Nexora Privacy Policy

Translation for convenience. The Spanish version (privacy-policy.es.md) is the official and binding text. This English translation is provided for convenience only. In case of any discrepancy, the Spanish version prevails.

---

1. Introduction

This Privacy Policy explains what personal data Nexora collects, what it uses it for, who it shares it with, how long it keeps it, and what rights you have over it.

It is written in accordance with Law No. 8968, the Law on the Protection of Individuals with regard to the Processing of their Personal Data, and its implementing regulation (Executive Decree No. 37554-JP) of the Republic of Costa Rica.

It describes the data processing the app actually performs today. If we add new processing in the future, we will update this Policy and notify you before it takes effect, as described in section 13.

---

2. Data controller

The controller determines the purposes and means of processing and is accountable to you and to Costa Rica's Data Protection Agency (PRODHAB).

---

3. Consent

When you register on Nexora you check the "I accept the Terms and Conditions" box, which includes acceptance of this Privacy Policy. That act constitutes your informed, express consent to the processing described here, under Article 5 of Law No. 8968.

Some processing requires separate, specific consent, which you grant — and may withdraw — independently:

• Precise device location: your operating system asks for permission the first time. You can revoke it at any time in your phone's settings.
• Camera and photo library: your operating system asks for permission when you upload images.
• Push notifications: your operating system asks for permission; you can disable them entirely or by type within the app.
• Verification documents (Professionals): uploading them is voluntary and only necessary if you want access to verification and the Trust Seal.

You may withdraw your consent at any time as described in section 9.5. Withdrawal does not affect the lawfulness of prior processing.

---

4. What data we collect

4.1 Data you provide

When creating an account (required):

Optional:

Addresses: label, street address, city, province, postal code, country, and associated geographic coordinates. Used to locate your projects and for Maintenance History.

If you are a Professional, additionally: business name, profile description, years of experience, services offered with hourly or fixed rates, service radius, base location, availability, and your portfolio images, titles, and descriptions.

Content you post: project titles and descriptions, estimated budgets, project images, bids with amount and message, reviews with rating and text, responses to reviews, Concierge requests, Maintenance History records (including costs and attachments), moderation reports, and support messages.

4.2 Verification documents (Professionals) — sensitive data

If you choose to get verified, you upload:

• Phase 1: identity document and criminal background certificate.
• Phase 2: résumé, certifications, references, or other supporting documents.

These are restricted-access, sensitive data under Article 3 of Law No. 8968 and receive heightened handling:

• Stored encrypted and never in publicly accessible repositories.
• Accessed only through short-lived signed links, generated one at a time.
• Only the administrative staff performing the review can view them.
• The contents of these documents are never written to system logs.
• After review, the file is deleted and we retain only the outcome (approved or rejected), its date, and the reviewer's notes. See section 8.

Important clarification: we currently do not query state registries (the Supreme Electoral Tribunal, the Judiciary, or any other). Review is visual and manual, performed by our team. We do not transmit your documents to any public entity or third-party verifier.

4.3 Location data

With your permission, we obtain your precise device location to find nearby professionals, calculate distances, and pre-fill the location of a project or request.

• It is used at the moment of the query; we do not perform continuous or background tracking.
• Coordinates associated with addresses, projects, Concierge requests, and professional profiles are stored, because they are part of the feature.
• If you deny permission, you can still use the app by entering the location manually.

4.4 Data generated by your use of the app

We do not collect the content of your conversations. Nexora has no in-app messaging: contact happens on WhatsApp (see section 6.3).

4.5 Technical and device data

• IP address: processed transiently in cache memory to enforce request limits and prevent abuse. It is not stored in the database or permanently associated with your account.
• Push notification token and device platform (iOS or Android).
• App platform and version, captured only when you open a support ticket, so we can reproduce the issue.
• Device advertising identifier, managed by the operating system and used by Google AdMob (see section 7).

