Legal

Data Processing Addendum

Version 1.0 · Last updated: 2026-11-02

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between [OWNER: legal entity name and form, e.g. company name and state of registration] (“Processor”, “Nexxtool AI”) and the customer (“Controller”) and applies when Nexxtool AI processes personal data on the customer’s behalf. To get a signed copy, email support@nexxtool.ai with your company name and signatory; we countersign.

1. Roles and scope

For personal data contained in the replies, rules and facts the customer submits (“Customer Data”), the customer is the controller and Nexxtool AI is the processor. For its own account, billing and security data Nexxtool AI is a controller under the Privacy Policy. Subject matter: checking AI-written text against the customer’s rules. Duration: the life of the account. Nature: receipt, evaluation, limited storage (result, fingerprint and 60-character preview) and deletion. Data subjects: the customer’s end customers and staff whose data appears in replies. Types of data: whatever the customer includes in the text it sends; the customer should not send special-category data unless needed.

2. Instructions

Nexxtool AI processes Customer Data only on the customer’s documented instructions (the Terms, this DPA, and use of the service and its settings) and to meet legal duties. It tells the customer if it believes an instruction breaks data protection law. Nexxtool AI does not sell Customer Data and does not use it to train AI models.

3. Confidentiality

People who can access Customer Data are bound by confidentiality, and access is limited to what their work needs. Administrator actions are logged.

4. Security measures

• Encryption in transit (TLS); encrypted nightly database backups held 30 days.
• API keys stored only as hashes; secrets never returned after creation.
• Access control on the database; administrator console limited to named owners; audit log of administrator actions.
• Rate limiting and abuse controls; hard monthly caps per account.
• Full reply text is not stored; history keeps a fingerprint and a 60-character preview, deleted on a plan-based schedule.
• Account deletion removes the account’s data immediately.

5. Subprocessors

The customer gives general authorisation for the subprocessors on the subprocessors page. Nexxtool AI binds each to data protection duties no less protective than this DPA and remains responsible for them. It will update that page before adding or replacing a subprocessor and notify customers who asked for notice at least 30 days ahead; the customer may object on reasonable data protection grounds within that time, and if the parties cannot resolve it the customer may cancel the affected service.

6. International transfers

Where Customer Data is transferred out of the EEA, UK or Switzerland to a country without an adequacy decision, the parties rely on [OWNER: transfer mechanism: Standard Contractual Clauses (controller-to-processor module, plus UK addendum) and/or the EU-US Data Privacy Framework; lawyer to confirm and attach].

7. Data subject requests

Nexxtool AI helps the customer answer requests from data subjects. The customer can export and delete its data itself in the dashboard (Settings). Nexxtool AI passes on any request it receives directly and does not answer it except on the customer’s instruction. It also helps, at reasonable cost, with data protection impact assessments and consultations relating to the service.

8. Personal data breaches

Nexxtool AI notifies the customer without undue delay, and within [OWNER: number of hours, commonly 72] of becoming aware, of a breach affecting Customer Data, with the information it has to help the customer meet its duties.

9. Deletion and return

The customer can export its data before it deletes the account. On deletion Nexxtool AI deletes Customer Data immediately from the live service; copies in encrypted backups expire within 30 days. Billing records are kept by Stripe as the law requires.

10. Audits

Nexxtool AI will give the customer the information needed to show compliance with this DPA, and allow reasonable audits by the customer or its auditor (not more than once a year, with 30 days’ notice, during business hours, at the customer’s cost, under confidentiality) where that information is not enough or a regulator requires it.

11. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.