Nexa Mobile App Privacy Policy

FRAMECAD Limited ("FRAMECAD", "we", "our" or "us") is committed to protecting the privacy and security of Personal Information and your data processed through the FRAMECAD Nexa mobile applications, the Nexa platform, related web portals, integrations and FRAMECAD cloud services (together, "Nexa") in accordance with the terms of this Privacy Policy and applicable law. Capitalised terms used in this Privacy Policy have the meanings given in the body of the Privacy Policy and in Section 19 (Definitions).

This Privacy Policy explains what information we collect, how we use it, how we protect it, when it may be shared, where it may be processed, and the choices and rights available to you.

This Privacy Policy applies to Customers and their Authorised Users. The terms "you" and "your" and “user” mean a Customer or an Authorised User, as the context requires, and, where the context requires, any other individual whose Personal Information we process through Nexa.

Nexa is intended for business and professional use only It is not intended for personal, household, or consumer use.

2. Scope

This Privacy Policy applies to information collected or processed through Nexa, including information collected through the Nexa Android App, Nexa iOS App, related web portals, integrations, cloud services, support channels, licensing services, analytics, diagnostics, security monitoring, push notification services and product improvement activities.

This Privacy Policy should be read together with any applicable Customer agreement,  Software License Agreement, Terms & Conditions, cloud services terms, order form, support terms, data processing addendum, or other contractual terms agreed between FRAMECAD and the Customer.

FRAMECAD publishes other privacy policies and notices in connection with its other websites, products, and services, including the general privacy policy published on FRAMECAD's corporate website. This Privacy Policy applies specifically to Nexa as described in this Section 2. If there is any inconsistency between this Privacy Policy and any other privacy policy published by FRAMECAD in relation to the collection, use, or disclosure of information through Nexa, this Privacy Policy will prevail to the extent of that inconsistency. For matters not addressed in this Privacy Policy (for example, information collected through FRAMECAD's general corporate website, marketing activities not related to Nexa, or other FRAMECAD products and services that do not form part of Nexa), the privacy policy applicable to that website, activity, or product will apply.

3. Information We Collect

3.1 Account and Contact Information

When a Customer or Authorised User creates, accesses, or uses a Nexa account, we may collect information such as:

• Email address
• Account identifiers, including company or organisation name
• User details, including first name, last name, job title, and contact information
• Authentication and access information, including identity provider information where applicable

Where a Customer or an Authorised User's employing organisation creates a Nexa account on behalf of an Authorised User, FRAMECAD collects that Authorised User's Personal Information indirectly (that is, from a source other than the individual concerned). In these circumstances, FRAMECAD will take reasonable steps to ensure the Authorised User is notified of this by either referring the Authorised User to this Privacy Notice (which constitutes notice to the Authorised User) — or, for example, by in-app or email notice at first login, or through the Customer — of the fact of collection, its purpose, the intended recipients, FRAMECAD's identity and contact details, and the Authorised User's rights of access and correction.

3.2 Device, App and Technical Information

We may collect technical information about the devices, systems and app environment used to access Nexa, including:

• Device type, operating system, and system architecture
• Mobile platform and related app configuration(s)
• Device identifiers (brand, model)
• App instance identifiers (Nexa application version)
• Licensing identifiers
• IP address and network information
• Location information, where permission has been granted, in connection with status updates recorded against project items (see below for further detail)
• Software serial number, version, license key, or other licensing identity details
• Crash reports, diagnostic logs, real-user monitoring events, traces, performance information, and WebView monitoring information where applicable.
  
  

3.3 Location Information

Where, in connection with you accessing or using Nexa, you have granted us permission to access your device's location, we may collect location information in connection with status updates you record against project items, including any supporting photographic evidence. Depending on the permission you grant, this information may be precise or approximate.

We use this information to associate a record of where a status update was made with that update, supporting traceability and verification of project activity.

3.4 Usage and Activity Information

We may collect information about how Nexa is used, including:

• Features and functions used
• Activity times, session duration, and interaction history
• Trial or full license status
• Software or subscription expiry status
• Support ticket activity and product feedback
• Error events, reliability events, performance events, and security events
  
  

3.5 Customer Project Data

Nexa may allow Customers and Authorised Users to upload, enter, generate, store, process or transmit Customer Project Data. Depending on the Customer’s use of Nexa, this may include:

• Project information, project names, addresses, or other site information
• Building designs, drawings, models, specifications, calculations, and engineering information
• Manufacturing information, production information, machine data, and operational data
• Material lists, job information, production outputs, and quality information
• Uploaded documents, photographs, screenshots, reports, and notes, including quality-control submissions such as photographs, signatures, and notes, and status update images
• User-generated content and Customer communications within Nexa
• Metadata associated with the above information

Customer Project Data may include Personal Information if the Customer or Authorised User includes Personal Information in project names, files, notes, images, documents, metadata, or other content uploaded to or generated within Nexa.

