Privacy Policy

1. Who we are

The Service is operated by Nexora Information Technology Consultants L.L.C, a company established in Dubai, United Arab Emirates. We are the controller responsible for the personal data processed through the Service.

If you have any question about this policy or about your data, you can contact us at info@nexora-it.com.

2. Information we collect

We collect the following categories of information, most of which you provide directly when setting up and using your account:

• Account details — your name, email address, password (stored only as a secure hash), and account/role settings.
• Company and entity data — the details of the companies and entities you manage, including trade licence information, legal form, jurisdiction/free zone, licensing authority, and key compliance dates.
• Employee data (MOHRE / WPS module) — where you use the labour-compliance features, information about your employees such as name, nationality, job title, salary details for WPS, Emirates ID and visa details. Sensitive identifiers such as Emirates ID and visa numbers are encrypted at the field level in our database.
• Uploaded documents — files you upload to the document vault or submit to the AI analyzer (for example trade licences, contracts, and compliance documents).
• Financial figures from connected accounting tools — where you choose to connect Zoho Books, Xero or QuickBooks, we import your financial reports (such as Profit & Loss figures) on a read-only basis to populate your UAE Corporate Tax estimate. See the Accounting Integrations section below.
• Payment details — subscription payments are processed by Stripe. Card and payment details are entered into and handled by Stripe; we do not receive or store your full card number. We retain only limited billing metadata (such as subscription status, plan and renewal dates).
• Usage and analytics data — technical information such as IP address, device and browser type, pages visited and actions taken, collected to operate, secure and improve the Service (including via Google Analytics).

3. How we use your information

We use personal data to provide and improve the Service, and for the following purposes:

• To create and manage your account and authenticate you.
• To generate compliance calendars, reminders, documents, tax estimates and health scores based on the data you enter.
• To provide the AI document-generation, document-analysis and chat features.
• To process subscriptions, trials and billing through Stripe.
• To send transactional and reminder emails (for example deadline reminders and account notices).
• To secure the Service, prevent abuse, and comply with applicable legal obligations.
• To understand usage and improve features and performance.

4. We do not sell your personal data

We do not sell your personal data, and we do not share it with third parties for their own marketing. We share data only with the service providers (subprocessors) that help us operate the Service, as described below, and only as needed to provide it to you.

5. Accounting integrations (read-only)

You can optionally connect a supported accounting tool — Zoho Books, Xero or QuickBooks (Intuit) — to the Service. These integrations are read-only and are used for a single purpose.

When you connect one of these tools, you authorise us, through the provider's official OAuth flow, to access your financial reports (for example your Profit & Loss report) on a read-only basis. We use this data solely to populate your own UAE Corporate Tax estimate inside your account.

We never write to, or make any changes in, your accounting tool. We do not use this financial data for any other purpose, and we never share it with, or sell it to, any third party.

You can disconnect any accounting integration at any time from within the Service. Disconnecting immediately revokes our access, and we stop retrieving any further data from that tool.

6. Service providers (subprocessors)

We rely on a small number of trusted service providers to run the Service. Each processes personal data only on our behalf and under appropriate safeguards:

• Supabase — database, authentication and file storage.
• Stripe — subscription billing and payment processing.
• Anthropic — the AI model that powers document generation, analysis and the compliance assistant.
• Resend — delivery of transactional and reminder emails.
• Google Analytics — website and product usage analytics.
• Vercel — application hosting and content delivery.
• Accounting integrations you authorise — Zoho Books, Xero and QuickBooks (Intuit), used read-only as described above.

7. How we protect your data

We apply technical and organisational measures designed to protect your data, including:

• Encryption of data in transit (HTTPS/TLS) and encryption at rest.
• Field-level encryption of sensitive identifiers such as Emirates ID and visa numbers, and of the access tokens used for accounting integrations.
• Row-level access controls so that each account can access only its own data, plus role-based permissions within an account.
• Storage of passwords only as secure hashes, never in plain text.

8. Data retention

We retain your personal data for as long as your account is active and for as long as needed to provide the Service. If you close your account or ask us to delete your data, we will delete or anonymise your personal data, except where we are required to retain certain records to comply with legal, tax or accounting obligations, or to resolve disputes and enforce our agreements.

Cached financial figures imported from an accounting integration are retained only to display your tax estimate and are removed when you disconnect the integration or delete the related records.

9. Your rights

You have the right to access the personal data we hold about you, to request correction of inaccurate data, and to request deletion of your data. Much of your data can be viewed and edited directly within the Service. For any other request, contact us at info@nexora-it.com and we will respond within a reasonable period.

10. International transfers

Some of our service providers process data on infrastructure located outside the United Arab Emirates. Where data is transferred internationally, we take steps to ensure it remains protected consistent with this policy and applicable law.

11. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page, and where appropriate we will notify you through the Service.

13. Governing law and contact

This Privacy Policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai.

For any privacy question or request, contact us at info@nexora-it.com.