Privacy Policy

NEXORA is an online marketplace that helps people in Kosovo find independent tradespeople. The platform is operated by NEXORA NETWORK SH.P.K., which is responsible for your personal data under this policy (the "controller"). In this policy "NEXORA", "we" and "us" mean the operator of the platform.

• Business registration number (ARBK): 812464668
• How to reach us about privacy: by email at nexora.kosova@gmail.com

Everyone who creates an account gives us:

• an email address and a password. The password is handled by our authentication provider (Supabase) and stored only in scrambled (hashed) form; nobody at NEXORA can read it;
• a name and a phone number, as entered at sign-up;
• the kind of account created: customer or professional.

We also record when you last signed in, and when you accepted the Terms of Service and the Platform Disclaimer, together with the version you accepted.

If you are a customer, the extra details you add on your profile page, such as a photo or a short bio, are kept on your own device and are not uploaded to NEXORA.

If you join as a professional we also store your trade and services, years of experience, the municipality you are based in and the areas you serve, a description, your working hours, the languages you speak, links you add, and your profile, cover and portfolio photos and videos.

• Shown to anyone who visits NEXORA, with or without an account: your name, trade, services, municipality and service area, experience, description, working hours, languages, photos, portfolio, reviews, verification badge, and whether you are currently accepting new customers.
• Never shown to customers: your phone number and email address. When a customer taps Call, NEXORA hands your number to their phone's own dialer to place the call; it is not displayed on NEXORA's pages. Your number and email are visible only to you and to NEXORA administrators.

To earn a verification badge you may upload documents such as an identity document, a business registration, certificates or insurance. They are kept in private storage, are never published, and can be opened only by NEXORA reviewers through links that expire after two minutes. Reviewers record their decision and any notes.

Your location. If you set a location pin on your profile, we store that pin and an optional note. It is where your customers get in-app directions to, and the distance to a job is measured from it. Without a pin, only your municipality is shown. It is shown only to your own customers — people who called you, messaged you, or whose request you accepted — and only for one month after that contact. Nobody else can see it. You can stop your exact location being shown at any time: switch off sharing on your profile, or remove the pin. Your pin is deleted when your account is deleted.

Profiles can be viewed by anyone who visits NEXORA, without an account. Contacting a professional — calling, messaging or sending a request — requires one.

• Requests. When you send a request we store your name, the phone number and email you give, the service, the municipality and your message, and deliver them only to the professional you chose. Other professionals cannot see it.
• Job location. You may add a map pin and a short note to a request. Only you, the professional you sent it to, and NEXORA administrators can see it. It is never shown in search results, on the public map, in notifications or in emails. The professional can open it in Google Maps.
• Calls. When you tap Call, NEXORA records the contact so that the professional sees it among their requests, together with your account email address, so they know who called.
• Customer records. To apply professionals' plan limits we record that a customer has contacted a professional. This record uses your account ID; contacting a professional always requires an account.
• Messages. Messages, photos and voice messages you send are stored so that both sides can read the conversation. Chat photos and voice messages are kept in private storage and opened through links that expire after five minutes. The microphone is used only while you are recording a voice message. NEXORA accesses conversations only when needed to investigate a report or to meet a legal obligation.
• Reviews. When you review a completed job, your name, rating, text and any photos are published on the professional's profile. Review photos can be opened by anyone who has their link.
• Feedback. If you send us feedback, we store your message, its type, the page you were on, your language, your browser's technical description (user-agent), and your account or email if you give it.

• If you allow it, your device's GPS position is used on your device to show your municipality and nearby professionals. It is stored only in your browser and is not sent to NEXORA.
• We store municipalities: a professional's base and service areas, and the municipality of a request.
• An exact location reaches NEXORA only when you pin a job location on a request (section 5), when a professional sets their location pin (section 4), or when you ask for directions.
• Directions. When you ask for directions, your current position is sent to NEXORA's own routing server to calculate the route, which is then drawn in the app. It is used only for that calculation: it is not stored, not logged, and not sent to anyone else. While you drive, your device follows the route itself and asks again only if you leave it. A professional can get directions to a job location you pinned on a request you sent them; a professional's location pin can be reached only by their own customers.

