At a glance
- We never sell your personal data, and we do not use confidential client material to train AI models.
- Analytics and advertising cookies load only if you accept them. You can change your choice any time under .
- We are the controller for website visitors, enquiries and clients, and a processor for data our clients put into Nexlla platforms (see our Data Processing Agreement).
- You can ask to access, correct, delete or export your data by emailing [email protected]. We reply within 30 days.
- Inboxy, Dragy, Rafeeq and QRy have their own privacy policies, which apply to those products.
Who we are and what this policy covers
The Nexlla Creative Agency brand and services are operated by Nexlla Group (“Nexlla”, “we”, “us”), a design and technology studio that works as a cloud-based business with no physical office. Contact is by email. This policy applies when you:
- visit www.nexlla.com or any page that links to this policy;
- contact us, book a meeting, chat with our support assistant, request a proposal or apply for a job;
- become a client, supplier or partner, or receive our services;
- use a Nexlla platform we operate — the Website Dashboard (dashboard.nexlla.com), Marketing Suite (marketing.nexlla.com), Customer Portal (login.nexlla.com), the Nello AI assistant and the related mobile apps; and
- receive emails, WhatsApp messages or other communications from us.
Controller and processor
For the situations above, Nexlla decides why and how your data is used, so we are the controller. When a client uses a Nexlla platform to manage their own customers, contacts, website visitors or staff, the client is the controller and Nexlla acts as their processor under our Data Processing Agreement. If you are one of our client’s customers, please contact that client first; we will help them answer you.
Products with their own policies
Some Nexlla products have dedicated privacy policies that apply instead of this one for that product: Inboxy, Dragy and Rafeeq. Where a product policy is stricter, the product policy wins.
The personal data we collect
| Source | Examples |
|---|---|
| You give it to us | Name, work email, phone or WhatsApp number, company, job title, country, budget and project details, messages, files and brand assets, meeting bookings, CVs and portfolios, billing details and feedback. |
| Account and platform use | Login email, hashed password, role and permissions, workspace settings, content you create, activity and audit logs, device and push-notification tokens, and AI prompts and outputs inside Nexlla platforms. |
| Collected automatically | IP address, browser and device type, pages viewed, referring page, approximate location derived from IP, an anonymous visitor ID used for live visitor counts, error logs and security events. Analytics and advertising data is collected only after you consent. |
| From other people | Referrals and introductions, public business profiles (for example LinkedIn or a company website), event organisers, our clients when they invite you to a platform, and payment providers confirming a payment. |
We do not ask for special-category data (such as health, religion or biometric data). Please do not send it to us unless a project genuinely needs it and we have agreed in writing how it will be protected.
We never ask for full payment card numbers. Card payments are handled directly by our payment providers (Stripe or PayPal), and we only receive confirmation and limited details such as the last four digits.
How we use your data and our legal bases
| Purpose | Legal basis |
|---|---|
| Answering enquiries, proposals, meeting bookings and support chats | Steps before a contract; legitimate interests |
| Delivering services, managing projects, invoices and accounts | Performance of a contract |
| Running, securing and improving our website and platforms, preventing spam and fraud (including reCAPTCHA or Turnstile checks and rate limits) | Legitimate interests; legal obligation |
| Website analytics and advertising measurement | Consent (through our cookie banner) |
| Marketing emails and WhatsApp messages about our services | Consent, or legitimate interests for existing business contacts where the law allows; you can opt out at any time |
| Recruitment | Steps before a contract; legitimate interests |
| Accounting, tax, legal claims and regulatory requests | Legal obligation; legitimate interests |
When we rely on legitimate interests, we balance our interests against your rights. You can object at any time (see your rights).
AI features and automated processing
Some Nexlla services use artificial intelligence: the Nello assistant, AI drafting and reply suggestions in the Marketing Suite, AI features in the Customer Portal, our website support assistant, and AI work we build for clients.
- Providers. Depending on the feature and the client’s settings, prompts and the content needed to answer them may be processed by Anthropic, OpenAI or Google (Gemini) under their business API terms. Those providers act as our sub-processors and, under those terms, do not use API data to train their models.
- No training on your confidential material. We do not use confidential client material or platform content to train or fine-tune AI models unless you agree in writing.
- Human control. Nexlla AI features propose actions; a person confirms them. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
- Accuracy. AI output can be wrong. Our Terms explain your responsibility to review it before use.
Cookies and similar technologies
We use strictly necessary cookies and browser storage to run the site, remember your consent choice, keep our support chat connected and protect forms from spam. Google Analytics and Google Ads cookies are used only if you accept them in our consent banner (Google Consent Mode v2 starts with everything denied). The full list, with lifetimes, is in our Cookie Policy. You can change your choice at any time under .
Marketing communications
We send newsletters, announcements and follow-up emails only where you have agreed or where the law allows us to contact existing business contacts. Every marketing email has a one-click unsubscribe link. When you opt out, we keep your address on a suppression list so we can honour your choice; we do not use it for anything else.
If you message us on WhatsApp, your messages are processed through Meta’s WhatsApp Business service. You can reply “STOP” at any time to stop promotional messages.
Opting out of marketing does not stop service, billing or security messages we must send.
Who we share data with
We do not sell personal data. We share it only when needed, with:
- Service providers (sub-processors) that host, secure or power our services, bound by contracts that limit their use of the data. These include Hostinger (servers), Cloudflare (network security and content delivery), Google (Analytics, Tag Manager, Ads, reCAPTCHA, Fonts and Firebase notifications), Anthropic, OpenAI and Google Gemini (AI features), Stripe and PayPal (payments) and Meta (WhatsApp). The current list, with purposes and locations, is in our Data Processing Agreement.
