Legal

Privacy policy

Last updated 6 November 2026 · Controller: Jklausen Holding S.L.

This policy explains how nexo collects, uses, shares and deletes personal data when you visit gonexo.io, use the nexo application, or connect third-party services to it.

1. Who we are

nexo is operated by Jklausen Holding S.L., a company registered in Spain (“nexo”, “we”, “us”). For any privacy question or request, contact us at hola@gonexo.io.

nexo is software for real estate agencies. For data an agency stores in nexo about its own clients and contacts, the agency is the data controller and nexo processes that data on the agency’s behalf. For our own website visitors, early-access applicants and account holders, nexo is the data controller.

2. Data we collect

Early-access form: your name, email address, agency size, whether you represent buyers or sellers, and any message you write.
Account data: name, email address, agency name, role, login and security information.
Content agencies add to nexo: contacts, leads, properties, messages, documents and notes that the agency and its team enter or import.
Data from services you connect: see section 3 for Meta platforms, section 4 for Google and section 5 for Microsoft. For any service you connect, we receive only the data needed for the feature you switched on.
Signing in with Google, Microsoft or Apple: the provider confirms who you are and sends us your name, email address, an account identifier and, if you have one, your profile photo. We use them to sign you in, or to create your nexo account if you sign up this way; your photo becomes your account picture, which your workspace’s members see.
Payment data: handled by our payment provider, Stripe. We do not store card numbers.
Technical data: server logs (such as request time, browser type and errors) used to run and secure the service.

3. Data from Meta platforms (Facebook, Instagram, WhatsApp)

An agency can connect its Facebook Page, Instagram account, Messenger or WhatsApp Business account to nexo using Facebook Login or WhatsApp Embedded Signup. When it does, we receive:

the connecting user’s basic Facebook profile (name and user ID);
the Pages, Instagram accounts, WhatsApp Business accounts and phone numbers the user chooses to connect;
access tokens that let nexo act on those accounts;
leads submitted through the agency’s Facebook and Instagram lead forms;
messages sent to and from the connected accounts, and the agency’s WhatsApp message templates.

We use this data only to provide the features the agency switched on:

showing conversations in the nexo inbox and letting the agency reply;
sending the WhatsApp notifications and automated messages the agency configured;
importing leads into the agency’s contact list.

We do not sell Meta platform data, use it for advertising, share it with data brokers, or use it to train AI models. Access tokens are encrypted at rest. An agency can disconnect at any time under Settings → Channels & Integrations in nexo, or by removing nexo under Settings → Business integrations on Facebook. When an agency disconnects, we delete the access tokens and stop receiving data from that account. Our use of information received from Meta APIs complies with the Meta Platform Terms and the Developer Policies, including all applicable restrictions on the use of platform data.

4. Data from Google (Gmail, Google Calendar, Google Contacts)

A user can connect their Google account to nexo under Settings → Your channels → Google. Before Google’s own consent screen, nexo shows what it will read and why, and the user chooses which services to connect. Depending on that choice, we receive:

Your Google account email — to show which account is connected.
Gmail — sending: nexo sends the emails you write in nexo from your Gmail address, so they appear in your Sent folder. nexo keeps a copy in the conversation.
Gmail — replies: when a contact replies to an email sent from nexo, nexo brings that reply, and its attachments, into the conversation.
Gmail — emails from your contacts (only if you switch it on): nexo checks who new emails are from and to (the From, To and Cc lines). Emails exchanged with a contact already in nexo are brought in with their subject, text and attachments; emails without a contact are not opened or saved.
Gmail — threads you save: with the nexo browser extension, a thread you choose to save in Gmail is copied into nexo.
Google Calendar: nexo creates, updates and deletes the events for the visits, tasks and follow-ups you choose to sync. It also reads the other events in your primary Google Calendar as they are created or changed (title, description, location, times and attendees), shows them in your nexo calendar, and turns an event with a contact and a property already in nexo into a visit.
Google Contacts (only when you start an import): names, email addresses, phone numbers and companies, imported once into your nexo contacts.

How we use it. Only to provide these features to you and your agency: showing and answering conversations, keeping contact timelines and calendars up to date, and the AI features you use on that data (summarising a reply, translating it, drafting an answer you review before sending, and suggesting contact details you confirm). We do not use Google data for advertising, sell it, or share it with data brokers.

Where it is stored. Emails, events and contacts are stored in nexo’s database in the European Union (Google Cloud); email attachments are stored in Google Cloud Storage. Google access tokens are encrypted at rest.

Who sees it. The members of your agency’s nexo workspace, according to their roles. nexo staff do not read your emails: they do so only with your explicit permission for specific messages, when it is necessary for security (for example investigating abuse or a bug), or to comply with the law.

Processors. OpenAI processes email text for the AI features above, with storage of requests turned off. Google Cloud (Model Armor, EU region) screens that text for malicious instructions before it reaches the AI. Google Cloud Storage stores attachments. Cloudflare R2, in the United States, keeps an encrypted nightly backup of nexo’s database, and a backup copy of the attachments stored before 29 October 2026 until we delete it. No one else receives Google data, except where the law requires it.

