Privacy policy
What leaves your phone, to whom, and when — in full.
Last updated: August 2026. The French version prevails; this translation is provided for convenience and has no contractual value.
In short
Nexap is a management app for the building trades. It holds your clients, your quotes, your invoices and your job sites: in other words, more or less everything your business is made of. Here is what leaves your phone, to whom, and when.
| Service | What it receives | Place |
|---|---|---|
| Hosting and infrastructure | ||
| Supabase Inc. Database, authentication, file storage and server functions |
All of your account and document data | Data stored in the Europe (European Union) region |
| o2switch Hosting of the public web pages (this site and the signing page) |
Technical connection data of visitors (IP address, server logs) | Clermont-Ferrand, France |
| Artificial intelligence | ||
| Anthropic The Nexa assistant, drafting service descriptions, reading photos of supplier documents |
The text of your request, the elements of the document concerned (client, line items, amounts) and the image you submit | United States |
| OpenAI Voice dictation: transcription of the recording, then analysis of the resulting text |
The raw audio recording — it contains what you say, so possibly a client's name, address or requirement | United States |
| E-mail delivery | ||
| Resend E-mail delivery: login codes, sending your documents to your clients, this site's support form |
The recipient's address, the subject, the message and the PDF attachment | United States |
| Electronic signature and e-invoicing | ||
| openapi.com Electronic signature of quotes and e-invoicing (Peppol network) |
Depending on the feature: the quote PDF with the signatory's name and e-mail; or the invoice content, the recipient client's identity and the IBAN given as the account to credit | Italy |
| Public services and open data | ||
| Base Adresse Nationale Address suggestions while typing |
The address being typed — neither the client's name nor the rest of their record | France — api-adresse.data.gouv.fr |
| Annuaire des entreprises Checking a company registration number and pre-filling a company record from the public register |
The company number searched for | France — recherche-entreprises.api.gouv.fr |
| Open-Meteo Weather for the job in progress |
The name of the TOWN of the job — never the full address, never the client's name | Germany |
| Operating system and distribution | ||
| Apple Distribution of the app on the App Store and delivery of notifications (APNs) |
Aggregated App Store download statistics, and — if you accept notifications — a device token that contains no personal data | Apple's APNs network |
Each service above is detailed further down, with a link to its own policy.
What Nexap does not do
This list matters as much as the previous one. It is verifiable: the app's code contains none of the libraries below.
- No advertising tool — no Meta pixel, no Google Ads, no ad network, no retargeting.
- No third-party analytics — no Google Analytics, no Firebase, no AppsFlyer, no Amplitude, no Mixpanel.
- No third-party crash reporting — no Sentry, no Crashlytics. Nexap's error log stays on your device.
- No cross-app tracking — Nexap never asks for Apple's tracking permission (ATT), because it has no use for it.
- No advertising identifier — the IDFA is never read.
- No sale, no commercial sharing — neither of your data nor of your clients'. At no price.
- No embedded social network — no share button that tracks you along the way.
- No in-app purchase at present — the app is entirely free, and no payment provider receives anything. The subscription library present in the code is not enabled: it never runs.
This website, nexap.fr, sets no cookies, loads no external fonts and sends no requests to any third-party server. Nothing to accept, so no banner to dismiss.
Data controller
The data controller is Mathys Bouchet (sole trader), 420 route de Toulon, 83400 Hyères, France.
Contact : support@nexap.fr · or the support form.
Company number: 932 404 213 00013. Given its size, the business is not required to appoint a data protection officer; requests are handled directly by the controller.
Data collected
Nexap collects only what you put into it, plus the strict minimum needed for the service to work.
- Your account — e-mail address, and the company information you enter: company name, registration number, contact details, logo, bank details, hourly rate, the wording on your documents.
- Your business data — clients (name, address, phone, e-mail), quotes, invoices, credit notes, deposits, job sites, jobs, appointments, catalogue, suppliers, purchase orders, expenses, notes.
- Content you submit — voice dictation recordings, job site photos, photos of supplier documents, the handwritten signature applied to a quote.
- Your clients' data — you enter them, and you remain responsible for them towards your clients. Nexap processes them on your behalf, as a processor within the meaning of the GDPR.
