Privacy Policy
Last updated: 25 October 2026 · Applies to nexatoolpro.com and all its tools
1. Who we are
NexaToolPro is the controller (the party that decides how personal data is used) for the personal data described in this policy.
- Operator: NexaToolPro (nexatoolpro.com), Kingdom of Saudi Arabia
- Contact for privacy and legal requests: [email protected]
- Address: Duba, Tabuk Region, Kingdom of Saudi Arabia
2. The laws we follow
We operate from the Kingdom of Saudi Arabia and handle personal data under the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations and the rules of the Saudi Data and AI Authority (SDAIA). Because visitors come from many countries, we also give the rights described below to visitors protected by the EU General Data Protection Regulation (GDPR) and ePrivacy rules, the UK GDPR and Privacy and Electronic Communications Regulations (PECR), and the California Consumer Privacy Act as amended (CCPA/CPRA). Where another country's law gives you more protection, that law applies to you.
3. What we process
| Information | What it is and where it comes from |
|---|---|
| Your files and text in the browser tools | Processed on your own device. They are not uploaded to our servers and we cannot see them. The exception is the AI tools, see section 6. |
| Account data | Email address, a salted one-way hash of your password (never the password itself), the time the account was created, whether the email is verified, the version and time of the Terms and Privacy Policy you accepted, and your history on/off setting. |
| Login and session data | A session token (stored only as a hash) with its expiry, and a short-lived count of failed log-in and sign-up attempts, kept together with the email address or the IP address used, to stop password guessing. |
| Activity history (if switched on) | For each finished job: tool name, output file name, file size and time. The file itself is never stored. The account page shows the latest 100 entries. File names can contain personal details, so name your files accordingly. |
| AI usage log | For each AI request: the day, tool, provider, whether it worked, the number of characters in and out, linked to your account to apply free daily and monthly limits. We do not store the text. |
| Anonymous tool counters | How many times each tool ran and whether it worked. No account, IP address, file name or cookie is attached. Browsers that send Do Not Track or Global Privacy Control are not counted. |
| Hosting and security logs | IP address, browser type, pages requested and time, created by our hosting provider (Cloudflare) when you visit the site, used for security and reliability. |
| Analytics data (only if you allow it) | Pages viewed, time on page, approximate location (city or country level), browser and device type, collected by Google Analytics 4 with IP anonymisation. See the Cookie Policy. |
| Messages and requests you send us | Your email address and what you write, for example in a support email or refund request. |
4. Why we use it and our legal basis
| Purpose | Legal basis (GDPR / UK GDPR) and PDPL |
|---|---|
| Provide the tools and your account, including log-in, your dashboard and your history | Performance of the service you ask for (contract). Under the PDPL, the service you request and your consent. |
| Keep the site secure, prevent abuse, limit failed log-ins and AI use, fix errors | Our legitimate interests in running a safe, reliable service. Under the PDPL, legitimate interests permitted by the law. |
| Send account emails (verification, password reset, important account notices) | Performance of the service you asked for. We do not send marketing emails. |
| Count visits and improve the tools with Google Analytics | Your consent. You can refuse, and you can withdraw it at any time from "Cookie settings" in the footer. |
| Answer your messages, handle refunds, keep records and defend legal claims | Our legitimate interests, and compliance with legal obligations. |
We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not use your account data for profiling. Advertising on the site, if it is shown, works as described in sections 5 and 8.
5. Who we share it with
We use a small number of service providers (processors) that only handle data on our behalf and for the purposes below. We do not sell your personal data. If we show advertising, the advertising provider listed below may collect data through cookies on this site, as described in section 8.
| Provider | What it does for us | Data it may receive |
|---|---|---|
| Cloudflare | Hosting, content delivery, security and the database (D1) for accounts | Everything described in section 3 that is stored on the site, plus visitor IP address and request data |
| Google (Analytics 4) | Visit statistics, only if you allow analytics | Analytics data described in section 3 |
| Google (AdSense) | Showing and measuring ads, only on pages where ads are shown, and, where the law requires consent, only after you agree | IP address, cookie identifiers, the page address, browser and device information and your consent choice |
| Google (Gemini) or xAI (Grok) | Writing the answers of the AI tools, only when you use an AI tool | The text you enter in that AI tool |
| Resend | Sending account emails (verification and password reset) | Your email address and the message |
| ExchangeRate-API | Live exchange rates for the Currency Converter. Only our server contacts it, to read the daily rates; your browser never does | Nothing about you. No amount, currency or visitor data is sent |
| Authorities and advisers | When the law requires it, or to protect our rights | Only what is needed |
6. AI tools
When you use an AI tool, the text you enter is sent through our server to an AI provider (Google Gemini or xAI Grok) so it can write the answer. The provider processes it under its own terms. We do not store the text or the answer. Please do not enter passwords, payment details, health information, identity numbers or other private or sensitive data. AI answers can be wrong, so check anything important.
