Privacy Policy

1. Scope

This Privacy Policy applies to Nawexa's public website and to Nawexa products and services that reference this Policy, including AIOS. It explains the categories of information we handle, why we use them, how connected-service data is treated, and the choices available to users.

Where a specific product presents an additional privacy notice at the point a feature is used, that notice supplements this Policy for that feature.

2. Information we handle

The information processed depends on how you use Nawexa services. It may include:

• Account and profile information that you or your organization provide to use a Nawexa product.
• Business workflow data submitted to, generated by, or processed within a workflow you configure.
• Integration data from third-party services you intentionally connect, subject to the permissions you authorize.
• Technical and security information such as request timestamps, network and browser details, error events, authentication events, and audit records.
• Communications you send to Nawexa for support, project discussions, or operational requests.

We aim to collect and process only information reasonably necessary to provide, secure, support, and improve the service or workflow you have chosen to use.

3. Google API data and connected Google services

What access may be requested

When you choose to connect a Google service to AIOS or another Nawexa product, Google shows the permissions requested before you authorize access. Depending on the feature, the product may process Google Drive files, folders, file metadata, or related account information that you explicitly choose, create, open, select, or otherwise make available to the connected workflow.

Nawexa does not ask for your Google password. Authorization is performed through Google's OAuth process, and you remain in control of whether to grant or revoke the connection.

Why Google user data is used

Google user data is used only to provide, operate, or secure the user-requested connected functionality. Examples include moving information into a workflow, creating or updating a user-directed file, retrieving a file the user selected for a task, maintaining the authorized connection, or recording security and audit events related to the integration.

What we do not do with Google user data

• We do not sell Google user data.
• We do not use Google user data for targeted advertising or advertising profiles.
• We do not use Google user data for purposes unrelated to the connected feature the user enabled.
• We do not permit humans to read Google user data except when necessary for security, support requested by the user, legal obligations, or service operation under appropriate access controls.

OAuth credentials

Connection credentials required to maintain an authorized Google integration are handled server-side and protected using security controls designed to prevent exposure to end users, logs, source code, and unrelated systems. When a user disconnects an integration, the connection is revoked or disabled so it can no longer be used for new requests.

4. How we use information

We use information for purposes that include:

• providing the product, workflow, integration, or service requested by the user;
• authenticating users and maintaining secure sessions and connected integrations;
• coordinating user-configured automation, AI-assisted workflows, and human approval steps;
• responding to support or project enquiries;
• detecting abuse, investigating errors, maintaining auditability, and protecting systems;
• maintaining service reliability and improving functionality based on operational needs.

We do not use connected-service data to create unrelated advertising products or sell personal data.

5. Sharing and service providers

We may share information only where reasonably necessary to operate the service, comply with law, protect users or systems, or follow a user's instruction. This can include infrastructure, hosting, communications, security, and other technical providers acting on our behalf.

Third-party integrations that a user chooses to connect may receive information as necessary to complete the user's requested action. Their handling of data is governed by their own terms and privacy practices in addition to any contractual protections that apply.

We do not sell personal information or Google user data.

6. Storage and retention

Information is retained only for as long as reasonably necessary for the purpose for which it was processed, to maintain the user's configured service or integration, to preserve security and audit records, or to meet applicable legal and operational requirements.

Some workflows may intentionally save business records, files, or generated outputs because persistent storage is part of the feature the user selected. Google-connected data is not retained for unrelated purposes.

OAuth connection credentials may remain stored while the integration is active. Disconnecting a provider disables or revokes the connection for future access. Limited technical, security, or audit records may remain where required for system integrity, fraud prevention, dispute handling, or legal compliance.

7. Security

Nawexa uses administrative and technical safeguards intended to protect information against unauthorized access, disclosure, alteration, and loss. Safeguards may include encryption, secret-management controls, access restrictions, audit records, network protections, and separation of operational environments.

No online system can be guaranteed to be completely secure. Users should also protect their credentials, review permissions before authorizing integrations, and promptly report suspected unauthorized access.

8. Your choices and controls

Depending on the service, you may be able to review or change connected integrations, disconnect a provider, remove or update information in your workspace, or request assistance concerning personal information.

You can also review or revoke third-party access to your Google Account through Google's account security controls. Revoking access may prevent the connected Nawexa feature from continuing to operate until authorization is restored.

9. Logs, cookies, and similar technologies

The public Nawexa website may generate standard server and security logs needed to deliver and protect the site. The current public site does not intentionally use advertising trackers.

Nawexa product interfaces may use essential session, authentication, security, or preference technologies required for the product to function. If additional analytics or tracking technologies are introduced, this Policy and any relevant in-product notice will be updated as appropriate.

10. International processing

Nawexa services may use infrastructure or service providers located in more than one country. As a result, information may be processed outside the country in which a user is located. Where applicable, we use appropriate measures intended to protect information during such processing.

11. Children

Nawexa's business technology services are not directed to children. We do not knowingly design AIOS or the corporate website for use by children as consumers.

12. Changes to this Policy

We may update this Policy as products, integrations, legal requirements, or data practices change. The effective date at the top of this page will be updated when material changes are published. Where appropriate, additional notice may be provided within the relevant product.

13. Contact