Privacy Policy

Version 1.2 — last updated 31 October 2026. Privacy Policy. This page says, in plain words, what we keep, why, where it lives and who else sees it.

Who we are

Nexora Engine is run by Chandima Himal Abeyesekera, an individual in Sri Lanka who publishes it under the brand name Arcline Studios. Address: B1-06-11 Viyathpura Apartments, Weera Mawatha, Kalalgoda, Thalawathugoda, Sri Lanka. Chandima Himal Abeyesekera is the data controller for the account and business data described below. You can reach us at support@nexoraengine.xyz or through the in-app Contact page.

What we keep

· Your account: your name, your email address and your password (the sign-in service handles the password), and when the account was created.

· Your work: company and bank details, a logo, item and client records, the documents you save and their contents, Master ERP records, theme settings, your plan and how many tool uses you have had.

· Premium requests: the name, phone or WhatsApp number, plan and message you type.

· Support: the topic, your messages and our replies; for a guest conversation, also the email address you type.

· On your device: your browser keeps a local copy — the signed-in session, your avatar, unsaved drafts and app settings — so the app keeps working offline.

Saved documents can contain other people’s details, for example your clients’ names, addresses and phone numbers. Those records are yours; only your account can read them.

Why we keep it

Only to run the app: your account and sign-in, syncing your work between your devices, support conversations and Premium requests. We do not sell personal data, there are no ads, and there is no analytics or tracking in the app.

Where it lives

On your device, in your browser’s local storage; and, while you are signed in, in our database at Supabase (region Northeast Asia (Tokyo), ap-northeast-1). Our providers may store or process your data outside Sri Lanka. Row-level security means one account cannot read another account’s rows.

Who else sees it

You, and the owner of Nexora Engine, who reads support conversations and decides Premium requests. Our providers process the data for us: Supabase (accounts and the synced copy), Cloudflare Turnstile (the bot check at sign-in — it sees your internet address and browser signals, not your email or your work), Resend (delivers the verification-code emails for our sign-in service), Vercel (hosts the website and runs the email-code endpoint, whose log keeps a masked address such as a***@g***.com) and GitHub (the desktop app asks it for the latest version and downloads the installer from it; it sees your internet address and the app version). The fonts and every other part of the app are served by the app itself — nothing is loaded from a public CDN.

How long we keep it

· Your account, plan, company and bank details, terms and your work: while your account is in use, or until you ask us to delete it.

· The daily free-use count: only the current day (Colombo time).

· The signed plan note on your PC: 7 days, then it stops working.

· An unused guest account: removed after 30 days without activity.

· A closed support conversation: removed one year after it is closed.

· A decided Premium request: removed one year after it is closed.

A record you delete leaves a small marker (no content) so the deletion reaches your other devices; the app removes markers older than 30 days the next time it syncs.

Your rights

You can ask to see a copy of the personal data we hold about you, have it corrected, have it deleted (the right to be forgotten), withdraw a consent you gave, or object to processing we base on our legitimate interests. Ask through the Contact page with the topic “Question about my data” (the topics “Delete my account” and “Get a copy of my data” are shortcuts) or email support@nexoraengine.xyz. We reply within 30 days, and we may ask you to prove you own the account. You can also complain to the Data Protection Authority of Sri Lanka, or, in the EU or UK, to your local supervisory authority. There is no delete-my-account button in the app yet: the Contact request is the path today, and we delete the account and its records for you.

Children

Nexora Engine is a business tool. Anyone may use it, but if you are under 18, please use it only with the agreement of a parent or guardian.

Changes

We may update this policy; the version and date at the top change with it. Questions and data requests go through the in-app Contact page or support@nexoraengine.xyz.