Privacy Policy

Nexa is a business management application developed and operated by Five2Nine Projects, a South African company. We provide tools for sales tracking, expense management, invoicing, manufacturing, team collaboration, and more — designed for entrepreneurs and small businesses.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Nexa mobile application (“the App”) and any related services.

We collect information you provide directly, information generated through your use of the App, and limited technical data required to operate the service.

• Account information: Name, email address, and password when you register.
• Business information: Company name, business type, country, and currency preferences.
• Financial records: Sales, expenses, invoices, quotations, purchases, and account balances that you enter into the App.
• Product & inventory data: Products, raw materials, packaging materials, recipes, and production records you create.
• Customer & supplier data: Names, contact details, and transaction history for your customers and suppliers.
• Team data: Names and email addresses of team members you invite to your company workspace.
• Device & usage data: Device type, OS version, app version, and general usage patterns to help us improve the App.
• Push notification tokens: Device tokens used to deliver in-app notifications such as invoice reminders and task deadlines.

Nexa requests access to your device’s camera and photo library to support specific features. Camera access is never used for surveillance, background recording, or any purpose unrelated to the features described below.

We use the information we collect solely to provide, maintain, and improve the Nexa service:

• To operate the App: Store and sync your business records, generate reports, and power features like invoicing, manufacturing, and team collaboration.
• To personalise your experience: Apply your currency, country, and business-type preferences across the App.
• To send notifications: Deliver invoice reminders, task deadlines, and other alerts you have opted in to receive.
• To process payments: Handle subscription billing securely via our payment provider (PayFast). We do not store card details.
• To provide support: Respond to your queries and troubleshoot issues when you contact us.
• To improve the App: Analyse aggregated, anonymised usage patterns to identify bugs and prioritise new features.
• To comply with legal obligations: Retain records as required by applicable South African law.

We do not sell your personal information, use it for targeted advertising, or share it with data brokers.

Your data is stored on secure cloud infrastructure provided by Supabase, which uses industry-standard encryption at rest and in transit (TLS/HTTPS). Access is controlled by row-level security policies so each user and company can only access their own records.

• Encryption in transit: All data sent between the App and our servers is encrypted using TLS.
• Encryption at rest: Data stored in our database and file storage is encrypted at rest.
• Access controls: Strict row-level security ensures your data is isolated from other users’ data.
• Authentication: Passwords are never stored in plain text. We use secure hashing and token-based authentication.
• Data retention: Your data is retained for as long as your account is active. If you delete your account, your personal data is removed in accordance with our deletion procedures.

We do not sell, rent, or trade your personal information. We share data only in the limited circumstances below, and only to the extent necessary:

• Supabase (infrastructure): Our database and file storage provider. Data is processed under their privacy and security terms.
• PayFast (payments): Subscription billing is processed by PayFast. We share only the information required to process your payment. Card details are handled entirely by PayFast and are never stored by us.
• Email delivery: Transactional emails (e.g. invoice delivery, team invitations, password resets) are sent via a third-party email service. Only the recipient address and email content are shared for this purpose.
• AI features: If you use the AI assistant, your queries may be processed by a third-party AI provider. We do not send personally identifiable financial records to AI providers without your explicit action.
• Legal requirements: We may disclose information if required to do so by law, court order, or governmental authority in South Africa.

All third-party providers are contractually required to handle your data securely and only for the purposes we specify.

Under the Protection of Personal Information Act (POPIA) and applicable privacy law, you have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that inaccurate or incomplete information be corrected. Most information can be updated directly within the App.
• Deletion: Request deletion of your account and associated personal data. You can initiate account deletion from within the App’s settings.
• Objection: Object to certain types of processing, such as receiving marketing communications.
• Portability: Request an export of your data in a machine-readable format where technically feasible.
• Notifications: Manage push notification preferences at any time through your device settings or within the App.
• Camera permissions: Revoke camera or photo library access at any time through your device’s Settings app.

To exercise any of these rights, please contact us using the details in Section 10.

Nexa is designed for use by adults and business owners. The App is not directed at children under the age of 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will take steps to remove it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you via the App or by email.

Continued use of the App after changes are posted constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please reach out to us. We aim to respond to all privacy-related enquiries within 5 business days.