Privacy Policy

Last updated: January 1, 2026

1. Introduction

NexaDial ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard information when you use the NexaDial cloud PBX platform.

By using the Platform, you agree to the collection and use of information in accordance with this Policy.

2. Information We Collect

We collect information that you provide directly and information generated through your use of the Platform:

Category	Examples	Purpose
Account Data	Name, email address, hashed password, role	Authentication and account management
Call Data	Caller/called numbers, duration, status, timestamps, cost	Call logging, billing, analytics
Call Recordings	Audio recordings of calls (when enabled)	Quality assurance, compliance, training
SIP Credentials	SIP usernames, encrypted passwords	Extension authentication with VoIP provider
Configuration Data	Settings, ring group config, number routing	Platform operation
Usage Data	Login times, IP addresses, session tokens	Security, fraud prevention, rate limiting
Billing Data	Balance, transaction history, call costs	Billing management and financial records

3. How We Use Your Information

We use the information collected for the following purposes:

• Platform operation: Routing calls, managing extensions, processing ring groups
• Billing: Calculating per-minute charges and deducting from account balance
• Security: Detecting fraud, preventing abuse, enforcing rate limits and session management
• Analytics: Generating call logs, dashboards and usage reports visible to authorised administrators
• Compliance: Maintaining records as required by applicable law
• Customer support: Investigating and resolving technical issues

4. Call Recording

Call recording is an optional feature that can be enabled per extension or ring group. When enabled:

• Audio recordings are stored and accessible through the call logs interface
• Recordings are associated with the call record including date, time, and participants
• Access to recordings is restricted to authorised users with the appropriate permission
• You are solely responsible for ensuring all parties consent to recording as required by applicable law in your jurisdiction

5. Third-Party Services

The Platform integrates with the following third-party services to provide telephony functionality:

• our VoIP carrier: VoIP carrier services, SIP infrastructure and number provisioning. Call data passes through our VoIP carrier in accordance with their Privacy Policy

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

6. Data Retention

We retain data for the following periods unless you request deletion or applicable law requires otherwise:

• Call logs: Retained for as long as your account is active
• Call recordings: Retained until manually deleted or account closure
• Account data: Retained for the duration of account activity plus 90 days
• Billing records: Retained for 7 years for financial compliance purposes
• Security logs: Retained for 90 days

7. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Passwords stored using bcrypt hashing (never in plain text)
• CSRF token protection on all form submissions
• Rate limiting on login and password reset endpoints
• Session revocation on password change
• Two-factor authentication (2FA) support for user accounts
• HTTPS/TLS encryption for data in transit
• Webhook signature verification for inbound VoIP events

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Access Controls

The Platform uses a role-based access control system:

• Superadmin: Full platform access including all tenant data
• Admin: Full access within their tenant
• User: Restricted access based on permissions granted by admin

Each user can only access data belonging to their assigned tenant. Tenant data is fully isolated.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request your data in a portable format (call logs are exportable as CSV)
• Objection: Object to certain processing of your personal data

To exercise any of these rights, contact us at privacy@nexadial.com.

10. Cookies and Sessions

The Platform uses session cookies to maintain your authenticated state. These are:

• Essential cookies required for Platform operation
• Not used for advertising or cross-site tracking
• Automatically deleted when you log out or close your browser

No third-party analytics or advertising cookies are used on the Platform.

11. Children's Privacy

The Platform is intended for business use only and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. We encourage you to review this Policy periodically.

13. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: privacy@nexadial.com
• Contact form: nexadial.com/contact