Privacy Policy

1. Who we are and scope

This Privacy Policy explains how NexaNucleus ("NexaNucleus", "we", "us" or "our") collects, uses, shares and protects information when you use the Nexa360 mobile application for Android and iOS, the Nexa360 administration portal, the website at nexanucleus.com, and related services (together, the "Services").

Nexa360 is a business-management platform for cafés and food businesses. It is provided to businesses (our "Customers"), who invite their owners, managers and staff ("Users") to use it. When a Customer uses Nexa360 to manage its own business records — such as staff details, attendance, sales and stock — the Customer decides what is recorded and NexaNucleus processes that information on the Customer's behalf.

By using the Services you agree to the practices described in this policy. If you do not agree, please do not use the Services.

2. Information we collect

Account and profile information

• Name, email address, phone number and login credentials (passwords are stored only in hashed form).
• Business details such as business name, outlet or branch, and your role and permissions within the business.

Business and operational data you enter

• POS & billing: orders, bills, invoices, item and price details, discounts, taxes and payment method or status. Nexa360 does not store full card numbers; where card or UPI payments are taken, they are handled by the relevant payment provider.
• Sales & analytics: sales totals, trends and reports generated from your transactions.
• Stock & wastage: raw materials, packaging, inventory levels, purchases and wastage records.
• KOT & operations: kitchen order tickets and day-to-day operational records.
• Customer details (optional): if a business chooses to record its own customers' names or contact numbers on bills, that information is stored on the business's behalf.

Staff and attendance information

• Staff names, roles, check-in and check-out times, shifts and working hours.
• Where a business enables it and you grant permission, a photo or approximate/precise location captured at the time of check-in to verify attendance. This is collected only at the moment of marking attendance, not in the background.

Device and technical information

• Device model, operating system version, app version, language and time zone.
• A push-notification token so we can deliver announcements and alerts.
• Log data, crash reports and diagnostic information (such as error details and timestamps) used to keep the Services reliable and secure.
• IP address and basic usage information (for example, which screens or features are used) for security, auditing and improving the product.

Information you send us

• Messages, feedback and support requests you send by email or through the Services.

3. App permissions

Nexa360 asks for device permissions only when a feature needs them, and you can refuse or withdraw them at any time in your device settings. Refusing a permission only disables the related feature.

• Internet / network access: to sync your data securely with our cloud services.
• Notifications: to show announcements, order and operational alerts.
• Camera (if used): to capture attendance photos or scan codes.
• Location (if used): to verify that attendance is marked at the business premises.
• Bluetooth / nearby devices (if used): to connect to receipt or KOT printers.
• Photos / storage (if used): to upload images such as item pictures or to save and share reports and bills.

4. How we use information

• To provide, operate and maintain the Services, including billing, inventory, attendance, KOT, reporting and notifications.
• To create and manage accounts, authenticate Users and enforce role-based access.
• To keep each business's data separated from other businesses and to protect the Services against fraud, abuse and unauthorised access.
• To send service-related messages such as announcements, security alerts and support responses.
• To diagnose problems, fix bugs, and improve performance and features.
• To comply with legal obligations and respond to lawful requests.

5. How we share information

We do not sell personal information, and we do not use it for third-party advertising. We share information only in the following cases:

• Within your business: information is visible to other Users of the same business according to the roles and permissions set by that business (for example, a manager can see staff attendance).
• Service providers: trusted providers that host our infrastructure, store data, send notifications or help with crash reporting and analytics. They act on our instructions and may use the data only to provide their services to us.
• Legal reasons: where required by law, regulation, court order or a government authority, or to protect the rights, property or safety of NexaNucleus, our Users or the public.
• Business transfers: if NexaNucleus is involved in a merger, acquisition or sale of assets, information may be transferred subject to this policy.

6. Data security

We use administrative, technical and organisational safeguards designed to protect information, including:

• Encryption of data in transit using HTTPS/TLS.
• Tenant-aware data isolation so one business cannot access another business's data.
• Identity and role-based access control, with access limited to people who need it.
• Audit and operational logging, secure development practices and separation of environments and secrets.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your login credentials confidential and tell us promptly at support@nexanucleus.com if you suspect unauthorised access.

7. Data retention

We keep information for as long as the account or business subscription is active and as needed to provide the Services. When an account or business is deleted, we delete or anonymise the associated personal information within a reasonable period, normally within 30 days, except where we must retain certain records (for example, billing, tax or transaction records) to meet legal, accounting or audit obligations, or to resolve disputes and enforce our agreements. Backups are overwritten on a regular cycle.

8. Account and data deletion

You can request deletion of your Nexa360 account and associated data at any time:

1. Email support@nexanucleus.com from the email address linked to your account, with the subject "Nexa360 account deletion request".
2. Include your name, registered email or phone number, and your business name.
3. We will verify the request and confirm once deletion is complete, normally within 30 days.

If you are a staff member, your business owner or administrator can also remove your access. If you are the owner of a business account, deleting the business deletes its business records for all Users of that business, subject to the legal retention described above. You may also ask us to delete specific data without deleting your whole account.

9. Your rights and choices

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023, you may have the right to:

• Access the personal information we hold about you and receive a summary of how it is processed.
• Correct or update inaccurate or incomplete information.
• Request erasure of your personal information.
• Withdraw consent you previously gave (for example, by turning off camera, location or notification permissions).
• Nominate another person to exercise your rights in the event of death or incapacity, and raise a grievance with us.

To exercise these rights, contact support@nexanucleus.com. If your data was entered by a business you work for, we may refer your request to that business and help them respond.

10. Children's privacy

The Services are intended for businesses and their staff and are not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Where data is stored

Information is stored and processed on secure cloud infrastructure, which may be located in India or other countries where our service providers operate. Where information is transferred across borders, we take steps to ensure it remains protected as described in this policy and as required by applicable law.

12. Website and cookies

Our website at nexanucleus.com is informational. It may use essential cookies and standard server logs (such as IP address, browser type and pages visited) to operate securely and understand basic usage. We do not use the website to sell personal information or to run third-party advertising.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for significant changes, notify Users through the app or by email. Continued use of the Services after an update means you accept the revised policy.

14. Contact and grievance officer

If you have questions, requests or complaints about this Privacy Policy or how we handle your information, contact us:

• Company: NexaNucleus
• Privacy & grievance contact: support@nexanucleus.com
• General enquiries: contact@nexanucleus.com
• Website: https://nexanucleus.com

We aim to acknowledge requests within 72 hours and resolve them within 30 days.