1. Information We Collect

We may collect the following categories of personal and business-related information:

• Contact Information: Name, email address, phone number, business name, and job title, provided when you register, communicate with us, or use the Services.

• Payment and Billing Information: Billing contact details, billing address, subscription plan and status, and transaction and invoice history. Limited payment-method details (such as card brand, expiry date, and the last four digits, or a payment token) may be retained to manage your subscription. Full payment card numbers are collected and processed directly by our third-party payment processor (see Section 3); NexScale does not store complete card numbers.

• Client Interaction Data: Names, contact details, preferences, and notes about your clients or members that you manually input or sync from connected third-party systems (such as CRMs), whether you connect that system yourself or authorize its provider or another integration partner to grant us access on your instruction. You are responsible for ensuring you have the lawful authority or consent required to share this data with NexScale.

• Integration Credentials: Credentials, API keys, access tokens, and similar identifiers used to connect a third-party system to the Services. We hold these only for as long as the connection is in place, use them only to deliver the features you have enabled, and delete them when the connection ends. Where a credential is issued by a platform provider or integration partner and is not specific to you, we cease using it in respect of you and your Client Data, delete any identifiers specific to you, and request revocation where the provider requires it. This is set out in Section 4.3 of the Terms & Conditions.

• Integrated Communication Data: Metadata and content summaries (such as timestamps, sender/recipient identifiers, and message context) from communication channels you choose to connect to the platform, including WhatsApp, Telegram, SMS, and email. Full message content is processed only where enabled or configured by you.

• Document Uploads: Business-related documents you upload to the platform, including contracts, service reports, proposals, and client or member records. These documents may contain personal data that you are responsible for collecting and sharing lawfully.

• Usage Data: Technical and usage information automatically collected when you interact with the Services, such as IP address, browser type, operating system, device information, session duration, and feature usage patterns.

• Cookies and Tracking Technologies: Information collected through cookies and similar technologies to enable core functionality, enhance user experience, remember preferences, and perform analytics.

We do not intentionally collect sensitive personal data (such as health or biometric data). If you upload such data, you represent that you have obtained all required consents and legal authority to do so. Health, medical, injury, fitness-assessment, biometric, and government-identifier data, and free-text notes fields, are excluded from the scope of every Live Demonstration, and we give no agreement to receive them in that context. Where any such category is to be processed as part of a subscription, it must be agreed with us in writing in advance, as set out in Section 9.3 of the Terms & Conditions.

2. How We Use Your Information

We use personal information to:

• Provide, operate, maintain, and improve the Services, including AI-powered features;

• Enable integrations with connected systems and communication channels;

• Prepare and present a Live Demonstration to you, where one has been arranged — and for no other purpose. We do not use Client Data accessed for a Live Demonstration for marketing, benchmarking, product development, case studies, or any purpose other than preparing and presenting that demonstration to you;

• Store and manage business records and Client Data as directed by you;

• Process payments and manage your subscription — including the Introductory Period, monthly billing, renewals, and cancellations — and send related billing, renewal, and transactional notices (such as confirmation of your first payment and notice when any promotional discount applied during the Introductory Period is about to expire);

• Provide customer support and respond to inquiries;

• Monitor performance, security, and platform usage;

• Prevent misuse, fraud, or unauthorized access;

• Comply with legal and regulatory obligations.

Where you have opted in or where otherwise permitted by law, we may also send you product updates, newsletters, and marketing communications. You can opt out of marketing messages at any time using the unsubscribe link or by contacting us; this does not affect billing, security, or other service-related communications.

2.1 Legal Bases for Processing

Where required by law, we process personal data based on one or more of the following legal bases:

• Performance of a contract;

• Consent (where obtained);

• Legal obligations;

• Legitimate business interests, balanced against individual rights and freedoms.

3. Sharing Your Information

We do not sell or rent personal information.

We may share personal data with:

• Service providers and subprocessors that help us operate the Services (for example, cloud hosting, analytics, AI model providers, and communication APIs), under strict confidentiality and data-protection obligations. Our AI model providers are configured so that data sent to them is not retained beyond what is needed to return a result and is not used to train their models.

• Payment processor: payments and card transactions are processed by Stripe, Inc., our third-party payment processor. Stripe handles payment card data under its own privacy policy and security standards (including PCI-DSS); NexScale receives transaction confirmations and limited billing details but does not store complete card numbers.

• Legal or regulatory authorities where required to comply with law or enforce our agreements.

• Successor entities in connection with a merger, acquisition, or corporate restructuring.

We do not disclose Client Data accessed for a Live Demonstration, or any output derived from it, to anyone other than your own personnel and those NexScale personnel and subprocessors with a need to know. We do not record, screenshot, reuse, or publish it without your prior written approval.

NexScale does not use identifiable Client Data to train shared or general-purpose AI models. Any data used for service improvement is de-identified, anonymized, or aggregated so that it cannot reasonably identify you or your clients.

A current list of NexScale's subprocessors is available on request to legal@nexscale.ai, and is provided on request before any Live Demonstration begins.

