Legal

Privacy Statement

Applies to the nexaflow.fi website and to Google account data connected to the NexaFlow platform · Last updated 20 August 2026

This statement explains how we handle personal data in connection with the nexaflow.fi website. In short: this website uses no cookies, no analytics and no tracking, and we collect no personal data from you unless you choose to contact us.

01 · Who we areData controller

The controller responsible for the personal data described here is an individual operating the NexaFlow service; no company has been incorporated for it yet:

02 · What we collectPersonal data we process

Through this website we process very little personal data:

• No cookies or tracking. This website sets no cookies and uses no analytics, advertising or tracking technologies. We do not build profiles of visitors.
• Server logs. Our hosting provider processes the technical data needed to serve and secure the site — for example your IP address, browser and device type, the pages requested and the date and time. This is standard web-server logging.
• Information you send us. If you contact us — for example by email — we receive the contact details and message content you choose to provide.

03 · Why & on what basisPurposes and legal bases

We process the above for the following purposes, under the following legal bases in the EU General Data Protection Regulation (GDPR):

• Operating and securing the website — our legitimate interest in providing a reliable, secure site (Art. 6(1)(f)).
• Responding to your enquiries and, where relevant, discussing our services with you — taking steps at your request prior to any agreement, and our legitimate interest in replying (Art. 6(1)(b) and (f)).
• Consent — if we ever introduce non-essential cookies or analytics, we will ask for your consent first (Art. 6(1)(a)).

04 · Who we share it withRecipients and processors

We do not sell your personal data. We share it only with service providers who process it on our behalf and under contract:

• Vercel — website hosting and content delivery (served from the European Union).
• Google (Google Workspace) — the email service we use to receive and reply to correspondence you send us.

05 · Google account dataData from a connected Google account

The NexaFlow platform can connect to a user's Google account so that an adviser's own mailbox can inform their work, and so that replies they have approved can be sent from it. This connection is optional and is made only by the account holder, through Google's own consent screen.

What we request, and nothing more

• gmail.readonly — read access to messages, so the platform can use the adviser's existing correspondence as context for the engagement it belongs to.
• gmail.send — the ability to send a message. Used only to deliver a message the adviser has explicitly approved.

We do not request broader Gmail permissions such as gmail.modify or full-account access. The platform never deletes, alters or labels messages in a connected mailbox.

Nothing is sent without a human decision

The platform may draft a message, but it cannot send one on its own. Every outbound email is proposed to the adviser and is sent only after that person approves it, and an approval applies to that single message.

How this data is handled

• Access tokens are encrypted at rest with envelope encryption (AES-256-GCM), and are never exposed to other customers or shown in the interface.
• Message content and metadata are stored in our EU-hosted database, isolated per customer organisation, and are used only to provide the features described above.
• AI processing. To draft or summarise, message content may be sent to our AI providers. They process it solely to return the requested output, under terms that prohibit using customer content to train their models.
• We do not sell this data, use it for advertising, or use it to build profiles for any purpose other than providing the platform to the customer whose account it belongs to.
• Human access is limited to what is needed for support or security, and only where permitted by the customer's agreement.

Disconnecting and deletion

A connection can be revoked at any time — in the platform's Integrations settings, or from Google's own third-party access page. On disconnection we delete the stored tokens. Message data already stored is deleted in line with the customer's retention settings and their agreement with us, or sooner on request.

06 · International transfersData outside the EEA

The website is hosted in the European Union. Some of our providers are established outside the European Economic Area (EEA); where personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

07 · How long we keep itRetention

Server logs are retained only as long as needed to operate and secure the site, then deleted or anonymised. Correspondence is kept for as long as needed to handle your request and any resulting relationship, after which it is deleted.

08 · Your rightsYour rights under the GDPR

You have the right to request access to your personal data, and its rectification or erasure; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. To exercise any of these, contact us at petteri@nexaflow.fi.

You also have the right to lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

09 · SecurityHow we protect your data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including transport encryption (HTTPS) across the site.

10 · ChildrenChildren's data

This website is intended for business audiences and is not directed at children.

11 · ChangesUpdates to this statement

We may update this statement from time to time. The "last updated" date above always shows the current version; material changes will be reflected here.

12 · ContactContact us

For any question about this statement or your personal data, contact petteri@nexaflow.fi.