7. Transfers outside your country
Our providers run services in several countries, including the United States, so your data can be processed outside Saudi Arabia, the EU or the UK. We transfer data only to providers that give appropriate protection, and in line with the PDPL and its personal data transfer rules. For visitors in the EU or UK we rely, where needed, on safeguards such as the providers' Standard Contractual Clauses or adequacy decisions. Contact us for details.
8. Cookies and similar technologies
We use one cookie that is strictly necessary (the log-in cookie) and, only with your permission, Google Analytics cookies. Details, names and durations are in the Cookie Policy. You can change your choice at any time from "Cookie settings" in the footer.
Advertising (Google AdSense). We may show ads on some pages. They are served by Google. Google, as a third-party vendor, uses cookies, including advertising cookies, to serve ads based on a user's earlier visits to this site or to other sites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet. You can opt out of personalised advertising in Google Ads Settings or at www.aboutads.info. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. Where the law requires your consent (for example in the EEA, the UK and Switzerland), a consent message is shown and advertising cookies or personalised ads are used only if you agree.
9. How long we keep data
| Data | Kept for |
|---|---|
| Account data | Until you delete your account (you can do this yourself on the account page), after which it is removed from our database. |
| Session tokens and email tokens | Until they expire (sessions up to 30 days; email links for a short time). Expired items are removed automatically. |
| Failed log-in counters | A short window, then removed automatically. |
| Activity history | Until you clear it, switch it off, or delete your account. |
| AI usage log | Up to 13 months, then removed automatically, or earlier if you delete your account. |
| Analytics data | Up to 14 months in Google Analytics, according to our analytics settings. |
| Hosting and security logs | According to our hosting provider (Cloudflare) retention rules. |
| Support and refund messages | As long as needed to deal with your request and any follow-up, normally no more than 24 months, unless the law requires longer. |
10. Your rights
Depending on where you live you have the right to: be informed about how your data is used; access your data and receive a copy in a common format; have wrong data corrected; have your data deleted (destruction); restrict or object to some uses; withdraw consent at any time without affecting what was done before; and not be subject to decisions made only by automated means. Under the CCPA/CPRA you also have the right to know, delete, correct, and to limit the use of sensitive information (we do not collect any for these purposes). We will not treat you worse for using your rights.
How to use them. Log in and open your account page to download your data or delete your account yourself. For anything else, or if you do not have an account, email [email protected]. We may need to confirm who you are first. We reply within 30 days. You can use an authorised agent where the law allows.
Complaints. You can complain to us first, and you also have the right to complain to the supervisory authority: in Saudi Arabia the Saudi Data and AI Authority (SDAIA); in the EU your national data protection authority; in the UK the Information Commissioner's Office (ICO); in California the California Attorney General or the California Privacy Protection Agency.
11. California and other US states
In the past 12 months we collected the categories identifiers (email address, IP address), internet or network activity (pages viewed, tool usage), and the other account data in section 3. We do not sell personal information. If advertising is shown, advertising cookies set by Google may count as "sharing" for cross-context behavioural advertising under some US state laws; you can opt out in Google Ads Settings or at www.aboutads.info. We treat a Global Privacy Control signal as a refusal of analytics. We do not knowingly sell or share the data of anyone under 16.
12. Children
The site and accounts are not for children. You must be at least 16 years old to create an account (or the age of digital consent in your country if higher). We do not knowingly collect personal data from children. If you believe a child has given us data, email [email protected] and we will delete it.
13. Security and data breaches
We protect data with encrypted connections (HTTPS), one-way salted password hashing, HttpOnly and Secure session cookies, limits on failed log-ins and access limited to what is needed. No online service is perfectly secure. If a breach is likely to harm you, we will notify the competent authority (in Saudi Arabia, SDAIA) and the people affected within the time the law requires. Security researchers can find our contact in security.txt.
14. Changes to this policy
We update this policy when our practices or the law change. The date at the top shows the latest version. When a change affects your choices, such as analytics, we ask you again.
15. Contact
- Operator: NexaToolPro (nexatoolpro.com), Kingdom of Saudi Arabia
- Contact for privacy and legal requests: [email protected]
- Address: Duba, Tabuk Region, Kingdom of Saudi Arabia