4. Data Retention

We retain personal data only for as long as necessary to provide the Services and fulfill legal or contractual obligations.

• While your Account is active, we retain your account, billing, and Client Data to provide the Services.

• For up to ninety (90) days after termination or expiration of your subscription (the "Wind-Down Period"), you may request export of your Client Data in a commonly used machine-readable format.

• After the Wind-Down Period, we delete or anonymize personal data from our active production systems, unless earlier deletion is requested or longer retention is required by law. Residual copies may persist in routine, secured backups for a limited additional period (generally up to ninety (90) days) before being overwritten in the ordinary course.

• Aggregated or anonymized data that cannot identify you or your clients may be retained for analytics and service-improvement purposes.

4.1 Client Data accessed for a Live Demonstration

Different and shorter periods apply to Client Data we access for a Live Demonstration, as set out in Section 14.3 of the Terms & Conditions:

At the end of the Demonstration Period — thirty (30) days from the date the connection is established, unless we state otherwise in writing beforehand — we suspend the connection and stop accessing your data through it.

• If you do not enter into a subscription and make the carry-over election within the Conversion Window (the following thirty (30) days), we disable the connection, deal with the credential as described above, and delete all Client Data accessed for the Live Demonstration — including every score, summary, report, export, and AI Output derived from it — from active production systems within ten (10) business days. Residual backup copies are overwritten within a further thirty (30) days and are not accessed or restored in the meantime. We will confirm deletion in writing on request.

• If you do enter into a subscription and elect to carry the connection over, the connection and Client Data continue under your subscription and the ordinary retention rules above apply from that date. You are not asked to reconnect the system or re-issue the credential.

• You may ask us to delete Client Data accessed for a Live Demonstration at any earlier time, for any reason, and we will do so within ten (10) business days.

5. Your Responsibilities and Rights

5.1 Your Responsibilities

You are responsible for ensuring that any Client Data you submit to the Services is collected and shared in compliance with applicable privacy laws and that you have obtained any required consents or legal authority. This applies equally where you instruct a platform provider or integration partner to grant us access to your data rather than connecting the system yourself, and to any data made available to us for a Live Demonstration. We recommend confirming that your own member- or client-facing privacy notice permits disclosure of personal information to service providers acting on your behalf.

5.2 Your Rights

Depending on your jurisdiction, you may have the right to:

• Access personal data we hold about you;

• Request correction or deletion;

• Request a copy of your personal data in a portable format;

• Withdraw consent (where applicable);

• Object to or restrict certain processing activities.

To exercise your rights, contact legal@nexscale.ai. We may need to verify your identity and will respond to verified requests within 30 days, where required by law. Where the request relates to Client Data for which one of our customers is the controller, we will refer the request to that customer and assist them in responding.

6. Cross-Border Data Transfers

Your personal data may be stored or processed in jurisdictions outside your own, including Canada and the United States. Our cloud hosting and payment processing providers may process data in the United States. Where required by law, we use appropriate safeguards (such as contractual protections) to ensure personal data remains protected in accordance with applicable privacy laws.

7. Security

We implement administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or misuse. These measures include encryption, access controls, secure development practices, and ongoing monitoring. However, no system is completely secure, and we cannot guarantee absolute security.

Credentials used to connect third-party systems are stored encrypted, are accessible only to the personnel and systems that need them to operate the connection, and are deleted when the connection ends. Connections established for a Live Demonstration are read-only, and no messages are sent through them to your members, clients, or other contacts.

If we become aware of a confirmed security breach affecting personal data, we will notify affected customers — and, where applicable, regulators or affected individuals — without undue delay and in accordance with applicable law. You can report a security concern to security@nexscale.ai.

8. Third-Party Services

The Services may integrate with or link to third-party platforms and tools. Their privacy practices are governed by their own policies, not this Privacy Policy. We encourage you to review those policies before enabling integrations.

Where a platform provider or integration partner grants us access to your data on your instruction, that provider or partner acts as your own vendor and not as a subprocessor of NexScale. Its handling of your data is governed by your agreement with it. You are responsible for confirming that your agreement with that provider permits it to grant us access.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to support platform functionality and analytics. These may include:

• Strictly necessary cookies (for security and login);

• Performance and analytics cookies;

• Functional cookies (to remember preferences).

You can manage cookies through your browser settings or any cookie consent mechanism we provide.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the website or the Services. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

11. Language

The parties confirm that they have expressly requested that this Privacy Policy and all related documents and communications be drafted in the English language only.

Les parties confirment avoir expressément exigé que la présente politique de confidentialité ainsi que tous les documents et communications s'y rattachant soient rédigés en anglais seulement.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, please contact:

NexScale Inc. 99 Kirk Drive, Thornhill, Ontario, Canada

Privacy / Legal: legal@nexscale.ai

Security: security@nexscale.ai

Web: https://www.nexscale.ai

Trademark Notice. NexScale™ and NexScale Chloe™ are trademarks of NexScale Inc., whether registered or unregistered. Other product, service, and company names referenced in this Privacy Policy may be trademarks of their respective owners. All rights reserved.