Privacy policy

The controller is [[NEXULEX_LEGAL_ENTITY]] (tax ID [[NEXULEX_TAX_ID]]), registered at [[NEXULEX_REGISTERED_ADDRESS]] ("Nexulex"). Privacy contact: privacidad@nexulex.com; general contact: contacto@nexulex.com. This policy covers nexulex.com, its subdomains, the mobile and desktop apps, the API and related services. It is governed by Chilean Law 19,628 on the Protection of Private Life, as amended by Law 21,719 (in force from 1 December 2026), and, where the service is offered to people in the European Union, by Regulation (EU) 2016/679 (GDPR).

• Nexulex is the controller of account, authentication, billing, security, support and service communication data. • Nexulex is a processor for the case files, documents, clients, opposing parties and other content each organization uploads, imports or syncs. There, the customer organization is the controller and decides the purposes; Nexulex processes that data only on its instructions and under the terms of service, which include the data processing terms.

• Identity and account: name, email, phone, national ID when provided, photo, language, time zone, organization and role. • Authentication: hashed password, two-factor methods, passkeys, sessions, trusted devices and social sign-in identifiers (Google, Apple or others you enable). • Connected-source credentials: Oficina Judicial Virtual (OJV/PJUD) or Clave Única credentials an organization registers to sync cases. They are stored encrypted, used only for the authorized connection, and can be deleted at any time. • Work content: cases, files, documents, filings, deadlines, hearings, tasks, notes, time, expenses, settlements and comments. • Communications: chat messages, notifications, service emails and, in meetings or calls, display name, audio, video and metadata. Recordings happen only when someone starts one and participants are notified. • Billing: plan, usage, tax details for invoicing and payment status. Payments are processed through Mercado Pago or another payment provider; Nexulex does not store bank passwords or full card numbers. • Device and technical usage: IP address, browser, operating system, push notification tokens, access logs, errors and security events. • Integrations: calendar and other connected-service data, within the scope you authorize.

Users may add information about clients, opposing parties, witnesses, employees, debtors or other people, including sensitive data or data about legal proceedings. Nexulex also processes information from public court sources (such as the Chilean Judiciary) that the organization queries or syncs. The organization that uploads or connects that data is its controller: it must have a legal basis, inform people where required and limit access to those who need it. If you are named in a case file and want to exercise your rights, write to us; we will forward the request to the responsible organization and help it respond.

• Creating and managing accounts, organizations, roles and permissions; providing the contracted features (case files, sync, calendar, notifications, meetings, documents, API, AI): performance of a contract (Art. 6(1)(b) GDPR). • Invoicing, collecting payments and bookkeeping; responding to authorities: legal obligation (Art. 6(1)(c) GDPR). • Security, fraud and abuse prevention, audit logs, support and technical improvement: legitimate interest of Nexulex and its customers in a secure, working service (Art. 6(1)(f) GDPR), balanced against your rights. You may object. • Non-essential marketing communications, preference cookies and meeting recordings: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time without affecting prior processing. • Case-file content: basis determined by the controller organization; Nexulex processes it as a processor. Under Chilean law these map to the lawful bases of Law 19,628 as amended by Law 21,719 (consent, contract, legal obligation, legitimate interest and publicly accessible sources, among others). We do not use your data for behavioural advertising and we do not sell it.

When an organization enables AI features, the content needed to answer — a question, document excerpts or the selected case's details — is processed through Microsoft Azure OpenAI or another provider the organization configures with its own credentials. • Nexulex does not use customer content to train models, and the contracted Azure OpenAI service does not use it to train third-party models. • Outputs are assistive and require human review. Nexulex makes no decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). • If the organization connects its own provider, that provider's terms apply and the organization is responsible for that setup.

We share only the data needed with providers acting on our behalf under confidentiality and security contracts: • Cloudflare (delivery network, protection, tunnel and R2 object storage) — global/US. • Amazon Web Services – Simple Email Service (email delivery) — US. • Microsoft Azure OpenAI (AI features) — per contracted region. • Mercado Pago (payment processing and subscriptions) — Chile. • Apple and Google (push notifications and social sign-in, if used) — US. • Calendar providers you connect (Google, Microsoft) — US. Core infrastructure (servers, database, LiveKit video calls and self-hosted storage) is operated by Nexulex in Chile. We also share data with members and admins of your organization according to their permissions, with integrations your organization authorizes, and with authorities under a valid legal request. Nexulex does not sell personal data.

Some providers process data outside Chile, mainly in the United States. We make these transfers with appropriate safeguards: standard contractual clauses approved by the European Commission or the Chilean authority, provider security commitments and, where available, adequacy decisions or certification frameworks (such as the EU-U.S. Data Privacy Framework). You can request details of the applicable safeguards at privacidad@nexulex.com. For users in the European Economic Area: transfers to Chile, where the core infrastructure is located, rely on standard contractual clauses.

• Account and profile: while the account is active; deleted or anonymized within 90 days of closure, except as below. • Organization content: while the organization keeps the service; after it ends, available for export for 30 days, then deleted. • Connected-source credentials: until the organization deletes them or closes the account. • Billing and tax records: 6 years, as required by Chilean tax law. • Security and access logs: up to 12 months. • Meeting recordings: until the organization deletes them. • Backups: overwritten in cycles of up to 35 days. We keep data longer only where the law requires it or to establish, exercise or defend legal claims.

We apply technical and organizational measures proportionate to the risk: encryption in transit (TLS), encrypted credentials, per-organization and role permissions, two-factor and passkeys, audit logs, backups and monitoring. No internet-connected system is perfectly secure. If a security breach affects personal data, we will notify the Chilean Personal Data Protection Agency and, where applicable, the European supervisory authority and the affected organizations and people, within the deadlines and conditions of Law 21,719, Law 21,663 and the GDPR (within 72 hours under the latter). Report any incident to privacidad@nexulex.com.

You can exercise, free of charge, the rights of: • Access: know what data we process and get a copy. • Rectification: correct inaccurate or incomplete data. • Erasure: have data deleted when no longer needed or when you withdraw consent. • Objection: object to processing based on legitimate interest or for marketing. • Portability: receive your data in a structured, commonly used format, or have it sent to another controller. • Blocking or restriction: temporarily suspend processing while a request is resolved. • Not being subject to automated decisions with significant effects. • Withdrawing consent at any time. Write to privacidad@nexulex.com or use the privacy request form (/privacy-request). We may ask for reasonable information to verify your identity. We will reply within 30 calendar days (Law 21,719) or one month (GDPR), extendable where the law allows, with the reason.

If you believe we did not handle your request properly, you can complain to the Chilean Personal Data Protection Agency (Agencia de Protección de Datos Personales) or, if you are in the European Union, to the supervisory authority of your country of residence, without prejudice to any court action.

Where the GDPR requires it because services are offered to people in the European Union, Nexulex will appoint a representative under Article 27: [[NEXULEX_EU_REPRESENTATIVE]]. Until then, requests can be sent to privacidad@nexulex.com.

Nexulex is intended for professionals and organizations and is not designed for people under 18, who must not create accounts. Data about children and adolescents that an organization adds to a case file must be processed in their best interest, as the law requires. If you find an account belonging to a minor, contact us.

We will publish the current version here with its date. If a change is material, we will notify you by email or in the platform and, where required, ask for new acceptance or consent.

Privacy and rights: privacidad@nexulex.com. General contact: contacto@nexulex.com. Postal address: [[NEXULEX_REGISTERED_ADDRESS]].