• Searches. We store the words you search for (up to 120 characters), the municipality, and how many results were found, so that we can improve search. These records are not linked to your account.
• Views and contacts. We count how often profiles are viewed and contacted, so that professionals can see their statistics. To count unique visitors without knowing who they are, we turn your IP address, browser and the date into a code using a one-way cryptographic function. The code changes every day, and your IP address itself is not stored.
• Security. To block abuse, our servers keep your IP address in memory for up to one hour to limit how many requests can be sent from it. It is not written to our database.
• Sign-ins. When you sign in, we record the time, your browser and device, and your IP address, so that we can warn you about a sign-in from a device you have not used before.

When somebody describes a problem in their own words and NEXORA cannot match it directly, we try to understand it with a small language model that runs on our own servers. Nothing you type is sent to any outside company for this. We keep the search as described in section 7, and a copy of the question with the trades it matched, not linked to who asked, so that the same question is answered faster next time.

If you turn on notifications, your browser gives us a subscription address so that we can deliver them. We store it with your browser's user-agent and your language, so that notifications reach you in the language you use.

Notifications travel through the push service of your browser or phone maker (for example Google, Apple or Mozilla), encrypted so that the push service cannot read them. They tell you that something happened and may include a name, for example "Arta sent you a message", but never the text of a message or a request.

We also send emails about your account and the service: sign-up confirmation and password reset, the outcome of a professional's application, a new request or a new conversation for a professional, subscription reminders and plan notices, and platform announcements.

You can turn notifications off in your browser or phone settings at any time. Signing out removes the subscription from that device.

Kosovo's Law No. 06/L-082 on the Protection of Personal Data requires a legal basis for each use of personal data. Ours are:

• To provide NEXORA (accounts, profiles, requests, calls, messages, reviews, and the notifications you turn on): necessary to perform our agreement with you, the Terms of Service.
• To verify professionals, keep the platform safe, and prevent fraud and abuse: our legitimate interest in a trustworthy marketplace.
• To measure and improve NEXORA (search and profile statistics): our legitimate interest. These use codes that do not identify you.
• Push notifications and location access: your consent, which you can withdraw at any time.
• Billing records, and answering lawful requests from authorities: our legal obligations.

We do not use your data for advertising and we do not sell it. We do not take decisions about you based only on automated processing that have legal or similarly significant effects on you.

• The professional you contact receives your request, as described in section 5.
• Service providers that run NEXORA for us and may use the data only on our instructions:

• Supabase: accounts, database, file storage and real-time messaging.
• Netlify: hosting of the website. Its servers run in the United States (Ohio), and pages reach you through its worldwide network.
• Google, Apple and Mozilla push services: delivering notifications.
• An email delivery provider: sending account and service emails.
• A payment provider, once paid plans can be bought (not yet active): it will receive only what is needed to take a payment.

One service is contacted directly by your browser while you use NEXORA: OpenFreeMap supplies the map images (Mapbox, if we change map provider). It receives your IP address and the ordinary technical details that every web request carries. The typeface is served by NEXORA itself.

We also disclose data to authorities when the law requires it, and to a buyer or successor if NEXORA is ever sold or merged, under the same commitments as this policy. We never sell personal data.

Some of the providers above store or process data outside Kosovo, in the European Union and in the United States. When that happens we rely on the safeguards the law requires for such transfers, such as the providers' data-processing agreements and standard contractual clauses.

