NEXORA

Last updated: 2026-09-25

Privacy Policy

This policy explains what data we collect when you use Nexora and connect your accounts (Facebook, Instagram, Google Drive), how we use it, who we share it with and how you can delete it.

1. Data controller

Nexora, based in Costa Rica, is responsible for the data collected through the platform. Privacy questions: soporte@nexoragents.com.

2. Data we collect

  • Your account: name, email, organization and role.
  • Facebook and Instagram: Page ID and Instagram account ID, access tokens (encrypted with AES-256-GCM) and, if you run ads, the ad accounts you manage.
  • Google Drive: IDs and metadata of the photos and videos in the folder you authorize. We don’t store the rest of your Drive.
  • Usage data: posts, approvals, metrics returned by Meta (reach, engagement) and audit logs.
  • Technical data: browser, device, IP address and error logs.
  • Billing: plan, subscription status and purchase email. Your card details are handled by Lemon Squeezy (see “Payments”).
  • If you message us on WhatsApp: your number and messages, so we can reply.

We don’t access private Messenger or Instagram messages or your contacts, and we don’t store personal data about your followers.

4. How we use your data

  • To prepare, schedule and publish the content you approve.
  • To read metrics that improve upcoming posts.
  • To generate captions and, if you turn them on, images with AI models.
  • To provide support, detect fraud and keep the service secure.

We don’t sell your data and we don’t use it to train general-purpose AI models.

5. Providers that receive data

We share only what’s needed to run the service, with these providers:

  • Meta (Facebook, Instagram and WhatsApp): publishing, metrics and the Meta Pixel on the public website.
  • Google (Drive and Gemini): reading your photos and generating content. Under its paid-use terms, it doesn’t use this data to train its models.
  • Supabase: database and authentication.
  • Vercel: hosting for the website and the app.
  • Lemon Squeezy: card payments, taxes and receipts.
  • Resend: account emails.
  • Post for Me: publishing to Instagram and Facebook.
  • Zernio: Meta ads management, only on plans with Impulso.
  • Higgsfield: video generation, when applicable.

6. Payments

Card payments are processed by Lemon Squeezy as Merchant of Record, under its own privacy policy. Nexora never sees or stores your card details; we receive your email, plan and subscription status. SINPE Móvil payments (Costa Rica) are recorded by Nexora using the receipt you send us.

7. How long we keep data

  • Access tokens: while your account is active or until you revoke access.
  • Posts and metrics: while your account is active.
  • Audit logs: for up to 24 months.
  • Billing: for as long as Costa Rican tax law requires.

When you delete your account, we delete or anonymize your data within 30 days, except what the law requires us to keep.

8. Cookies and measurement

In the app we only use necessary cookies: your session (Supabase), light or dark theme, and protection for the Facebook connection.

On the public website (all public pages, not the app) we use the Meta Pixel to measure our ads, for example how many people message us on WhatsApp from an ad. Meta may use cookies for this. The Meta Pixel does not load inside the app. You can block it in your browser settings or in your Meta ad preferences. If you live in the U.S., you can email us to opt out of the use of your data for targeted advertising, in addition to blocking the Pixel in your browser.

9. Your rights

  • Access your data or request a copy (portability).
  • Correct inaccurate data from your dashboard or by writing to us.
  • Delete your data: see how to delete your data.
  • Object to processing based on legitimate interest.
  • Withdraw consent by disconnecting your accounts in Configuración → Conexiones (Settings → Connections).

Write to soporte@nexoragents.com. We respond within 30 days.

10. Children

Nexora is a professional tool and is not directed at anyone under 18. If we find data from a minor, we delete it.

11. Security

We encrypt access tokens (AES-256-GCM), use HTTPS connections and isolate each customer’s data with database-level security rules. If a breach affects your rights, we’ll notify you as required by applicable law.

12. International transfers

Our providers may process your data outside your country, for example in the United States. Where the law requires it, they use recognized safeguards, such as Standard Contractual Clauses.

13. Changes to this policy

If we make a material change, we’ll notify you by email or in the platform at least 30 days in advance. The date at the top shows the latest update.

14. Contact

Email: soporte@nexoragents.com