Privacy Policy

NEXCRI is a business operating system for African businesses. The service is operated by NEXCRI and is available at nexcri.com, with the administrative console hosted separately at admin.nexcri.com.

For privacy requests, contact legal@nexcri.com. We aim to respond within 30 days.

Account data: your name, email address, password hash, authentication provider and profile settings.

Workspace data: businesses, products, sales, expenses, customers, orders, team members, support tickets and audit records that you or your team create.

Technical data: IP address, browser type, device information, request timestamps and security logs generated when you use the service.

Support data: messages you send to our support team and any attachments you choose to include.

To create and secure your account, provide the workspace, process your instructions and display accurate reports.

To operate authentication, prevent abuse, investigate security incidents and maintain audit trails.

To provide support, send service notices and respond to legal or regulatory obligations.

We do not sell personal data and we do not use your workspace records to train third-party AI models.

We process data to perform our contract with you, to comply with legal obligations, to protect legitimate interests such as security and fraud prevention, and with your consent where required.

Where consent is the basis, you can withdraw it at any time without affecting processing that already took place.

Data is stored in a managed Postgres database with row-level security. Each workspace is isolated at the database level, and access is limited to authenticated members of that workspace.

Authentication is handled by Supabase. Passwords are hashed and never stored in plain text. Traffic is encrypted in transit using TLS.

We retain account and workspace data for as long as your account is active. After deletion, backups may persist for a limited period before being overwritten.

We use infrastructure and authentication providers to run the service, including Supabase for database and authentication and Vercel for hosting. These providers process data on our instructions and under their own security obligations.

If we add payment, email or messaging providers in future, this policy will be updated before those features are enabled.

Subject to applicable law, you may request access, correction, export or deletion of your personal data, object to certain processing, or ask us to restrict it.

Workspace owners can export workspace records from Settings and can contact support to request deletion of a workspace.

You can lodge a complaint with your local data protection authority. We encourage you to contact us first so we can try to resolve the issue.

We use strictly necessary cookies to keep you signed in and to protect your session. We do not use advertising cookies.

See our Cookie Policy for the categories we use and how to control them.

NEXCRI is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children.

We may update this policy as the service evolves. Material changes will be announced in the app or by email before they take effect.