Nexovil Nexovil

Data Processing Agreement

Last updated: October 2026

1. Scope and Roles

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Nexovil and the Customer. The Customer is the Data Controller of the personal data they enter into the Service. Nexovil is the Data Processor.

2. Processing Instructions

Nexovil will process Customer Data only on the documented instructions of the Customer, including with regard to transfers of Customer Data to a third country, unless required to do so by applicable law.

3. Confidentiality

Nexovil ensures that personnel authorized to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Security Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Nexovil implements appropriate technical and organizational measures, including:

  • Row Level Security to isolate tenant data.
  • Encryption of data in transit (TLS 1.2 or higher) and at rest.
  • Access controls and rate limiting.
  • Audit logs for tracked records.

5. Sub-processors

The Customer grants Nexovil general authorization to engage sub-processors. A current list of sub-processors is available on the Security page, including Cloudflare, Supabase, Lemon Squeezy, and Maileroo.

6. Data Subject Rights

Nexovil will assist the Customer in responding to requests from data subjects to exercise their rights under applicable data protection laws. The Customer can export or delete data directly through the Service's Settings page.

7. Data Breach Notification

Nexovil will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data.

8. Deletion or Return of Data

Upon termination of the Service, Nexovil will delete or return all Customer Data at the choice of the Customer, unless applicable law requires storage of the personal data.