Security and incident response

This page explains how Nexplora LLC ("Nexplora," "we," "us") protects your information and what we do if something goes wrong. It works together with our Privacy Policy. To report a security problem, email [email protected].

1. How we protect your data

• In transit — data is encrypted in transit (TLS).
• Connected-account credentials — encrypted at rest in a dedicated credential vault. They are never shown back to you and never sent to AI models. Disconnecting an account revokes its credentials and erases the secret.
• Production access — access to production systems is limited to the people who need it to run Nexplora.
• Your approval first — actions that send, publish, delete, move money or change access need your approval before they run. If you ask Nexplora to delete one specific item, that request is your approval.

No system is perfectly secure. If you believe your account is at risk, contact [email protected] right away.

2. How long we keep logs

Records of AI model requests and responses (each chat or code turn's run log) are deleted automatically after 90 days. Your chats themselves stay until you delete them. Memories, files, connected-account tokens and billing records are kept and deleted as described in section 8 of our Privacy Policy.

3. Incident response

A security incident is anything that exposes, changes or blocks access to your data without permission — for example someone getting into an account, a credential or a system they should not reach. This is what we do.

Detect and report

We find incidents through monitoring and error alerts, audit logs of the actions that run, and reports sent to [email protected]. Anyone can report a vulnerability or a suspected incident to that address.

Contain

We revoke or rotate the affected credentials and access, and isolate the affected systems.

Assess

We work out what data was involved and which users are affected.

Notify

• You — we notify affected users and merchants within 72 hours of confirming an incident that affects their personal data.
• Platforms — we notify the platforms whose data is involved (for example Shopify, Google or Meta) as their terms require, and no later than 72 hours after confirming the incident.
• Regulators — we notify regulators where the law requires.

Recover and review

We fix the cause and restore service. Then we write a post-incident review and make the follow-up fixes it calls for.

4. Contact

Nexplora LLC
2542 East 2nd Street, Brooklyn, NY 11223, United States
Security reports and questions: [email protected]