- Our team and vetted contractors working on your project, under confidentiality obligations.
- Professional advisers, such as lawyers, accountants, auditors and insurers.
- Authorities where the law requires it, or to protect rights, safety and security.
- A buyer or investor if Nexlla is involved in a merger, acquisition or restructuring, under confidentiality and on the same protections.
- Anyone else you ask us to share it with.
Our business email runs on our own mail server (mail.nexlla.com), not on a third-party mailbox provider.
International transfers
Our servers are hosted in Lithuania, in the European Union, so the GDPR applies to that hosting. Our team works from the UAE, Turkey and Syria, and our other providers operate data centres in several regions, including the European Union, the United Kingdom and the United States. When personal data moves across borders, we protect it with the safeguards the applicable law requires — for example adequacy decisions, standard contractual clauses, or the transfer conditions in the UAE Personal Data Protection Law — plus encryption in transit and access controls.
How long we keep data
We keep personal data only as long as we need it for the purposes above, then delete or anonymise it. Typical periods:
| Data | Typical retention |
|---|---|
| Enquiries, leads and CRM records | Up to 3 years after our last interaction, unless you become a client |
| Client, project and contract records | For the relationship, then up to 5 years for claims and record-keeping |
| Invoices and accounting records | At least 5 years, as UAE tax and commercial law requires |
| Job applications | 12 months after the role closes, unless you agree to longer |
| Marketing preferences and unsubscribes | Until you opt out; suppression entries are kept so we never email you again |
| Platform accounts | While the account is active; deleted or returned under the client’s contract after it ends |
| Analytics data (with consent) | No longer than 14 months in Google Analytics |
| Consent choice cookie | 180 days |
| Server and security logs | Only as long as needed for security and troubleshooting, then deleted on a rolling basis |
We may keep data longer if the law requires it or to establish, exercise or defend legal claims.
How we protect data
We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), hashed passwords, role-based access, least-privilege administration, network protection, rate limiting, spam and bot protection, audit logs, backups and staff confidentiality obligations. More detail is on our Trust & security page.
No system is perfectly secure. If a personal data breach is likely to put you at risk, we will tell you and the relevant authority as the law requires.
Your rights and how to use them
Depending on where you live, you can ask us to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data, or restrict how we use it;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive your data in a portable format or have it sent to another provider;
- withdraw consent at any time, without affecting earlier processing; and
- not be subject to decisions based solely on automated processing that significantly affect you.
Email [email protected] with “Privacy request” in the subject. We may need to verify your identity. We reply within 30 days; if a request is complex we will explain why we need more time, as the law allows. We do not charge for reasonable requests.
If you are unhappy with our answer, you can complain to your data protection authority — in the UAE, the UAE Data Office; in Saudi Arabia, SDAIA; in the EU or UK, your local supervisory authority. We would appreciate the chance to help first.
Regional notices
United Arab Emirates and the GCC
We process personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where they apply, the Saudi Personal Data Protection Law, Qatar Law No. 13 of 2016, Bahrain Law No. 30 of 2018, Oman Royal Decree No. 6/2022 and Kuwait’s data privacy regulations. Clients in free zones with their own regimes (such as DIFC or ADGM) can rely on our DPA for the processor terms those laws require.
European Economic Area and United Kingdom
Our servers are in Lithuania, in the European Union, so the GDPR applies to the hosting of your data. If the GDPR or UK GDPR applies to our processing of your data, the legal bases above are the ones we rely on, and you have all the rights listed in the previous section.
California and other US states
We do not sell personal information, and we do not knowingly sell or share the data of anyone under 16. Advertising cookies, which some US laws call “sharing” for cross-context behavioural advertising, run only if you accept them, and you can switch them off under . We honour Global Privacy Control signals as an opt-out where the law requires it. You can use the rights in the previous section without discrimination.
Children
Our website and services are for businesses and adults. They are not directed at children under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact [email protected] and we will delete it.
Changes to this policy
We update this policy when our services, providers or the law change. The “Last updated” date at the top shows the current version. If a change materially affects how we use data you have already given us, we will tell you by email or in the platform before it takes effect, and ask for consent where the law requires it.
Contact us
Nexlla Group, operating the Nexlla Creative Agency brand
A cloud-based business with no physical office. Contact is by email.
Email: [email protected]
Common questions
Does Nexlla sell my personal data?
No. Nexlla never sells personal data. We share it only with service providers that help us run our services, our team, professional advisers, or authorities when the law requires it.
Does Nexlla use my data to train AI models?
No. We do not use confidential client material or platform content to train or fine-tune AI models unless you agree in writing. Our AI providers (Anthropic, OpenAI and Google) process API data under business terms that exclude training.
How do I delete my data or get a copy of it?
Email [email protected] with "Privacy request" in the subject. We verify your identity and reply within 30 days, free of charge for reasonable requests.
Which data protection laws does Nexlla follow?
Nexlla follows the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), applicable GCC data protection laws such as the Saudi PDPL, and the GDPR or UK GDPR where they apply. Our servers are in Lithuania, in the EU, so the GDPR applies to that hosting.
Does nexlla.com use tracking cookies?
Only with your consent. Necessary cookies run the site; Google Analytics and Google Ads cookies load only if you accept them in the cookie banner, and you can change your choice at any time under Cookie settings.
Is my data stored outside my country?
It can be. Our servers are hosted in Lithuania, in the EU. Our team works from the UAE, Turkey and Syria, and our other providers run data centres in regions including the EU, the UK and the US. We protect transfers with the safeguards the law requires, plus encryption and access controls.