GDPR & Global Privacy Rights

This page explains our compliance with the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss nFADP, Brazil's LGPD, India's DPDP Act, South Africa's POPIA, Canada's PIPEDA/CPPA, Australia's Privacy Act 1988, and other applicable data protection frameworks worldwide.

If you are a resident of any jurisdiction with data protection laws, the rights described here apply to you, adapted as required by your local law.

Nettulztech Corp. is the Data Controller for personal data processed through Nettulz AI™.

Contact: contact@nexanaviai.com

For EU/EEA users: If we are required by applicable law to appoint an EU representative, we will update this page accordingly.

We process personal data under the following legal bases:

• Art. 6(1)(a) — Consent: Cookie usage (analytics, preferences, marketing), marketing communications.
• Art. 6(1)(b) — Contract: Account creation, service delivery, subscription management.
• Art. 6(1)(c) — Legal Obligation: Tax, financial regulation, law enforcement requests.
• Art. 6(1)(f) — Legitimate Interests: Security monitoring, fraud prevention, service improvement. A Legitimate Interests Assessment (LIA) is on file and available upon request.

Nettulz AI's Health Awareness and Mental Support agents may receive user-volunteered information relating to health or mental wellbeing. We treat any such data as special category data under GDPR Art. 9 and process it solely to provide the service you requested (Art. 9(2)(a) — explicit consent). We do not use such data for profiling, model training without consent, or any secondary purpose.

As a data subject under GDPR (or equivalent laws), you have the rights listed in the sections below. All requests should be directed to contact@nexanaviai.com. We will respond within 30 days, extendable to 60 days for complex requests with notice.

We will not charge a fee for reasonable requests. If requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or refuse, with explanation.

You may request a complete copy of all personal data we hold about you, including the categories of data, the purposes of processing, third parties it has been shared with, and the planned retention period. Submit a Subject Access Request (SAR) to contact@nexanaviai.com.

If any personal data we hold about you is inaccurate or incomplete, you may request correction at any time — either through your Profile settings or by emailing us.

You may request deletion of all personal data we hold about you. We will delete your account, profile, conversations, goals, and action plans within 30 days. Exceptions apply where we are required to retain data by law (e.g. financial records for 7 years in many jurisdictions).

Note: Deletion is permanent and irreversible. Data used in anonymized, aggregated model training cannot be "deleted" as it no longer contains identifying information.

You may request your personal data in a structured, commonly used, machine-readable format (JSON). This right applies to data you provided to us and that we process by automated means on the basis of consent or contract.

You may request that we restrict processing of your data while: you contest its accuracy; processing is unlawful but you oppose erasure; we no longer need the data but you need it for legal claims; or you have objected to processing under Art. 21 and we are verifying whether legitimate grounds override.

You have the right to object to processing of your personal data where we rely on legitimate interests (Art. 6(1)(f)) or process data for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. AI-generated guidance is for your consideration only — all significant decisions remain with you.

If this changes, we will provide clear notice and an opt-out mechanism.

Where we rely on consent as a legal basis, you may withdraw your consent at any time without detriment by: adjusting cookie preferences via the cookie banner, deleting your account, or contacting us. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

We may transfer personal data to countries outside the EU/EEA. We use the following safeguards:

• European Commission Standard Contractual Clauses (SCCs) for EU → Third Country transfers.
• UK International Data Transfer Agreement (IDTA) for UK users.
• Adequacy decisions where applicable.
• Binding Corporate Rules (BCRs) where available with our processors.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware (GDPR Art. 33). Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay (GDPR Art. 34).

Email: contact@nexanaviai.com with subject line "Data Rights Request".

Include: your name, email address, the specific right you are exercising, and any relevant details. We may ask you to verify your identity before processing the request.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority:

• EU: Your national Data Protection Authority — edpb.europa.eu
• UK: Information Commissioner's Office (ICO) — ico.org.uk
• Brazil: ANPD — gov.br/anpd
• Australia: OAIC — oaic.gov.au
• Canada: OPC — priv.gc.ca
• South Africa: Information Regulator — justice.gov.za/inforeg