4.6 Data stored on your device

The app stores locally on your phone:

• Your session tokens, in the operating system's secure storage (Keychain on iOS, Keystore on Android).
• A pending request queue, so actions taken offline complete when connectivity returns.
• Your language preference.

This data is removed when you log out or uninstall the app.

4.7 Payment data

Nexora never receives, processes, or stores your card details. Subscriptions are charged through the App Store or Google Play.

From subscription management we retain only: the plan purchased, the store, the product identifier, transaction identifiers, the identifier assigned by our subscription provider, the subscription status, and the period dates.

---

5. What we use your data for

What we do NOT do with your data:

• We do not sell it. Ever.
• We do not transfer it to third parties for those third parties' own commercial purposes, beyond what section 6 describes.
• We do not make automated decisions with legal effects on you. The Concierge algorithm ranks suggestions, but it does not decide, does not exclude anyone from the Platform, and produces no legal consequences.
• We do not use your content to train artificial intelligence models.
• We do not read your conversations, because they never pass through our systems.

---

6. Who we share your data with

6.1 With other Platform users

The following is visible to others as an inherent part of how the service works:

Consider carefully what you post. A project's exact address is not shown publicly — only the province and approximate location — but the description and photos you write and upload are visible to Professionals.

6.2 With our providers (data processors)

We engage providers who process data on our behalf and under our instructions, without being able to use it for their own purposes:

6.3 Specific note about WhatsApp

When you tap the contact button, the app opens WhatsApp on your device with the conversation started. From that moment, communication leaves Nexora's scope entirely and is subject to Meta Platforms' terms and privacy policy.

We have no access to those conversations, we do not store them, and we cannot recover them. We log only that the contact event occurred, for your plan's limits.

6.4 With authorities

We may disclose personal data where there is a court order, a request from a competent authority, or a legal obligation, or where necessary to protect a person's life or physical safety. Where the law permits, we will endeavor to notify you first.

6.5 In a business transfer

If the business is transferred — by sale, merger, or reorganization — data could be transferred to the acquirer, who will be bound by this same Policy. We will notify you with reasonable advance notice and you may delete your account before the transfer takes effect.

---

7. Advertising

Free plans (FREE for Users, BASIC for Professionals) display ads from the Google AdMob network.

• AdMob may use your device advertising identifier and technical data to select ads and measure their performance.
• Nexora does not share your name, phone, email, addresses, documents, or posted content with AdMob.
• CLUB and PRO subscriptions remove third-party ads from the app entirely.

How to limit personalized advertising. You can do this directly from your device:

• iOS: Settings → Privacy & Security → Tracking (turn off "Allow Apps to Request to Track"), and Settings → Privacy & Security → Apple Advertising.
• Android: Settings → Google → Ads → "Opt out of Ads Personalization" or delete the advertising ID.

In-house Professional listings are targeted only by service category and province, without using individual behavioral profiles.

---

8. How long we keep your data

8.1 Exceptions

We may keep data beyond these periods where necessary to comply with a legal obligation, respond to an authority's request, or establish or defend a legal claim, and only for as long as strictly necessary for that purpose.

8.2 What happens when you delete your account

When you delete your account from the app (Settings → Delete account):

1. Immediately: your account is deactivated, your profile stops appearing in searches and results, and you lose access.
2. Within 90 days: your personal data is deleted or irreversibly anonymized, except what we must retain under section 8.1.
3. Remains in anonymized form: the text of reviews you wrote about third parties, detached from your identity, so as not to distort other people's reputations.

If you want deletion carried out sooner, request it through the channel in section 9.6 and we will handle it within the timeframes in section 9.7.

Deleting your account does not cancel your subscription. You must cancel it in the App Store or Google Play, or it will continue to be charged.

---

9. Your rights

Law No. 8968 grants you the following rights over your personal data:

9.1 Right of access

You may request confirmation of whether we process data about you and obtain a copy of it, along with information about its origin, purpose, and recipients. Much of this is immediately available inside the app: profile, addresses, projects, bids, reviews, favorites, maintenance history, subscription, and support tickets.