3.6 Mobile Permissions and Platform Data

Depending on the features enabled in Nexa and the permissions granted by the user, the Android or iOS app may request access to device capabilities such as camera, photos, files, notifications, location, storage, or similar permissions. FRAMECAD will use such permissions only for the purposes described in the app, this Privacy Policy, the applicable app-store disclosures, or the applicable Customer agreement.

Push notifications may be delivered using Google Firebase Cloud Messaging or similar platform notification services. Notification tokens or app instance identifiers may be processed for the purpose of delivering messages and managing notification delivery.

4. How We Use Information

FRAMECAD may use information collected or processed through Nexa for the following purposes:

• To provide, operate, maintain, and improve Nexa
• To authenticate users and manage accounts, licenses, and subscriptions
• To provide Customer support, updates, patches, fixes, and technical assistance
• To deliver push notifications and service communications where enabled
• To monitor app performance, reliability, security, and usage
• To diagnose defects, errors, crashes, and service issues
• To collect logs, traces, real-user monitoring events and diagnostic data for troubleshooting, and service improvement
• To detect, prevent and respond to unauthorised use, misuse, security incidents, or license breaches
• To improve user experience, product quality, and service reliability
• To meet contractual, legal, regulatory, accounting, audit, and compliance obligations
• To develop new features, products, services, analytics, predictive insights, and manufacturing capabilities
  
  

5. Customer Project Data, Predictive Insights and Manufacturing Models

Customer Project Data remains owned by the Customer or the party that provided it, subject to any applicable Customer agreement. FRAMECAD does not claim ownership of Customer Project Data merely because it is processed through Nexa.

Subject to applicable law, contractual obligations, and Customer permissions, FRAMECAD may access, process, and use Customer project data, operational data, manufacturing data, product usage data, and associated metadata for the following purposes:

• Providing, operating, securing, and supporting Nexa
• Investigating incidents, defects, safety, performance, or reliability issues
• Validating software behaviour, manufacturing outputs, and production workflows
• Developing, testing, validating, and improving predictive insights, recommendations, and analytics
• Improving manufacturing optimisation, production quality, and operational efficiency
• Developing, training, testing, validating, and improving engineering, construction, manufacturing, and operational models
• Creating aggregated, statistical, or de-identified datasets, benchmarks, and insights
• Improving existing FRAMECAD products and services and developing new products and services

Where feasible and appropriate, FRAMECAD will use aggregated, de-identified or anonymised information for analytics, research, predictive insight development, and model development activities. However, development, validation, support, troubleshooting, or security activities may require access to identifiable Customer Project Data or associated user information.

FRAMECAD will not knowingly disclose Customer-specific project data to other Customers except with the Customer’s consent, as required to provide the service, as required by law, or as otherwise permitted under an applicable agreement.

6. Artificial Intelligence, Machine Learning and Analytics

Nexa may include or support analytics, automation, artificial intelligence, machine learning, predictive insight, and manufacturing intelligence features. To support these capabilities, FRAMECAD may process Customer project data, manufacturing information, production outcomes, usage information, diagnostic information, and system performance information.

These activities may be used to:

• Train, test, validate, and improve predictive models
• Develop manufacturing optimisation algorithms
• Improve design-to-manufacture workflows
• Improve production quality, reliability, and operational efficiency
• Identify trends, benchmark performance, and generate aggregated insights
• Improve the safety, reliability, and performance of FRAMECAD products and services

FRAMECAD may combine information from multiple users to create aggregated or de-identified datasets, insights, models, and benchmarks. Unless authorised by the applicable user or permitted by law or contract, FRAMECAD will not publish user-identifiable project data as part of these activities.

7. Third-Party Services, SDKs, and Sub-processors

Nexa may use third-party services and SDKs to operate app functionality, deliver notifications, monitor reliability, diagnose issues, analyse performance, and support Customers. These services may process Personal Information, device information, diagnostic data, usage data, logs, or Customer Project Data depending on how Nexa is configured and used.

 

FRAMECAD will take reasonable steps to ensure third-party services process information in accordance with applicable contractual, privacy and security requirements. If integrated SDKs or services change, FRAMECAD will review and update the relevant app-store disclosures and this Privacy Policy where required.