- Internal usage measurement — screens visited and actions taken, as technical keys. Never a client name, an amount or the text of a quote. Stored in Nexap's own database, never passed to a third party, and switchable off at any time in Profile → Privacy.
- Notifications — if you accept them, a device token provided by Apple is kept so we can reach you. It contains no personal data and disappears if you uninstall the app.
Nexap never asks for your GPS location, nor access to your contacts, calendar or address book. The camera, photo library and microphone are requested only at the exact moment you press the corresponding button, and each can be refused without preventing the rest from working.
Purposes and legal bases
| Why | Legal basis (GDPR) |
|---|---|
| Providing the service: account, documents, sync, assistant | Performance of the contract (the Terms) |
| Answering a support request | Performance of the contract / legitimate interest |
| Security, abuse prevention, maintenance | Legitimate interest |
| Internal usage measurement to improve the product | Consent — switchable off in Profile → Privacy |
| Accounting and tax obligations | Legal obligation |
The providers, one by one
Each receives only what it needs, and only when the corresponding feature is used. None of them receives all of your data, except the host — that is what a host is.
Hosting and infrastructure
Supabase Inc. — United States
Database, authentication, file storage and server functions.
Data transmitted : All of your account and document data.
When : At all times — it is Nexap's host.
o2switch — France
Hosting of the public web pages (this site and the signing page).
Data transmitted : Technical connection data of visitors (IP address, server logs).
When : On each visit to a public page. The application itself does not go through o2switch.
Artificial intelligence
Anthropic — United States
The Nexa assistant, drafting service descriptions, reading photos of supplier documents.
Data transmitted : The text of your request, the elements of the document concerned (client, line items, amounts) and the image you submit.
When : Only at the moment you ask Nexa a question or photograph a document.
OpenAI — United States
Voice dictation: transcription of the recording, then analysis of the resulting text.
Data transmitted : The raw audio recording — it contains what you say, so possibly a client's name, address or requirement.
When : Only while you dictate, and only if you use dictation.
E-mail delivery
Resend — United States
E-mail delivery: login codes, sending your documents to your clients, this site's support form.
Data transmitted : The recipient's address, the subject, the message and the PDF attachment.
When : On each e-mail you send, and on each login request.
Electronic signature and e-invoicing
openapi.com — Italy (European Union)
Electronic signature of quotes and e-invoicing (Peppol network).
Data transmitted : Depending on the feature: the quote PDF with the signatory's name and e-mail; or the invoice content, the recipient client's identity and the IBAN given as the account to credit.
When : Only when you send a quote for signature or an invoice electronically.
Public services and open data
Base Adresse Nationale — France (public service)
Address suggestions while typing.
Data transmitted : The address being typed — neither the client's name nor the rest of their record.
When : On each keystroke in an address field. Manual entry without suggestions remains possible.
Annuaire des entreprises — France (public service)
Checking a company registration number and pre-filling a company record from the public register.
Data transmitted : The company number searched for.
When : During sign-up, and when you look up a company.
Open-Meteo — Germany (European Union)
Weather for the job in progress.
Data transmitted : The name of the TOWN of the job — never the full address, never the client's name.
When : On the day screen, when a job is scheduled.
Operating system and distribution
Apple — United States / Ireland
Distribution of the app on the App Store and delivery of notifications (APNs).
Data transmitted : Aggregated App Store download statistics, and — if you accept notifications — a device token that contains no personal data.
When : On download, and on each notification sent.
Artificial intelligence
Nexap calls on two model providers, for distinct purposes. In both cases, only the elements needed for the request at hand are transmitted, and only at the moment you trigger the feature. Nothing leaves in the background.
- Anthropic — the Nexa assistant, drafting service descriptions and reading photos of supplier documents. Receives the text of your request, the elements of the document concerned and the image you submit.
- OpenAI — voice dictation. The raw audio recording is transmitted for transcription, then the resulting text is analysed to produce a draft. That audio contains what you say: it may therefore include a client's name, address or requirement.
Both providers undertake, in the terms of their professional interfaces, not to use for training their models the content transmitted to them by this route.
