NEXA AI Privacy Policy

Version 1.1.0. Effective date: 15 May 2026.

This policy explains how NEXA AI LTD, company number 517299947, of Tel Aviv, Israel ("NEXA AI", "we", "us") handles personal data. It covers our website at https://www.nexadirect.ai, the NEXA Panel at https://app.nexadirect.ai, and the personal data we handle in providing our services.

We sell to businesses. Our customers are hotels, vacation rental managers and other accommodation operators (each a "Customer"). We are not an online travel agency or travel agent, we are not a party to any booking, and we never hold guest money. We charge our Customers a monthly subscription based on the number of units they list with us, with a performance discount that reduces the fee when the Customer's direct bookings are lower. We charge no commission and take no share of any booking. To calculate the discount we use the booking value, creation date and booking source of reservations, but not the identity of any guest. That is why we do not need to use personal data about guests in order to bill.

1. Who we are and how to reach us

1.1 NEXA AI LTD of Tel Aviv, Israel is responsible for the processing described in clause 2.2.

1.2 Privacy questions, requests and complaints go to [email protected]. General support is [email protected], billing is [email protected] and legal is [email protected].

2. Our two roles

2.1 Guest data: our Customer is the controller and we are its processor. Personal data about guests and travelers that reaches us through a Customer's property management system, through the booking engine we operate under the Customer's brand, or through the optional analytics script where a Customer installs it, is processed on that Customer's instructions under our Terms of Service. The Customer decides why and how it is used, and the data belongs to the Customer.

2.2 Our own business data: we are the controller. We decide the purposes ourselves for visitors to https://www.nexadirect.ai, prospects and marketing contacts, the staff users of a Customer's account, billing and payment records, support correspondence, security and fraud logs, and usage data describing how our services are used. We use that data to run the account, invoice and collect our fees, prevent fraud, keep our services secure, improve them, and defend or bring a claim.

2.3 We do not sell personal data. We do not sell or rent personal data and we do not share it for cross context behavioral advertising. We do not use guest data for advertising, for advertising measurement for anyone else, or to build profiles of people across unrelated websites.

2.4 If you are a guest. To see, correct or delete your data, contact the property you booked with. They decide the outcome. If you contact us we will pass your request to them where we can identify them, and help them answer it, but we cannot decide it ourselves.

3. What personal data we collect

3.1 Website and marketing. Name, business email, company, job title, country, what you write in a contact or demo form, campaign source, pages viewed, device and browser type, approximate location inferred from IP address, IP address, cookie identifiers, and opens and clicks on our own marketing emails.

3.2 Account users. Name, business email, phone, job title, role and permissions, credentials in hashed form, login timestamps, IP address and device information, actions taken in the NEXA Panel, and notification preferences.

3.3 Billing. Billing contact name and email, billing address, tax identifiers, invoices, amounts due and paid, the number of listed units charged in each period, the direct booking value used to calculate the fee for each period, payment status, and dispute and collection correspondence. Card data is handled by our payment processors. We do not store full card numbers and receive only a payment token and truncated card details.

3.3.1 Record of acceptance and billing authorisation. When an account is created and the Terms of Service are accepted we record the version of the Terms accepted, the date and time, the account and the user, the IP address from which acceptance was given, and the browser user agent. We keep this record to prove that the customer authorised the subscription and the recurring charge, to answer a billing question, and to defend a payment dispute or chargeback with a card issuer. Our lawful basis is our legitimate interest in being able to evidence an agreement we are a party to and to defend a claim.

3.4 Support. Tickets, emails, chat and call notes, attachments, and any personal data included in them, including guest data a Customer sends us in a support request.

3.5 The property management system integration. A Customer authorizes us to connect to its system, through which we receive and store reservation and property records. Depending on the system and the Customer's setup these can include guest name, email address, telephone number, postal address, country, language, number of guests, stay dates, property and unit, rate plan, booking value, booking and cancellation status and timestamps, booking source, guest notes, and payment status and truncated card details held by that system. We are a processor for all of it.

3.6 The booking engine. Where a Customer uses our booking engine, the guest books in a flow we operate under the Customer's brand. We receive guest name, email address, telephone number, address where collected, stay dates, property and unit, occupancy, rate plan and booking value, special requests, any consents given, IP address and device information, and the payment status returned by the Customer's own gateway. The guest pays the Customer and we never receive full card numbers. We are a processor for all of it.

