Privacy policy

nexroom processes the information you provide when using the website, creating an account or contacting us. Use the contact form at nexroom.app/kontakta-oss for questions about your information and requests to exercise your rights.

This policy applies to people who visit the website, represent a customer or prospect, use the service, contact support or are invited to a customer organisation. Data comes from you, your organisation administrator, use of the service and technical security and operations logs.

We process data only for the stated purposes and on the legal bases below. Where the customer is a legal person, processing of its contact persons will normally rely on our and the customer's legitimate interests in administering the business relationship.

Data may be disclosed to authorised personnel at nexroom and the customer and to providers required for the service: Supabase for database, authentication and file storage, Vercel for web hosting and technical logs, and Resend for email delivery. Receiving email systems also process sent messages.

We retain data only for as long as needed for each purpose. Account and workspace material is retained while the customer account or contractual relationship is active and is then deleted or de-identified under the approved retention schedule. Contact cases, bug reports and unaccepted quote material are normally retained for no more than 24 months after the last activity. Short-lived security contexts expire after 5–15 minutes and certain quote-related abuse hashes are deleted after 30 days.

Order, contract, invoice and payment records are retained for as long as required by accounting rules, normally through the seventh year after the end of the calendar year in which the financial year ended. Data may be retained longer where required for an ongoing legal claim, authority requirement, backup recovery or another documented legal hold. Organisation-owned Rooms, cases, orders and invoices are not automatically deleted merely because an individual user's account is deleted.

Depending on the processing, you can request access, rectification, erasure, restriction or data portability and object to processing. We may need to confirm your identity to protect your data. You can lodge a complaint with the Swedish Authority for Privacy Protection, IMY. Contact us using the contact form to exercise your rights.

Read about your rights at IMY: https://www.imy.se/privatperson/dataskydd/dina-rattigheter/

Room Builder uses versioned rules and product profiles for recommendations and visualisations. The feature does not make decisions that produce legal or similarly significant effects for individuals. Methods, assumptions, sources and limitations are explained with the result and in the Design Guide.

nexroom may have different data-protection roles for different processing activities. A data processing agreement must be entered into before nexroom processes personal data solely on a customer's documented instructions. Roles must not be inferred solely from product labels.