Privacy & Cookies

1. In short

• We keep only what your account and your payments need. There is no advertising, analytics or tracking, and we do not sell your data.
• Your files and tables are processed in the server's memory only while the job runs, and are not stored.
• Our AI service provider understands your requests and reads your documents (section 4).

2. What we keep, and for how long

• Account: your email address, your name (optional), your language, a one-way hash of your password (the password itself is never stored) and the date and text version of the terms you accepted. If you choose "Continue with Google", the email address and name Google sends us. Kept while your account is open.
• Sessions and security: a hash of the session token, the IP address and browser the session was opened from; deleted 7 days after the session ends or you sign out. Failed sign-in attempts and the hashes of email links (verification, password reset) are deleted after 1 day.
• Usage and credits: the date and type of each job, its number of rows and pages and the credits charged; never the content. Job records are kept for 13 months, monthly credit counters for 25 months.
• Subscriptions and payments: plan, amount, period dates, Lemon Squeezy's transaction reference and the history of purchased credits (your remaining credits are calculated from it); never card details. Kept as the record of your payments.
• Other: the names and hashes of API keys; team memberships and invitations (an invitation that is not accepted is deleted 30 days after it expires); the number of requests made that day, for the AI daily limit (deleted after two days at the latest).

When you close your account, your email address, name, sessions, API keys and team memberships are deleted; usage and payment records stay for the periods above with your name and email address removed. You can get a copy of the records we keep about you with the "Download my data (JSON)" button on your account page.

In the development period we keep your written requests and job details (steps, column headers, counts, file names, result), not table contents or files, to improve the service. Only the Nexell team sees them; they are deleted after 90 days. Feedback you send through the form (text, optional rating and email, page path, language, short browser summary; linked to your account if signed in) is kept for 12 months.

3. Your files

The text you paste, the files you add and the table you work on reach our server over an encrypted connection (HTTPS) only to do the job you asked for, and are kept in memory only while the job runs; they are not written to disk, to a database or to server logs, and are never used to train any model. That is why we cannot give your results back later: download the result or keep it in your browser's work history. If your content includes other people's personal data, processing it lawfully is your responsibility.

4. What is sent to our AI service provider

To understand your request and to read your documents and turn them into a table, your request text and the content of your files are sent over an encrypted connection to our AI service provider. Personal data in text content (for example names, phone numbers, email addresses, ID and tax numbers, IBANs) is replaced with placeholders before it is sent; personal data inside PDFs and images cannot be masked. Your account details and IP address are not sent. The provider does not use this data to train its models. The provider's name and retention terms are in section 6 of the Terms of Use. Do not upload documents containing personal or confidential information you do not want to share.

5. Our service providers

• Our AI service provider (United States; named in section 6 of the Terms of Use): understanding your requests and reading your documents.
• DigitalOcean (server in Frankfurt, Germany): hosting the server and the account database.
• Resend (United States): sending account emails (welcome, verification, password reset, subscription and credit notices, team invitations, account closure).
• Lemon Squeezy (United States): taking payment, invoicing and taxes. Your email address, your name if your account has one and your user number are passed to the checkout form; Lemon Squeezy collects your card details directly.
• Google: verifying your identity, only if you choose "Continue with Google".

Some of these providers are outside Turkey and the EU, so your data is transferred abroad. We do not share your data with anyone other than these providers, except with the competent authorities when the law requires it.

6. Cookies and what your browser keeps

We use no advertising, analytics or tracking cookies, and no other company's scripts or fonts are loaded on our pages. There are only two cookies, both for signing in:

• nx_session — remembers that you are signed in (HttpOnly, Secure, SameSite=Lax). If you do not tick "Remember me on this device" when you sign in, it is deleted when you close the browser; if you tick it, it stays for 30 days. Without the tick, the session also ends on the server after 24 hours at the latest, even if the browser stays open. "Sign out" deletes it and also ends the session on the server.
• nx_g_state — set only when you choose "Continue with Google", to protect that sign-in step against forged requests; up to 10 minutes.

Kept in your browser's own storage, on this device only: your theme (nx.theme) and language (nx.locale), the last 40 requests you typed in the tool (nx.komutlar), whether the tool's side panel is collapsed (nx.yanDar), the company details you entered in the document form (nx.firma) and whether you dismissed the development-phase banner (nx.betaSerit) in localStorage; your work history, the latest 100 jobs, in IndexedDB (nexell). When you press "Continue in the tool" in the try-out on the home page, the text you typed and the files you added wait in IndexedDB (nx-aktarim) to be handed to the tool: nothing is uploaded during the handoff, they are read and deleted when the tool opens, and if they are not used within 10 minutes they expire and are deleted the next time you open the tool. You can delete them with "Clear history" in the tool, "Delete saved company details" in the document form, or in your browser settings.

All of these are needed only for features you use, so we do not show a cookie consent banner.

7. Your rights (KVKK and GDPR)

We process your data to open your account, provide the service and take payment, to meet legal record-keeping duties and to keep the service secure. Under Turkey's Personal Data Protection Law No. 6698 (KVKK) and the General Data Protection Regulation (GDPR) in the EU and the UK, you have the right to learn whether your data is processed, to get a copy, to ask for it to be corrected or deleted, to object to its processing, and to ask for its processing to be restricted or for it to be moved to another service. To use these rights, write to destek@getnexell.com from the email address registered to your account; we reply within 30 days at the latest. If you are not satisfied with our reply, you can complain to Turkey's Personal Data Protection Board or to the data protection authority of the country where you live.

8. Changes and contact

We update this notice as the service changes; we announce important changes on the site before they take effect.

Nexell — contact: destek@getnexell.com