3.7 The optional analytics script. A Customer may install our script on its own website so that booking events appear in its reporting. It is optional. If installed, the bookings it records may be counted toward the Customer's direct booking value for billing, as described in our Terms of Service. It records only the reservation identifier, the property and unit identifier, the stay dates, the booking value, the currency, the page URL, the timestamp, the IP address and the browser user agent. It does not collect guest names or guest email addresses, card data or free text guest notes. We are a processor for these records.

3.8 Security and audit records. Server, application and API logs, sign in and authorization events, error traces, fraud signals, and the IP addresses and device identifiers in those events.

3.9 Data we do not want. We do not ask for and do not intend to process special category data under Article 9 of the GDPR, criminal offense data, identity document numbers or sensitive personal information as defined in California law, and Customers should not send it. Our services are for businesses and are not directed at children, although a guest record may include the number of children in a party or a child's name where the Customer's system records it; we handle that only as a processor on the Customer's instructions.

4. Why we use personal data, and our legal basis

Where we are the controller under clause 2.2, we rely on the following.

4.1 To perform our contract, or to take steps before one. Creating and running an account, delivering the services purchased, operating the NEXA Panel, invoicing and collecting our fees, and providing support.

4.2 Our legitimate interests, weighed against the rights of the people concerned: preventing and detecting fraud; information security, access control and logging; improving and developing our services; dealing with a Customer through its staff users; marketing our own services to businesses; and bringing or defending legal claims.

4.3 Consent, where the law requires it, for non essential cookies and for marketing emails where consent is needed. You can withdraw consent at any time, which does not affect processing already carried out.

4.4 Legal obligation, for accounting, tax and invoicing records and for responding to lawful requests from authorities.

4.5 Guest data. For guest data we are a processor and the legal basis is chosen by the Customer, which is also responsible for telling its guests. We process it only on the Customer's instructions, which are to route travelers, complete and record bookings, write them back to the Customer's system, show the Customer its own booking records, provide support, keep the service secure and comply with the law.

4.6 Automated processing. We use automated processing to run the services, route travelers to a Customer's booking flow and detect fraud and abuse. We do not make decisions about people by automated means alone that produce legal or similarly significant effects on them. What a Customer pays is calculated from its number of listed units and decides nothing about any guest. We do not use personal data to train third party or publicly available AI models; where we use machine learning to improve our services we use aggregated data that identifies no one.

5. Cookies

5.1 https://www.nexadirect.ai and https://app.nexadirect.ai use strictly necessary cookies for sign in, session management and security, and, where you consent, analytics cookies that tell us how our own site and product are used. You can manage non essential cookies through our cookie banner and in your browser.

5.2 Where a Customer installs our optional analytics script on its own website, that website is the Customer's. The Customer is the controller for its visitors and is responsible for its own cookie notice and for obtaining any consent the law requires before the script runs. We do not provide that consent mechanism.

6. Who we share personal data with

6.1 Our hosting provider. Our systems, and the data in them, are hosted by Cloudraw in the Netherlands and Finland. Cloudraw stores the data and provides the infrastructure. It is bound by a written contract, may use the data only to provide that service to us, and is subject to confidentiality and security obligations.

6.2 Our payment processors. Subscription payments are processed by our payment processors, each of which acts as a controller in its own right for its own compliance and fraud purposes. We will tell you which processors we use on request. We send it billing contact and transaction details and receive back payment tokens, truncated card details and payment status.

6.3 No one else. Apart from Cloudraw and our payment processors, we use no other third party processor for our Customers' data. If that changes, we will tell our Customers by email or in the NEXA Panel before the new provider starts processing their data.

6.4 AI platforms that query our connector. Our connector answers questions from AI assistants and other AI driven discovery surfaces with availability, pricing, property and location information and a link to the Customer's booking flow. We do not send guest personal data to those platforms. We do not send them reservation records, guest names, guest contact details or booking histories. Where a traveler follows a link they arrive at the Customer's own booking flow, and that Customer's privacy notice applies from that point.