AI training. nexo does not use Google Workspace data to develop, improve or train generalised or non-personalised AI or machine-learning models, and does not allow its providers to do so.

How long we keep it, and how to delete it. For as long as your account is active, unless you delete it sooner:

When you disconnect Google, nexo asks whether to keep or delete the emails it brought in from that inbox, with their attachments. Emails written in nexo stay.
At any time, Delete emails brought in from Gmail on the Gmail row under Settings → Your channels deletes them.
When your user is deleted, we revoke nexo’s access to your Google account and delete the emails brought in from it. When an agency workspace is closed, we revoke access and stop syncing at once.
Calendar events brought in from Google, and the visits made from them, stay in nexo after you disconnect Google. Ask us to delete them (section 13).
You can withdraw nexo’s access in nexo (Settings → Your channels → Google → Disconnect) or in your Google account.

nexo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data from Microsoft (Outlook mail, Outlook calendar, Microsoft contacts)

A user can connect a Microsoft 365, Outlook.com or other Microsoft account to nexo under Settings → Your channels → Microsoft, choosing Outlook mail, Outlook calendar and Microsoft contacts one at a time. Microsoft’s consent screen then lists the Microsoft Graph permissions nexo asks for:

Every connection: openid, email, profile and User.Read, to read your name and email address and show which account is connected; offline_access, so the connection keeps working without you signing in again.
Outlook mail: Mail.ReadWrite and Mail.Send. nexo sends an email by creating it as a draft in your mailbox and then sending that draft, and Microsoft only allows creating a draft with Mail.ReadWrite. nexo never moves or deletes your emails; the only message it ever deletes is its own draft of a send that failed.
Outlook calendar: Calendars.ReadWrite.
Microsoft contacts: Contacts.Read (read only).

Depending on what you connect, we receive:

Outlook mail — sending: nexo sends the emails you write in nexo from your Outlook address, so they appear in your Sent Items. nexo keeps a copy in the conversation.
Outlook mail — replies: when a contact replies to an email you sent from nexo through Outlook, nexo brings that reply, and its attachments, into the conversation.
Outlook mail — emails from your contacts (only if you switch it on): nexo checks who new emails are from and to (the From, To and Cc lines), starting with the last 30 days. Emails exchanged with a contact already in nexo are brought in with their subject, text and attachments; emails without a contact are not opened or saved. Drafts, Junk Email and Deleted Items are skipped.
Outlook calendar: nexo creates, updates and deletes the events for the visits, tasks and follow-ups you choose to sync. It also reads the other events in your Outlook calendar as they are created or changed (title, description, location, times and attendees), shows them in your nexo calendar, and turns an event with a contact and a property already in nexo into a visit.
Microsoft contacts (only when you start an import): names, email addresses, phone numbers, companies and addresses, imported once into your nexo contacts.

How we use it, where it is stored and who sees it. Exactly as for Google data in section 4: only to provide these features to you and your agency, including the AI features you use on that data; stored in nexo’s database in the European Union (Google Cloud), with attachments in Google Cloud Storage; seen by the members of your agency’s workspace according to their roles, and by nexo staff only with your explicit permission for specific messages, when it is necessary for security, or to comply with the law. Microsoft access and refresh tokens are encrypted at rest. We do not use Microsoft data for advertising, sell it, or share it with data brokers.

Processors. Microsoft (Microsoft Graph and Microsoft Entra ID) is the service you connect: it holds your mailbox, calendar and contacts, and asks for your consent. Within nexo, OpenAI processes email text for the AI features, with storage of requests turned off; Google Cloud (Model Armor, EU region) screens that text for malicious instructions before it reaches the AI; Google Cloud Storage stores attachments. Cloudflare R2, in the United States, keeps an encrypted nightly backup of nexo’s database, and a backup copy of the attachments stored before 29 October 2026 until we delete it. No one else receives Microsoft data, except where the law requires it.

AI training. nexo does not use Microsoft data to develop, improve or train generalised or non-personalised AI or machine-learning models, and does not allow its providers to do so.

How long we keep it, and how to delete it. For as long as your account is active, unless you delete it sooner:

When you disconnect Outlook mail, nexo asks whether to keep or delete the emails it brought in from that mailbox, with their attachments. Emails written in nexo stay.
At any time, Delete emails brought in from Outlook on the Outlook mail row under Settings → Your channels deletes them.
When your user is deleted, we delete the emails brought in from your Outlook mailboxes (except a mailbox a teammate still has connected, whose emails stay in the workspace) and your Microsoft connection with its tokens. When an agency workspace is closed, we delete its members’ Microsoft connections and stop syncing at once.
Calendar events brought in from Outlook stay in your nexo calendar after you disconnect Outlook calendar. Ask us to delete them (section 13).
Microsoft does not let an app withdraw its own access. When you disconnect the last Microsoft service in nexo (under Settings → Your channels), we delete the tokens nexo stored, which ends nexo’s access. To remove nexo’s permissions from your Microsoft account as well, use myapps.microsoft.com for a work or school account, or account.microsoft.com/privacy (apps and services that can access your data) for a personal account.

