

Customer records kept by businesses

Venues and operators keep the details above in their customer list on NEXORA, with notes about their contact with you. For that list the business decides how your data is used (it is the controller) and NEXORA stores it on the business's behalf (as processor).

To see, correct or delete what a business holds about you, contact the business, or email privacy@nexora.example and we will help. Your data export in Settings includes the questions you sent and the contact records linked to your account.

Questions we block as spam are deleted after 30 days.

The AI assistant

The search box can answer questions with an AI assistant. Your questions are sent to Anthropic, which runs the AI model, as our processor. Anthropic may not use them to train its models. Before a question is sent or stored, we remove email addresses and phone numbers from it, and we never send your name or account details.

We store the questions, the answers and the results shown for 30 days, then delete them automatically. If you are signed in, you can see and delete your recent conversations in My NEXORA, and they are included in your data export. If you are not signed in, a conversation is linked only to a random browser ID (nx_sid) and a hashed network address, used to count your free questions.

We use the stored conversations to improve the assistant and our listings (for example, questions that found nothing). They are shown to our staff without names or account details.

See How the AI assistant works (/legal/ai) for more.

If you work at a business that uses NEXORA

Businesses can plan their staff's shifts on NEXORA, and staff can request leave, swap shifts and clock in and out. The business decides how this data is used (it is the controller); NEXORA stores it on the business's behalf (as processor). Sick leave is stored as dates only, never a reason.

Swedish businesses that must keep a staff register (personalliggare) record each person's name, personal identity number (personnummer or samordningsnummer) and when they start and stop work, as Swedish tax law requires (skatteförfarandelagen 39 kap.). The number is stored encrypted, shown on screen only as its last four digits, and given in full only in the register shown to the Swedish Tax Agency (Skatteverket). Register entries can't be changed or deleted and are kept for at least two years after the end of the business's tax year.

Clocking in works only on the workplace network or after scanning the workplace's QR code. We don't track your location, and we compare but never store the network address.

To see what a business holds about you, ask the business, or email privacy@nexora.example.

How long we keep it

Booking and payment records: as long as tax law requires (typically 6 years in Spain).

Scan records: 24 months. Account data: until you delete your account.

Your rights

You can access, correct, export or delete your data. Download a copy anytime from Settings → Your data. For anything else, email privacy@nexora.example.

You can complain to your data protection authority (in Spain, the AEPD).