6.5 The Customer's own systems. Where we act as processor we write and return data to the Customer's property management system and show it in the NEXA Panel. The Customer decides who inside its organization sees it.

6.6 Others where we must. Our professional advisers under a duty of confidentiality; courts, regulators, tax authorities and law enforcement where the law requires or where we need to establish or defend a legal claim, telling the Customer first where we act as processor and the law allows; and, in a merger or sale of our business, the counterparty and its advisers under confidentiality obligations.

6.7 We disclose personal data to no one else for their own marketing.

7. International transfers

7.1 Where the data sits. Personal data is stored on servers in the Netherlands and Finland, both inside the European Economic Area.

7.2 Access from Israel. We are an Israeli company, and our staff access that data from Israel to operate and support the service. Israel is the subject of a European Commission adequacy decision, so this access is not a restricted transfer under European law.

7.3 Other transfers. Where personal data is transferred out of the European Economic Area or the United Kingdom to a country that is not covered by an adequacy decision, we use the European Commission standard contractual clauses, together with the UK International Data Transfer Addendum where the transfer is from the United Kingdom, and we apply measures such as encryption in transit and at rest and access on a need to know basis. You can ask for a copy of the relevant mechanism at [email protected], with commercial terms redacted.

8. How long we keep personal data

8.1 We keep personal data only as long as we need it and then delete or de-identify it. What we take into account is how long the account is active, how long we need the record to invoice and collect our fees, accounting and tax record keeping rules, the time limit for legal claims, and any dispute or legal hold.

8.2 In practice: the record of acceptance and billing authorisation described in clause 3.3.1, for the term and then at least 730 days, so that it remains available for the period in which a card dispute can be raised; account and configuration data, including the record of listed units, for the term and then 730 days after the account closes; reservation and booking event records, which we hold as processor, 730 days or as the Customer instructs; invoices and other accounting records, 730 days; support correspondence, 365 days; security and audit logs, 365 days; website and marketing data, which we do not retain; and backups, overwritten on our ordinary cycle within 24 hours.

8.3 Because the performance discount in our fees is calculated from booking value, creation date and booking source, we keep those reservation details, without guest identity, for as long as we need them to invoice, to answer invoice queries and to defend a fee claim, and in line with accounting and tax record keeping rules.

9. Security

9.1 We protect personal data with measures appropriate to the risk, including encryption in transit and at rest, access control on a need to know basis, multi factor authentication for administrative access, separation of production from test environments, logging of access, backups, patching, and confidentiality obligations for our staff.

9.2 No system is completely secure. If a personal data breach happens we act as the law requires, including telling the affected Customer without undue delay where we act as its processor.

10. Your rights

10.1 Under the GDPR and the UK GDPR, and subject to the conditions in the law, you may ask us for access to your personal data, correction, erasure or restriction; object to processing based on our legitimate interests; object at any time to direct marketing; ask for portability of data you gave us; and withdraw consent where we rely on it. Write to [email protected]. We may need to verify who you are, and we answer within one month, extendable by two further months for complex requests, in which case we will tell you.

10.2 If you are in California, you may ask what personal information we have collected about you, where it came from, why we have it and who we share it with, and ask for deletion or correction. We do not sell personal information and do not share it for cross context behavioral advertising, so the right to opt out does not apply, and we do not collect sensitive personal information to infer characteristics. We will not treat you differently for exercising a right. For guest and traveler information we act as a service provider to the Customer, which is the business. Email [email protected]; an authorized agent may act for you with written permission. We answer within forty five days, extendable by a further forty five with notice.

10.3 Requests about guest data go to the property. If your data was given to an accommodation operator that uses us, that operator decides the request. Send it to them. If you send it to us we will forward it where we can identify the operator and help them answer, but we cannot decide it.

10.4 You may complain to your data protection authority, and in the United Kingdom to the Information Commissioner's Office. We would rather you raised it with us first.

11. Changes to this policy

11.1 We may update this policy. The date above shows when it last changed. Where a change is material and we act as controller, we will tell you by email to the account contact, or on https://www.nexadirect.ai or in the NEXA Panel, before it takes effect.

12. Contact

12.1 NEXA AI LTD, Tel Aviv, Israel. Privacy: [email protected]. Support: [email protected]. Billing: [email protected]. Legal: [email protected].