Who we are
nexp is operated by NEXP (PVT) Ltd ("nexp", "we", "us"). This policy covers nexp.dev, the documentation, the console, the nexp mobile app and the nexp instances we host for you. For the data you store inside your instance, you are the controller and we process it on your behalf.
What we collect
- Account details. Your name, email address and password when you create a nexp.dev account. Passwords are stored only as a secure hash by nexp IAM; we never see them.
- Organisation and instance details. Organisation names, addresses (slugs), environment status, plan and licence details, and usage signals such as last activity — needed to provision, license and run your instances, including pausing inactive free instances.
- AI usage. For each AI agent request: who asked, which agent, when, and how many tokens it used — so your administrators can set and enforce usage limits.
- Technical logs. IP address, device and browser information and timestamps, kept for security, abuse prevention and troubleshooting.
- Support messages. What you send us when you contact support.
Your instance data
Everything you store in your instance — records, documents and attachments, conversations with your agents, reports — belongs to you. Each instance has its own private, isolated database and identity space. We access instance contents only to operate the service (for example backups or incident response) or when you ask us to. We do not sell your data, use it for advertising, or use it to train AI models.
AI agents
AI agents are optional. Your administrators decide whether they are switched on, which agents exist, which apps each may use and who may talk to them. They are designed so that your business data does not go to the AI:
- What the AI receives:the message a user types, the structure of the data the agent may use (table and field names, types and permitted values), made-up sample rows, and — for app-builder agents — your app's configuration with passwords, keys, tokens and other confidential values removed.
- What the AI never receives: your records, totals or figures, and the reports it prepares. The agent writes a report layout; your real figures are filled in on our servers, inside your instance, and shown only to you.
- Changes need a person. Changes an agent suggests are applied only after an authorised user approves them, after a snapshot of the app is taken, and can be undone.
The AI is provided by Anthropic, which processes these requests on our behalf under its commercial terms and does not use them to train its models. Users should still avoid typing confidential personal information into agent conversations.
How we use information
- To provide, operate, secure and improve the service.
- To send service messages about provisioning, your instances, security and billing.
- To enforce our terms, prevent abuse and meet legal obligations.
Cookies
We use only essential cookies: the sign-in session, shared across nexp.dev, docs.nexp.dev and console.nexp.dev so you sign in once, and the security cookies sign-in needs. We do not use advertising or analytics trackers.
Sub-processors
We host on infrastructure we operate and on established cloud providers. AI agent requests are processed by Anthropic as described above. Email is sent through the mail service configured for the platform or for your organisation. Where data crosses borders we rely on appropriate safeguards. A current list of sub-processors is available on request.
Retention & deletion
We keep account and organisation details while your account is active. Free instances that stay inactive are paused, then archived with a backup and removed on the published schedule. Agent conversations, AI usage records and snapshots live in your instance and are deleted with it. You can ask us to delete your account and its data at any time.
Security
We protect information with isolation per instance, encryption in transit, encrypted secrets at rest, strict access control and audit logging. See our Security page for details.
Your rights
Depending on where you live, you may have the right to access, correct, export or erase your personal data, and to object to or restrict processing. For data inside an organisation's instance, please contact that organisation first; we will help them respond. Write to us and we will reply within 30 days.
Children
nexp is a business service and is not directed to children under 16.
Changes
We post changes to this policy here and update the date above. For material changes we notify account owners by email before they take effect.