← Back to Naxora

Privacy Policy

Last updated: March 4, 2026

This Privacy Policy explains how Naxora (“we,” “us,” or “our”) collects, uses, discloses, and protects your information when you use our Service. We are committed to protecting your privacy and being transparent about our data practices.

Naxora operates as a sole proprietorship in the United States. For purposes of the EU General Data Protection Regulation (“GDPR”), we act as the data controller for account and billing data we collect directly. For business data you process through our software (customer conversations, knowledge bases, etc.), you are the data controller. Your data runs in an isolated container and we do not access it except for essential infrastructure maintenance.

1. Our Core Principle: Isolation & Privacy

Naxora is built with data isolation as a fundamental design principle:

2. Information We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Information We Do NOT Access

3. How We Use Your Information

Legal Basis (GDPR): We process your data based on: (a) performance of our contract with you; (b) our legitimate interests in operating and improving the Service; (c) your consent where required; and (d) compliance with legal obligations.

4. AI Processing

Default AI Model: When using our default AI model (Anthropic Claude), conversation data is sent to the AI provider for processing. This data is transmitted in real-time and is not stored by us. Anthropic's data practices are governed by their own privacy policy. We use a commercial API agreement that prohibits the use of your data for model training.

BYOK Mode: When you use your own API keys, all AI requests go directly from your container to your chosen provider. We do not proxy, intercept, log, or have any visibility into these requests. Your API keys are stored encrypted within your isolated container.

5. Cookies & Tracking Technologies

Our website (naxora.ai) uses the following cookies and tracking technologies:

We do not use advertising cookies or sell data to advertisers.

6. Third-Party Services

We share limited data with the following third-party service providers:

We do not sell, rent, or share your personal information with third parties for their marketing purposes. Ever.

7. Data Retention

8. Data Security

We implement industry-standard security measures to protect the data we do collect, including: encryption in transit (TLS 1.2+), encryption at rest for server-stored data, isolated containers per customer, regular security assessments, access controls and authentication, and secure coding practices. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a data breach affecting your personal information, we will: (a) notify affected users via email within 72 hours of becoming aware of the breach; (b) notify relevant supervisory authorities as required by applicable law (including GDPR requirements); (c) provide details about the nature of the breach, data affected, and steps we are taking; and (d) offer guidance on steps you can take to protect yourself.

10. Your Rights & Choices

10.1 All Users

10.2 European Users (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the GDPR, including: the right to restrict processing, the right to object to processing based on legitimate interests, the right to withdraw consent at any time, and the right to lodge a complaint with your local data protection authority.

10.3 California Users (CCPA/CPRA)

If you are a California resident, you have the right to: (a) know what personal information we collect, use, and disclose; (b) request deletion of your personal information; (c) opt out of the “sale” or “sharing” of personal information — we do not sell or share your personal information; (d) non-discrimination for exercising your CCPA rights. To exercise these rights, contact support@naxora.ai. We will verify your identity before processing requests.

11. International Data Transfers

Our servers are located in the United States. If you are accessing the Service from outside the United States, your account, billing data, and container data may be transferred to and processed in the United States. We ensure appropriate safeguards are in place for international data transfers, including Standard Contractual Clauses (SCCs) where required by GDPR.

12. Do Not Track Signals

Some browsers send “Do Not Track” (DNT) signals. There is currently no industry standard for how to respond to DNT signals. We do not currently respond to DNT signals, but we minimize tracking as described in our Cookies section. We do not engage in cross-site tracking.

13. Children's Privacy

Naxora is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under the applicable age, we will promptly delete that information. If you believe a child has provided us with personal information, please contact us at support@naxora.ai.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and sending an email notification at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: