Privacy Policy
This policy explains what personal data Nexva One processes, why, and what choices you have. It covers the Nexva One connector that you add to an AI assistant (such as ChatGPT, Claude or Cursor), the shopping cards it shows inside that assistant, and this website at nexva.co.
1. Who is responsible
The controller is NEXVA GmbH, a company registered in Austria (FN 677508 k, Commercial Court Vienna (Handelsgericht Wien)). For any privacy question or request, write to legal@nexva.co.
2. What Nexva One is, and what it is not
Nexva One is a directory that lets your AI assistant search and compare products from independent stores and open a store’s checkout for you. We are not the seller. When you buy, the store that sells the item is the seller and processes your order and payment under its own privacy policy. We never receive your card details.
3. Data we process
| Category | What it includes | When |
|---|---|---|
| Shopping requests | The search terms, filters, product choices and language your assistant sends to Nexva One when it calls one of our tools. | Every time the assistant uses Nexva One |
| Cart | Products, options and quantities you add, linked to a random cart identifier. | When you add something to a cart |
| Account (optional) | Account name, email address, mobile number, nickname and password. | Only if you create an account or sign in on the card |
| Shipping addresses (optional) | Recipient name, mobile number and address you save on the card. | Only if you save an address |
| Order references | Checkout session identifiers and confirmation codes, so you can ask where an order is. | When you open a store’s checkout |
| Technical data | IP address, timestamps, the name and version of the assistant app that connected, and error logs. | When the connector or this website is used |
We do not ask for, and you should not enter, payment card numbers, government ID numbers or health information in the chat or on the card. We do not request your precise location and we do not receive your conversation history: we only see what your assistant sends when it calls a Nexva One tool.
4. Why we use it, and our legal basis
- To provide the service you ask for — searching stores, keeping your cart, opening a checkout, managing your account and saved addresses (performance of a contract, Art. 6(1)(b) GDPR).
- To keep the service secure and working — preventing abuse, fixing errors and measuring load (our legitimate interests, Art. 6(1)(f) GDPR).
- To meet legal obligations — for example tax, accounting or responding to lawful requests (Art. 6(1)(c) GDPR).
We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models.
5. Who receives it
- The store you check out with. When you open a checkout, we pass that store the items in your cart and, if you chose one, the saved shipping address, so it can prepare your order. From then on the store’s own privacy policy applies.
- Our group company and hosting providers. Curless Pte. Ltd. (Singapore) operates our servers on Amazon Web Services in Singapore on our behalf. This website is hosted by Vercel Inc.
- Your AI assistant provider. Results we return are shown inside the assistant you use (for example OpenAI or Anthropic), which handles them under its own privacy terms.
- Authorities, where the law requires it.
6. International transfers
Our servers are in Singapore, which is outside the European Economic Area. Where personal data of people in the EEA, the UK or Switzerland is transferred there, we rely on the European Commission’s Standard Contractual Clauses, together with technical and organisational safeguards. You can ask us for a copy at legal@nexva.co.
7. How long we keep it
- Carts that are not linked to an account: deleted 90 days after the last change.
- Accounts and saved addresses: kept until you delete them or ask us to; then removed within 30 days, unless we must keep a record by law.
- Order references: kept for as long as needed to answer questions about the order, and at most 24 months.
- Technical logs: kept for up to 30 days, longer only when needed to investigate a security incident.
8. Your rights
Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw any consent you gave. Send your request to legal@nexva.co; we answer within one month. You also have the right to complain to a data protection authority — in Austria, the Datenschutzbehörde (dsb.gv.at) — or the authority where you live.
You can remove saved addresses on the card at any time, sign out, or remove Nexva One from your assistant’s connector settings to stop it from being used.
9. Security
Connections to Nexva One and this website are encrypted in transit. Access to personal data is limited to people who need it to run the service.
10. Children
Nexva One is not directed at children under 13, and you must be at least 16 to create an account. Stores may set higher age limits for their products.
11. Changes
If we change this policy we will update the date above, and for material changes we will give notice on this website before they take effect.
See also our Terms of Service and Support.