Legal
Privacy notice
Nexorai is a fully remote engineering studio for AI, custom software, SaaS and cloud. One of the things we build is websites for small businesses. To find businesses we can help, we look at publicly listed companies, review their current website and, when we believe a better site would help them, we send one short email to say so. This notice explains what information that involves, why we use it, the legal basis we rely on, and the choices you have.
Who we are
Nexorai, established in Tunisia.
Contact: hello@nexorai.dev
We are established outside the European Union and the United Kingdom. Because we offer our services to businesses there, the EU General Data Protection Regulation (GDPR) and the UK GDPR still apply to the way we handle personal data of people in those regions. We also follow Tunisia's Organic Law No. 2004-63 on the protection of personal data.
What information we hold and where it comes from
We do not collect this information from you directly. We gather it from places where businesses publish it so that customers can reach them:
- Public business directories and maps: Google Maps, Yelp, Yellow Pages, Pages Jaunes, Trustpilot, OpenStreetMap.
- The business's own website, including its contact and "about" pages.
- Public company pages on social networks such as LinkedIn and Facebook.
From those sources we may hold: the business name, address and phone number; its website and the public technical and design characteristics of that website; a generic contact address such as info@ or contact@; and, where a business publishes them, the name, role and work email address of a person to contact. We do not collect home addresses, personal (non-work) email addresses, or any sensitive categories of data.
Why we use it, and the legal basis
- Assessing whether we can help. We review a business's public website to judge whether a redesign would benefit it and to prepare a concrete suggestion. Legal basis: our legitimate interest in finding clients for our services (GDPR Article 6(1)(f)).
- Contacting you once. We send one email introducing ourselves and our suggestion. If we hear nothing, we may send a small number of brief follow-ups over the following weeks, then stop. Legal basis: legitimate interest, limited to messages relevant to your professional role. We have documented the assessment behind this and will share it on request.
- Keeping a record of who does not want to hear from us. When you object or unsubscribe, we keep your address on a suppression list so that we never email it again. Legal basis: our legal obligation to honour your objection.
- Replying to you. If you contact us through the website form or by email, we use your details to answer. Legal basis: taking steps at your request before entering into a contract.
Email tracking
Our emails may include a small image and tracked links that tell us whether an email was opened or a link was clicked. We use this only to understand whether our outreach is relevant. If you would rather we did not, disable image loading in your email client or reply and tell us; we will stop contacting you.
Who we share it with
We do not sell or rent this information. It is processed by providers that host our systems and deliver our email, under contracts that restrict them to acting on our instructions: our website and email-link services (Vercel), our contact-form and engagement database (Supabase, hosted in the EU), and our email provider (OVH). Our own working systems are operated from Tunisia.
How long we keep it
- Businesses we have looked at but never contacted: deleted within 12 months.
- Businesses we have contacted: anonymised 24 months after our last message, unless we are in a conversation.
- Suppression list (addresses that asked not to be contacted): kept for as long as needed to honour that request, in a form that identifies the address only.
- Website contact-form messages: deleted after 24 months.
Your rights
Under the GDPR and UK GDPR you can:
- Object to direct marketing at any time. This right is absolute. Use the unsubscribe link in any email, reply "no thanks", or write to us — we will stop immediately and add your address to the suppression list.
- Ask what information we hold about you, and receive a copy.
- Ask us to correct, delete or restrict it.
- Complain to a supervisory authority: in France the CNIL, in the UK the ICO, in Tunisia the Instance Nationale de Protection des Données Personnelles (INPDP), or the authority in your own country.
To exercise any of these, email hello@nexorai.dev. We answer within one month.
This website
nexorai.dev does not use cookies and runs no analytics. Your dark-mode and language preferences are stored only in your own browser. The contact form sends the name, company, email address and message you type to us so that we can reply; we keep those messages for 24 months.
Changes
We will update this page when our practices change and revise the date at the top. See also our Terms of use.