Privacy Policy

NexFin is a finance operations platform provided by Nexoryx One.

This Privacy Policy describes how Nexoryx One handles personal information associated with the NexFin website, account access and use of the NexFin platform.

For privacy-related enquiries, contact support@nexoryxone.com.

Your name, business email, company, job title, company website and any optional details or message you provide, plus the time you accepted our Terms and this Privacy Policy and the version you accepted.

Your account details (email, name), your sign-in method (Google, Microsoft, or a password stored only as a salted Argon2id hash — never in plain text), your role within a workspace, and sign-in attempts (time, provider, result, IP address and browser type).

An audit trail of important actions taken in NexFin — approvals, overrides, exceptions and similar workspace decisions — recording who took the action and when, so finance activity remains attributable.

Business records your organisation uploads or enters into its workspace — suppliers, purchase orders, goods receipts, invoices, payment-workflow records, cases and the documents attached to them — belong to your organisation and are kept within that workspace.

If your organisation connects a finance inbox (Google Workspace, Microsoft 365 or another email provider), document storage (such as Google Drive or Microsoft OneDrive/SharePoint, or NexFin-managed storage) or an accounting platform, NexFin processes the information those connections provide in order to operate the features you've enabled. Integration credentials are encrypted and are never shown again once saved.

NexFin does not connect to bank accounts, does not read live bank balances, does not move money and does not store online-banking credentials. Payment records in NexFin are operational workflow records; payment itself is executed by your own accounting or ERP system.

NexFin does not use your data to train AI models.

We use this information to operate NexFin, keep it secure, communicate with you (verification, approval, invitation, security and password-reset emails), and support your pilot. We only use personal information for the purposes described in this policy.

NexFin runs on managed infrastructure providers: PostgreSQL database hosting (Supabase), application hosting (Vercel), transactional email delivery, and — only where you choose to connect them — Microsoft (OneDrive/SharePoint), Google (Drive), Amazon S3, Cloudflare R2, or NexFin-managed private object storage for your documents.

As NexFin's integrations expand, this list of service providers may be updated; we'll update this policy to reflect that.

Access is controlled by administrator approval and role-based permissions. Each organisation's workspace data is isolated from every other organisation's. Integration credentials are encrypted at rest. Sessions can be revoked by an administrator at any time. This describes how NexFin is designed to operate; it is not a warranty.

We keep personal information for as long as your organisation's workspace is active, and for a reasonable period afterwards where needed to meet legal, accounting or security obligations. Business and finance records remain available to your organisation for as long as its workspace exists.

Depending on where you're located, you may have rights to access, correct, delete, restrict or receive a copy of the personal information we hold about you, and to object to certain uses of it.

To exercise any of these rights, contact us at support@nexoryxone.com and we will respond as required by applicable law.

Nexoryx One processes personal information associated with NexFin with regard to applicable data-protection requirements, including the UK General Data Protection Regulation (UK GDPR) and, where applicable, the EU General Data Protection Regulation (EU GDPR).

NexFin provides access-control, security and audit capabilities intended to support organisations in managing their data-protection responsibilities.

Organisations using NexFin remain responsible for determining their own obligations as data controllers or processors and for configuring and using the service appropriately for their circumstances.

NexFin uses strictly necessary cookies only: a secure session cookie when you sign in, and a short-lived cookie that lets you check the status of an access request you've submitted. We do not set advertising or analytics cookies.

When this policy changes, its version changes, and — where required — you'll be asked to accept the new version. The version you accept is recorded along with the time of acceptance.

For any question about this policy or how we handle your information, contact support@nexoryxone.com.