9.2 Right of rectification

You may correct inaccurate or incomplete data. Most of it is editable directly in the app. For anything that is not, write to us.

9.3 Right of erasure

You may request deletion of your data where it is inaccurate, incomplete, no longer necessary, or was collected improperly. Section 8.2 describes the general procedure.

9.4 Right to object

You may object to specific processing — for example, receiving push notifications or having advertising personalized — without that affecting your access to the service.

9.5 Withdrawal of consent

You may withdraw consent at any time, for example by removing location, camera, or notification permissions in your device settings, or by deleting your account. Withdrawal is not retroactive.

9.6 How to exercise your rights

Primary channel: the in-app ticket system (Settings → Support), category "Other," clearly stating which right you wish to exercise.

Alternate channel, if you cannot access your account: soporte@nexoraclub.app, writing from the email associated with your account or providing enough information to establish your identity.

To protect your data, we will verify your identity before acting on a request. We will not act on third-party requests without proof of representation.

9.7 Response times

Under Article 7 of Law No. 8968, we will respond to access requests within a maximum of five business days. Rectification or deletion requests will be handled within the same period, unless their complexity requires an extension, which we will explain to you with justification.

Exercising these rights is free of charge.

9.8 Right to complain to PRODHAB

If you believe your request was not properly handled or that your data is being processed improperly, you may file a complaint with the Data Protection Agency (PRODHAB), part of Costa Rica's Ministry of Justice and Peace.

---

10. Information security

We apply reasonable technical and organizational measures, including:

• Encryption in transit (HTTPS/TLS) for all communication with our servers.
• Passwords stored as hashes with bcrypt; never in readable form.
• Token-based authentication with limited lifetimes, refresh, and revocation.
• Role-based access control: each user accesses only their own data; administrative staff access only what is necessary for moderation and verification.
• No publicly accessible files: every file is served through short-lived signed links. There are no public buckets.
• Isolation of verification documents: they are accessible only within the Professional's own namespace, and their contents are never written to logs.
• Rate limits and lockout on failed attempts, to contain automated attacks.
• Secure on-device storage of session tokens, using Keychain (iOS) and Keystore (Android).

No security measure is infallible. If a security breach affecting your personal data occurs, we will notify you and report it to PRODHAB as required by applicable regulations.

---

11. International data transfers

Your data is stored and processed on servers located in the United States of America (Google Cloud Platform, Northern Virginia region), as well as on the international infrastructure of the other providers listed in section 6.2.

Under Article 14 of Law No. 8968, transferring personal data to third countries requires your informed consent. By accepting this Policy, you expressly consent to that international transfer.

We require our providers to give contractual commitments on confidentiality and security equivalent to the standards in this Policy. If you do not want your data transferred outside Costa Rica, you should not use Nexora, as the Platform cannot operate without this infrastructure.

---

12. Minors

Nexora is intended solely for people aged 18 and over. We do not knowingly collect data from minors.

If we determine that an account belongs to someone under 18, we will deactivate it and delete their data. If you are a parent or legal guardian and believe a minor in your care provided us with personal data, contact us through the channel in section 9.6 and we will delete it.

---

13. Changes to this Policy

We may update this Policy to reflect changes in the app, in our providers, or in the law.

• We will publish the updated version with a new effective date.
• For material changes — new purposes, new data categories, or new recipients — we will notify you through the app at least 15 calendar days in advance, and where the law requires it, we will ask for your consent again.
• We will keep the version history of this document in the project repository.

---

14. Contact

Controller: Jeison Melendez Arrieta, individual Domicile: Cartago, Cartago, Costa Rica Primary channel: in-app ticket system (Settings → Support) Alternate email: soporte@nexoraclub.app

Supervisory authority: Data Protection Agency (PRODHAB), Ministry of Justice and Peace, San José, Costa Rica.