6. How we use data

to provide, maintain and support the nexo service;
to reply to early-access requests and keep you informed about the launch;
to send service emails (for example sign-in codes and account notices);
to keep the service secure and prevent abuse;
to meet legal, tax and accounting obligations.

7. Legal bases

We process personal data to perform our contract with you or your agency, on the basis of our legitimate interests (running, securing and improving the service), with your consent where we ask for it, and to comply with legal obligations.

8. Who we share data with

We share personal data only with service providers that help us run nexo, under contracts that require them to protect it:

Google Cloud — application hosting and databases (Cloud Run, Cloud SQL and Cloud Storage, in Madrid, EU region), hosting of this website, and screening email text for malicious instructions before it reaches the AI features (Model Armor, EU region);
Cloudflare — DNS and backup storage (United States);
Resend — email delivery;
Cal.com — booking a demo on this website (the booking calendar loads from cal.com);
Stripe — payments and billing;
OpenAI — AI features inside nexo (for example drafting replies and summaries), with storage of requests turned off;
Anthropic — AI features inside nexo (for example generating an agency's website);
PostHog — product analytics inside nexo, to run, secure and improve the service (EU region);
Grafana — monitoring, logs and alerting for availability and security (EU region);
Apple (Apple Push Notification service) — push notifications to the nexo app on iPhone;
Google Firebase (Firebase Cloud Messaging) — push notifications to the nexo app on Android;
Meta and Google — when an agency connects those services, and for analytics and ad measurement on this website if you consent to it;
Microsoft (Microsoft Graph and Microsoft Entra ID) — when a user connects Outlook mail, Outlook calendar or Microsoft contacts, or signs in with a Microsoft account;
Mapbox and Google Maps — maps and address lookup;
Google Fonts — the font on this website (your browser requests it from Google, which receives your IP address).

We may also disclose data where the law requires it. We never sell personal data.

9. International transfers

Our main infrastructure is in the European Union. Some providers listed above may process data outside the European Economic Area. Where they do, the transfer is protected by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

10. How long we keep data

Account and agency data: for as long as the account is active.
After an account is closed, or after an agency asks us to delete its data: we delete or anonymise it, except records we must keep by law (such as invoices under Spanish tax and accounting rules).
Early-access requests: until we have replied and onboarded you, or until you ask us to delete them.
Analytics on agency websites hosted by nexo: 90 days.
Usage analytics in the nexo application: deleted when your account is deleted; session recordings are kept for 30 days.
Diagnostics of the nexo application (traces and system logs): 14 days.

11. Cookies and analytics

With your consent, this website uses Google Analytics to understand how it is used and the Meta Pixel to measure visits from our Facebook and Instagram ads. Neither is loaded until you allow it in the cookie banner, and you can withdraw consent at any time under “Cookie settings” in the footer. Google (Google Ireland Ltd.) and Meta (Meta Platforms Ireland Ltd.) may transfer data to the United States under the EU–US Data Privacy Framework. Our cookie policy lists every cookie, what it does and how long it lasts. The site also remembers your language and cookie choice in your browser’s local storage, and loads its font from Google Fonts.

Agency websites hosted by nexo measure visits with analytics software we host ourselves; it is cookieless, does not store your IP address, does not track you across sites or devices, and shares nothing with third-party analytics providers.

The nexo application uses the cookies needed to keep you signed in. Once you are signed in, it asks you once whether you want to help improve nexo with usage analytics (PostHog, EU region). Until you answer, and if you decline, it only counts page visits and clicks anonymously — without cookies or any other storage in your browser, and without identifying you. If you allow it, it links that usage to your account, sets an analytics cookie and records your sessions with all text and typing hidden, so no client data is ever seen. You can change your answer at any time in Settings › Account & security.

12. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise them, email hola@gonexo.io. If your data is held by an agency that uses nexo, you can also contact that agency directly. You may complain to the Spanish Data Protection Agency (www.aepd.es).

13. How to delete your data

You can ask us to delete your data, including any data received from Meta platforms, Google or Microsoft:

Email hola@gonexo.io with the subject “Delete my data”, from the email address linked to your account or request. Tell us if you want everything deleted or only data from a connected service.
To remove only Meta data, disconnect Facebook, Instagram or WhatsApp in nexo under Settings → Channels & Integrations, or remove nexo from Settings → Business integrations on Facebook.
To remove Google data, disconnect Google in nexo under Settings → Your channels and choose to delete the emails nexo brought in, or use Delete emails brought in from Gmail on the Gmail row. See section 4. This leaves the calendar events brought in from Google; to delete them, email us as in point 1.
To remove Microsoft data, disconnect Outlook mail in nexo under Settings → Your channels and choose to delete the emails nexo brought in, or use Delete emails brought in from Outlook on the Outlook mail row. See section 5.

We confirm your request by email and complete it within 30 days, except records we must keep by law.

14. Security

We use encryption in transit (HTTPS) and at rest for sensitive credentials, access controls that separate each agency’s data, and restricted administrative access.

15. Children

nexo is a business service and is not directed at anyone under 16.

16. Changes to this policy

We will update this page when our practices change and revise the date at the top. For significant changes, we will notify account holders by email.