What a model produces is an aid, not a truth. Generated amounts, calculations and texts are indicative and must be checked before being sent to a client or entered into accounts. This is also stated in the terms of use.
Retention periods
| Data | Kept |
|---|---|
| Account and business data | For as long as the account is active. Deleted with the account. |
| Documents sent for electronic signature | With the corresponding quote, including the audit trail. |
| Voice dictation recordings | Not kept: transcribed then discarded. Only the resulting text remains, inside your document. |
| Internal usage measurement | 13 months at most. |
| Support requests | 3 years from the last exchange. |
| IP address fingerprint from the support form | A non-reversible fingerprint, kept with the request. The address itself is never recorded. |
| Host's technical logs | According to the host's policy, a few days. |
Beyond these periods, data is erased. The rights of access, rectification, erasure and portability can no longer be exercised over erased data.
Transfers outside the European Union
Several providers are established in the United States: Supabase, Anthropic, OpenAI, Resend and Apple. These transfers are covered by the European Commission's standard contractual clauses, set out in the processing agreements concluded with each of them.
Your account data is stored in the Europe (European Union) region of the host's infrastructure.
Security
- Encryption in transit (TLS) on all communications, and at rest on the host's side.
- Per-account partitioning at the database level: a server-side rule checks, on every read and every write, that the row belongs to the account requesting it. One tradesperson cannot read another's data, even if the app has a bug. Stored files (job photos, logos) follow the same rule.
- Login by one-time code sent by e-mail: no password to remember, therefore no password to steal.
- Third-party service keys live server-side, inside functions. The app installed on your phone contains none of them.
In the event of a data breach likely to result in a risk to your rights, you will be informed, and the French supervisory authority within 72 hours, in accordance with Articles 33 and 34 of the GDPR.
Your rights
The GDPR gives you the following rights over your data:
- Access — know what is processed and obtain a copy.
- Rectification — correct what is inaccurate. Most of it is editable directly in the app.
- Erasure — delete your data. Available without writing to us, see below.
- Portability — retrieve a full archive in a machine-readable format, from within the app.
- Restriction and objection — object to processing based on legitimate interest, or ask for it to be frozen.
- Withdrawal of consent — at any time, for usage measurement, in Profile → Privacy.
To exercise these rights: support@nexap.fr. Answer within one month at most, free of charge. If you disagree with the outcome, you may lodge a complaint with the CNIL, the French supervisory authority.
Deleting your account
Deletion is inside the app, with no need to write to us or wait for an answer:
Profile → Privacy → Delete my account
It permanently erases your documents, your clients, your files and your login identifier. The operation is irreversible: export your archive first if you want to keep a copy.
Minors
Nexap is a professional tool intended for businesses. The service is not directed at minors and no data is knowingly collected from anyone under 15.
Cookies and trackers
The nexap.fr website sets no cookies — none for measurement, advertising or sessions. The only thing recorded in your browser is your light or dark theme choice, in local storage: it never leaves your device and is read by no one.
In the app, local technical storage keeps your login session and a copy of your data, so that Nexap works offline. It is necessary for the service and is not used for any tracking.
What is declared to Apple
Nexap's App Store listing declares the data collected, as Apple requires. That declaration matches exactly what is written here:
- Data linked to you: e-mail address (account identification), content you create (your documents), and technical identifiers.
- Data used to track you: none.
- Data not linked to you: none.
"Track" has the meaning Apple gives it: linking your data with data from other companies for advertising or data-broker purposes. Nexap does not do this, which is why the tracking permission prompt never appears.
Changes to this policy
This policy may change, in particular if a provider is added or removed. The date of last update appears at the top of the page. If a change affects processing based on your consent, that consent will be requested again.
Definitions
- Personal data — any information allowing a person to be identified, directly or by cross-referencing.
- Data controller — the one who decides why and how data is processed. Here: Nexap's publisher.
- Processor — the one who processes data on the controller's behalf, on its instructions. Here: the providers listed above.
- Tracker — any technique allowing someone to be followed: cookie, unique identifier, pixel, browser fingerprint.
- RGPD — European regulation 2016/679 on data protection.
Contact
For any question about this policy, or to exercise a right: support@nexap.fr.
An answer comes from a human — Nexap is run by one person.