How Nexgile handles your data.

Nexgile Inc. (Herndon, Virginia, USA) and its R&D subsidiary Nexgile Technologies Pvt Ltd. (Hyderabad, India) — together, "Nexgile," "we," "us" — build owned digital workforces: agentic-AI digital workers designed for your business, rehearsed against a Simulated Enterprise, and delivered as source code you own. This policy applies to:

• Website visitors — anyone browsing nexgile.com.
• Prospects and clients — people who contact us, evaluate our platform, or engage us to build digital workers.
• Candidates — people who apply for roles through our careers page.

What this policy does not cover. Once we deliver software to a client, that software runs on the client's own infrastructure. Any data processed inside a client's self-hosted systems is controlled by that client, under that client's policies. We build the software; we don't operate it, and there is no Nexgile cloud or runtime in the loop after delivery. If you interact with a system a Nexgile client operates, that client's privacy policy governs.

Client design-time inputs. Some clients bring materials to help us design their digital workers — for example, RPA estate exports or operational logs. This happens on the client's terms, is used only to design that client's workers, and is governed by a data-processing agreement put in place before anything moves. Nothing in this category is ever collected from the website.

We use personal information only for the purposes below. Where the GDPR applies, the legal basis for each purpose is mapped alongside it.

We do not use your personal information for automated decisions that produce legal or similarly significant effects about you. We do not use website visitor data, contact inquiries, or candidate applications to train AI models.

It would be normal to find a long cookie disclosure here. Ours is simpler: nexgile.com currently runs no analytics service, sets no analytics or advertising cookies, and embeds no tracking pixels, beacons, or social-media widgets. We do not use cookies for advertising, retargeting, or cross-site tracking — or, today, for anything else.

Server logs. Like every website, our hosting infrastructure keeps standard server logs — IP address, request time, and the page requested — to operate and secure the site. They are not mined for analytics.

Google Fonts. This site loads its typefaces from Google Fonts. When your browser fetches the font files, your IP address and standard request metadata are transmitted to Google as part of that request. That is the only third-party request this site makes.

If this ever changes. If we introduce analytics in the future, we will update this policy first — naming what runs, what it collects, and how to opt out — before it goes live.

We are an AI company, so we hold ourselves to specifics here — scoped, honest ones.

Synthetic rehearsal. Every digital worker we design is rehearsed against a Simulated Enterprise: a complete synthetic company with synthetic data. Simulation, preview, and red-teaming all run against this synthetic environment — not against your production data. That is the scope of this pledge: rehearsal happens on data we generate, so testing your workers never requires exposing your operations.

Design-time inputs are separately governed. When a client chooses to share design-time materials — operational logs, RPA estate exports, process documentation — that is a deliberate, contracted act. It happens on the client's terms, under a data-processing agreement signed before any data moves, and the materials are used solely to design that client's workers.

Training-data isolation. We maintain training-data isolation controls: client data and design-time inputs are not used to train models for other clients or for general model improvement.

Prompt-data deletion. We maintain prompt-data deletion controls, so prompt content used during engagements can be deleted.

You own and run the result. Digital workers are delivered as source code the client owns and self-hosts. After delivery there is no Nexgile cloud or runtime in the loop, and no per-decision billing that would require us to observe your workers operating. Data your workers process in production lives on your infrastructure, under your control.

Oversight built in. The product supports human-in-the-loop oversight and tamper-evident audit trails, so the humans accountable for your operations can supervise and verify what digital workers do.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We share it only in these situations:

• Service providers. Vendors who help us operate — such as hosting, analytics, and email services — process data on our behalf, under contracts that restrict use to our instructions. A list of sub-processors is available on request to privacy@nexgile.com.
• Within Nexgile. Our Herndon and Hyderabad operations share information as needed to serve you, under the safeguards described in International transfers.
• Legal requirements. We disclose information when a law, regulation, court order, or valid governmental request requires it, or to protect our rights, safety, or property. Where lawful, we will tell you before disclosing.
• Business transfers. If Nexgile is involved in a merger, acquisition, or asset sale, personal information may transfer as part of that transaction. We will notify you of any change in ownership or in how your information is used.

Nexgile operates from Herndon, Virginia, USA and Hyderabad, India. Information you provide may be processed in either location.

When personal information moves across borders — including out of the European Economic Area, the United Kingdom, or other regions with transfer restrictions — we use recognized safeguards, including Standard Contractual Clauses where required, and we require equivalent protections from service providers who process data on our behalf. Wherever your data is processed, it receives the protections described in this policy.

We retain personal information no longer than needed for the purpose it was collected for, then delete or anonymize it. We do not warehouse data on the chance it becomes useful later.

You can request deletion at any time — see Your rights. Where a legal obligation requires us to keep something longer, we keep only what that obligation covers and delete the rest.

We apply security measures appropriate to the data we hold:

• Encryption in transit and at rest.
• Access controls built on least privilege — people see only what their role requires.
• Regular security reviews of our practices and systems.
• Tamper-evident audit trails in the product we deliver, so activity can be verified after the fact.

No method of transmission or storage is perfectly secure, and we don't claim otherwise. If you believe you've found a security vulnerability, email security@nexgile.com — we take reports seriously and respond promptly. Our Trust Center describes our security program, including the certifications we are pursuing, in more detail.

Your rights vary by where you live, but our default is simple: if you ask us to show you, fix, or delete your data, we will, unless a legal obligation prevents it.

California, specifically. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of — but the right is yours regardless, and we will never discriminate against you for exercising any privacy right.

India, specifically. We are committed to alignment with the Digital Personal Data Protection Act, 2023. Requests and grievances go to the same address as everything else: privacy@nexgile.com.

Nexgile provides business-to-business services. Our website and services are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, email privacy@nexgile.com and we will delete it.

We update this policy as our practices, products, or legal obligations evolve. Every version is dated at the top of this page. For material changes — anything that meaningfully affects what we collect or how we use it — we will post a prominent notice on this page before the change takes effect. Continuing to use the site after a change takes effect means the updated policy applies.

This version is effective July 31, 2026. It replaces the version dated January 5, 2026.