Legal

Privacy Policy

Last updated: October 1, 2026

NexAPI Labs, Inc. ("NexAPI", "we", "us") respects your privacy. This policy explains what personal data we collect through nexapi.io and our APIs, why we collect it, and the choices you have. It applies to visitors and account holders alike; where our customers act as processors for their own end users, we remain the business-facing processor.

1. Data we collect

• Account data — name, email, organization, billing details held by our payment processor.
• Usage data — request counts, latency, error rates, key metadata, spend.
• Request bodies — the payloads you send and the outputs returned, logged for abuse monitoring for up to 30 days by default.
• Technical data — IP address, TLS properties, and device signals used for security.

2. How we use it

We use personal data to operate, secure and bill the service, to prevent abuse, to meet legal obligations, and to send transactional email. We do not sell personal data and we do not use request bodies for model training.

3. Legal bases

Under the GDPR and the CCPA as amended by the CPRA, we process personal data under contracts, legitimate interests in security and fraud prevention, and legal obligations. Where consent applies (for example marketing email), you may withdraw it at any time.

4. Processors and transfers

We share data only with processors that support the service (payment processing, email delivery, cloud hosting in US and EU regions). Transfers outside the EEA rely on the EU Standard Contractual Clauses.

5. Your rights

You may access, correct, export or delete your personal data, and object to or restrict certain processing. Enterprise customers may instruct us in writing. Everyone can exercise rights by emailing [email protected]; we respond within 30 days. California residents may not be discriminated against for exercising their rights.

6. Retention

Account data is kept while your account is active and for 90 days after closure. Operational logs are kept 30 days by default and may be set to zero retention on Enterprise plans.

7. Security

We encrypt data in transit with TLS 1.3 and at rest, enforce least-privilege access, and undergo annual SOC 2 Type II audits. Our report is available on request under NDA.

8. Contact

Our privacy contact is [email protected]. Postal: NexAPI Labs, Inc., 548 Market Street, Suite 212, San Francisco, CA 94104. See also our Cookie Policy and Terms of Service.