8. How We Share Information

FRAMECAD may share information with:

• FRAMECAD Affiliates
• Cloud hosting and infrastructure providers
• Identity, authentication, and access management providers
• Mobile platform service providers where required for app distribution, diagnostics, crash reporting, notifications, or app functionality
• Analytics, monitoring, crash reporting, logging, tracing, and diagnostic service providers, including Datadog where implemented
• Push notification providers, including Google Firebase Cloud Messaging where implemented
• Customer support, service management, and communications providers
• Professional advisers, auditors, insurers, and legal advisers
• Regulators, law enforcement agencies, courts, or other authorities where required or permitted by law
• A purchaser, successor, or assignee in connection with a business transfer, merger, restructuring, or sale of assets

FRAMECAD does not sell Personal Information. FRAMECAD does not disclose Customer Project Data to other Customers for their independent use unless authorised by the Customer or otherwise permitted by agreement or law.

9. Cloud Hosting and International Processing

Nexa is a cloud-connected service. Personal information and Customer Project Data may be stored, accessed, backed up, transferred or otherwise processed in New Zealand and in other countries where FRAMECAD, its Affiliates or its service providers operate systems, cloud infrastructure, support services, or business operations.

These countries may include jurisdictions that do not provide the same level of data protection as the Customer’s home country. Where required, FRAMECAD will take reasonable steps designed to protect information transferred internationally, including through contractual, technical, and organisational safeguards.

Before disclosing Personal Information to a person or entity outside New Zealand, FRAMECAD will take reasonable steps to ensure that the overseas recipient is either subject to privacy laws providing comparable safeguards to the Privacy Act, bound by a contract requiring it to protect the information to a comparable standard (for example, standard contractual clauses), or that another exception under Information Privacy Principle 12 of the Privacy Act applies.

The Nexa mobile apps store, access, and process information in the US3 site for observability and AWS US-WEST-2 for cloud infrastructure.

10. Apple App Store and Google Play Disclosures

FRAMECAD may publish app-store privacy disclosures for Nexa through Google Play Console and Apple App Store Connect. These app-store disclosures are intended to summarise selected aspects of this Privacy Policy in the format required by each platform.

For Google Play, FRAMECAD will complete the Data Safety section in Play Console based on the data collected, shared, and protected by Nexa, including data collected or managed through third-party libraries or SDKs used by the app.

For Apple platforms, FRAMECAD will provide App Privacy information in App Store Connect, including data collected by Nexa or third-party code integrated into Nexa, whether data is linked to the user, and whether data is used to track users. The iOS app codebase should include a valid PrivacyInfo.xcprivacy manifest reflecting the app and relevant SDK behaviour.

If the actual data practices, SDKs, permissions, or app features change, FRAMECAD will review this Privacy Policy and the applicable app-store privacy disclosures and update them where required.

11. Tracking, Advertising and Cross-App Use

Nexa is intended as a business application. Nexa does not use IDFA, Apple's App Tracking Transparency framework, or AdSupport, and does not track users across third-party apps or websites for targeted advertising. The iOS app's PrivacyInfo.xcprivacy manifest declares NSPrivacyTracking as false.

If FRAMECAD introduces functionality or third-party services that constitute tracking under Apple or Google app-store requirements, FRAMECAD will update the relevant app-store disclosures and obtain any required user permissions before using that functionality.

12. Security

FRAMECAD uses reasonable technical and organisational safeguards designed to protect Personal Information and Customer Project Data against unauthorised access, loss, misuse, disclosure, alteration, or destruction. These safeguards may include:

• Encryption in transit
• Encryption at rest where supported by the relevant service or storage environment
• Role-based access control
• Authentication and account access controls
• Administrative access controls and internal access limitations
• Logging, monitoring, and security review processes
• Segregation of Customer data where supported by the architecture
• Backup and recovery controls

No service or method of transmission or storage is completely secure. Users are responsible for maintaining the confidentiality of their account credentials and for ensuring that only Authorised Users access Nexa.

13. Customer Responsibilities

Customers are responsible for:

• Ensuring they have the necessary rights, permissions and consents to upload, process and share Customer Project Data through Nexa
• Ensuring that Personal Information included in project data is accurate, lawful, and appropriate for processing through Nexa
• Managing Authorised Users and removing access when it is no longer required
• Using Nexa in accordance with applicable laws, Customer agreements, and FRAMECAD terms
• Complying with any privacy, employment, construction, engineering, building, data protection, or confidentiality obligations that apply to their own data and users
  
  

14. Data Retention and Deletion

FRAMECAD retains Personal Information and Customer Project Data for as long as reasonably necessary to provide Nexa, support Customers, maintain business records, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and improve FRAMECAD products and services.