NEXORA uses no advertising or analytics cookies and no third-party trackers. It uses only the cookies and browser storage it needs to work:

• nexora-language (cookie, one year): remembers the language you chose.
• nexora-theme (cookie, one year): remembers whether you chose the dark or the light look.
• nexora-session (cookie, one year): says only whether someone is signed in on this browser, so pages can appear at once for visitors. It holds no name, email or account number.
• nexora-ref (cookie, 30 days): remembers an invitation code from a referral link until you sign up.
• nx_admin (cookie, four hours): used only by NEXORA administrators to sign in to the admin console.
• Your sign-in session (browser storage): keeps you signed in.
• Your acceptance of the Terms (browser storage): so the notice is not shown to you again on this device.
• Conveniences kept only on your device (browser storage): your location and municipality, saved professionals, recently contacted professionals, recent map searches, the last request you wrote, and a random code for this browser.

Signing out clears the account-related entries from the device. Because everything here is either needed for the site to work or kept only on your device, NEXORA does not show a cookie banner.

• Your account and profile: for as long as your account exists.
• Requests, messages and reviews: for as long as the accounts involved exist, because they are part of the other person's history too.
• Search and usage statistics: 24 months, then deleted automatically. They contain no names, email addresses or IP addresses.
• Sign-in records: 12 months, then deleted automatically.
• Billing records: for as long as tax and accounting law requires.
• Notification subscriptions: until you turn notifications off, sign out, or the push service reports that the subscription is no longer valid.
• Security limits: up to one hour, in memory only.

You can ask to delete your account from your profile page (customers) or from Settings (professionals). A NEXORA administrator handles every request, and you can withdraw yours until it has been completed. When it is completed:

• your sign-in account, notification subscriptions, acceptance records, portfolio, verification documents and photos are deleted;
• your name, phone number and email address are removed from your requests, your conversations and your professional profile, which is hidden;
• messages you sent stay visible to the people you sent them to, and reviews you wrote stay on the professional's profile without their photos, both under the name "Deleted user";
• billing records are kept for as long as the law requires;
• we keep a restricted record of the deleted account, including your name, email address, phone number, account type and a summary of your activity, together with your deletion request, so that we can handle disputes, fraud and legal claims. Only authorised administrators can open it, every access is logged, and it is never published. It is deleted automatically three years after the deletion is completed.

• Every database table is protected by access rules, so each person can read only what they are allowed to.
• A professional's phone number and email address are withheld from customers by the database itself, not only hidden on screen.
• Verification documents, chat photos and voice messages are kept in private storage and opened only through links that expire within minutes.
• Administrators have separate accounts with limited roles, high-impact actions require two-factor authentication, and administrative actions are logged.
• Connections to NEXORA are encrypted (HTTPS), and notifications are encrypted so that push services cannot read them.

No system is completely secure. If a breach is likely to put your rights at risk, we will inform the Information and Privacy Agency and, where required, you.

Under Kosovo's Law No. 06/L-082 on the Protection of Personal Data you have the right to:

• know what data we hold about you and receive a copy of it;
• have incorrect data corrected; you can edit much of it yourself on your profile;
• have your data deleted, as described in section 14;
• restrict or object to some uses, including those based on our legitimate interests;
• receive the data you gave us in a portable format;
• withdraw your consent at any time, for example by turning off notifications or location access, without affecting what was done before.

To use these rights, contact us by email at nexora.kosova@gmail.com. We answer within 30 days, free of charge, and may first ask you to confirm your identity.

If you believe we have mishandled your data, you can complain to Kosovo's data protection authority, the Information and Privacy Agency (Agjencia për Informim dhe Privatësi): submit a complaint.

NEXORA is meant for adults. You must be at least 18 years old to create an account. We do not knowingly collect data about children; if you believe a child has created an account, contact us by email at nexora.kosova@gmail.com and we will delete it.

This policy is information for you, not an agreement: you are never asked to accept it. When we change it, the date at the top of this page changes. If a change significantly affects how your data is used, we will tell you through NEXORA or by email before it takes effect.

Questions about this policy or about your data: contact us by email at nexora.kosova@gmail.com.