Retention periods may vary depending on the type of data, Customer agreement, account status, support needs, legal requirements, and backup processes. Deleted information may remain in backups, logs, or archival systems for a limited period before being deleted or overwritten according to applicable retention practices.

Customers may request deletion or return of Customer Project Data subject to applicable agreements, legal requirements, technical limitations, backup retention, and legitimate business purposes.

15. User Rights and Choices

Subject to applicable law, users may have rights to request access to, correction of, deletion of, restriction of processing of, or export of Personal Information. Users may also have rights to object to certain processing or withdraw consent where processing is based on consent.

Where a user accesses Nexa through a Customer organisation, FRAMECAD may direct the user to contact that organisation first, as the Customer may control the relevant account or project data.

Nexa accounts are created and managed by FRAMECAD or by the user's employing organisation; users cannot self-register within the app. To request deletion of an account and associated data, contact FRAMECAD. FRAMECAD will confirm receipt and action the request in line with the retention periods in Section 14. Records — including status history, quality-control submissions, and photo evidence forming part of a Customer's project audit trail — may be retained by the Customer organisation as the data controller, in which case the request will be directed to that organisation.

Privacy requests may be submitted using the contact details below. If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner — see Section 18 (Legal Compliance).

16. Children’s Privacy

Nexa is intended for business and professional users only and is not intended for use by Children (as defined in Section 19). FRAMECAD does not knowingly collect Personal Information from Children through Nexa. If FRAMECAD becomes aware that it has inadvertently collected Personal Information from a Child, FRAMECAD will take reasonable steps to delete that information as soon as reasonably practicable, unless retention of that information is required by law.

17. Changes to This Privacy Policy

FRAMECAD may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users, such as by posting an updated policy, providing in-app notice, or communicating through Customer channels.

18. Legal Compliance

FRAMECAD is committed to complying with the Privacy Act, including the 13 information privacy principles (IPPs) set out in that Act, which govern how FRAMECAD collects, holds, uses, discloses, and secures Personal Information. In particular, and without limiting FRAMECAD's obligations under the Privacy Act more generally:

• Where FRAMECAD collects Personal Information indirectly (that is, from a source other than the individual concerned), FRAMECAD will comply with Information Privacy Principle 3A, including by giving notice of the collection where required (see Section 3.1).
• Where FRAMECAD discloses Personal Information to a person or entity outside New Zealand, FRAMECAD will comply with Information Privacy Principle 12 (see Section 9).
• If FRAMECAD experiences a privacy breach that has caused, or is likely to cause, serious harm to an affected individual (a notifiable privacy breach), FRAMECAD will notify the Office of the Privacy Commissioner and the affected individual(s) as soon as practicable, in accordance with Part 6 of the Privacy Act.
• If you have a concern about how FRAMECAD has handled your Personal Information that cannot be resolved by contacting FRAMECAD under Section 20 (Contact Us), you may make a complaint to the Office of the Privacy Commissioner (www.privacy.org.nz).

Depending on where a Customer, Authorised User, or other individual is located, and where Nexa is offered or used, other laws may also apply to FRAMECAD's processing of Personal Information. FRAMECAD will comply with these laws to the extent they apply to FRAMECAD's processing of Personal Information through Nexa.

19. Definitions

Capitalised terms used in this Privacy Policy have the meanings set out below, whether or not capitalised where they are used elsewhere in this Privacy Policy. “FRAMECAD” and “Nexa” are defined in Section 1 (Introduction).

• “Affiliate” means, in relation to FRAMECAD Limited, any entity that directly or indirectly controls, is controlled by, or is under common control with FRAMECAD Limited, including any related company (as defined in the Companies Act 1993).
• “Authorised User” means an individual who has been granted access to Nexa by, or on behalf of, a Customer.
• “Children” means individuals under the age of 18 years, and “Child” has the equivalent meaning.
• “Customer” means the organisation that has entered into an agreement with FRAMECAD for the provision of Nexa.
• “Customer Project Data” has the meaning given in Section 3.5.
• “Personal Information” means information about an identifiable individual, as defined in section 7 of the Privacy Act.
• “Privacy Act” means the Privacy Act 2020 (New Zealand), as amended from time to time, and includes any regulations, codes of practice, or successor legislation.

20. Contact Us

If you have questions about this Privacy Policy or how FRAMECAD manages Personal Information or Customer project data, please contact:

FRAMECAD Limited
Level 4, Building 730, 261 Morrin Road
St Johns, Auckland 1072
New Zealand
Email: privacy@framecad.com

 

This Privacy Policy was last updated on: 21 August 2026.