Privacy Policy

We update this policy from time to time. When there is a significant change to this policy, we will notify you via the email address you have provided to us.

When we refer to “we” (or “our” or “us”), that means Nexza, Inc. (doing business as Ruddr). We provide a platform that helps small to midsize professional services firms operate their business.

Our approach to data protection is built around the following principles.

When you visit our websites or use our services, we collect personal data. The ways we collect it can be broadly categorized into the following:

Information you provide to us directly: When you visit or use some parts of our websites and/or services we might ask you to provide personal data to us. For example, we ask for your contact information when you sign up for a free trial, take part in training and events, contact us with questions or request support. If you don’t want to provide us with personal data, you don’t have to, but it might mean you can’t use some parts of our websites or services.

Information we collect automatically: We collect some information about you automatically when you visit our websites or use our services, like your IP address and device type. We also collect information when you navigate through our websites and services, including what pages you looked at and what links you clicked on. This information is useful for us as it helps us get a better understanding of how you’re using our websites and services so that we can continue to provide the best experience possible. Some of this information is collected using cookies and similar tracking technologies.

Where we collect personal data, we’ll only process it:

If we don’t collect your personal data, we may be unable to provide you with all our services, and some functions and features on our websites may not be available to you.

First and foremost, we use your personal data to operate our websites and provide you with any services you’ve requested, and to manage our relationship with you. We also use your personal data for other purposes, which may include the following:

Information exchanged through Connected Applications is subject to the specific use restrictions described in the Connected Applications section, including the restrictions on advertising and AI model training.

There will be times when we need to share your personal data with third parties. We will only disclose your personal data to:

Security is a priority for us when it comes to your personal data. We’re committed to protecting your personal data and have appropriate technical and organizational measures in place to make sure that happens.

The length of time we keep your personal data depends on what it is and whether we have an ongoing business need to retain it (for example, to provide you with a service you’ve requested or to comply with applicable legal, tax or accounting requirements). This includes data processed by AI features, such as user prompts and generated outputs.

We’ll retain your personal data for as long as we have a relationship with you and for a period of time afterwards where we have an ongoing business need to retain it, in accordance with our data retention policies and practices.

For information exchanged through Connected Applications, including authorization token validity, request logging, and the effects of disconnecting an application, see the Connected Applications section. The specific retention practices described there govern that processing.

If you are from the European Economic Area (EEA), our legal basis for collecting and using the personal information described in this Privacy Policy depends on the personal data we collect and the specific context in which we collect it.

We may process your personal data because:

Nexza, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.  Nexza, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Nexza, Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit: https://www.dataprivacyframework.gov/

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Nexza, Inc. commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

Nexza, Inc. is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). Under certain conditions, you may invoke binding arbitration. Nexza, Inc. is obligated to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to us and following the procedures and subject to conditions set forth in Annex I of Principles.

Nexza, Inc. is required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Nexza, Inc. remains responsible for any of your personal information that is shared under the Onward Transfer Principle with third parties for external processing on our behalf.

Your personal information may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that are different to the laws of your country, and in some cases, may not be as protective. Specifically, our website servers are primarily located in the U.S. and we may process your personal information in jurisdictions where our affiliates, partners and third-party service providers are located. However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Policy. These safeguards include implementing applicable data transfer mechanisms, such as the E.U. standard contractual clauses, or other lawful mechanisms for transfers of personal information in accordance with applicable data protection law. We have self-certified compliance with the EU-U.S. Data Privacy Framework, the UK extension to the EU-U.S. Data Privacy Framework, and the Swiss-US Data Privacy Framework as set forth by the U.S. Department of Commerce with respect to personal information relating to individuals from the EEA, UK, and Switzerland. Please see our Data Privacy Framework Notice to learn more.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your personal data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

We do not support Do Not Track. Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked.

You can enable or disable Do Not Track by visiting the Preferences or Settings page of your web browser.

If you are a resident of the European Economic Area, you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal data.

If you wish to be informed what personal data we hold about you and if you want it to be removed from our systems, please contact us.

In certain circumstances, you have the following data protection rights:

Please note that we may ask you to verify your identity before responding to such requests.

You have the right to complain to a Data Protection Authority about our collection and use of your personal data. For more information, please contact your local data protection authority in the European Economic Area.

We use certain sub-processors to assist in providing our services. A sub-processor is a third party data processor engaged by us who agrees to receive personal data intended for processing activities to be carried out (i) on behalf of our customers; (ii) in accordance with customer instructions as communicated by us; and (iii) in accordance with the terms of a written contract between us and the sub-processor.

We maintain an up-to-date list of the names and locations of all sub-processors on our trust site at: https://trust.ruddr.com/subprocessors

If you believe that we have infringed applicable data protection laws in relation to your personal information, you may submit a data protection complaint directly to us.

You may submit a complaint by:

We will acknowledge receipt of your complaint within 30 days and will investigate and respond without undue delay.

We will keep you informed of the progress of your complaint and notify you of the outcome once our investigation is complete.

If you are dissatisfied with our response, you may lodge a complaint with the UK Information Commissioner's Office (ICO).

We use artificial intelligence (“AI”) technologies, including machine learning models and large language models, to provide certain features within our services, including an “AI Assistant” and Agents. Our AI Assistant can:

Ruddr does not use customer workspace data, user prompts, or generated outputs to train or improve its own or third-party AI models. For third-party applications that users connect to Ruddr, the application provider’s own processing is described in the Connected Applications section below.

Ruddr's AI functionality may process:

The AI functionality may also generate new content or insights based on this data.

The AI Assistant provides recommendations and generated outputs that may assist decision-making. These outputs are not intended to replace human judgment. Users remain responsible for reviewing and validating AI-generated content.

Depending on your account settings and workspace permissions, you may:

You may choose to connect your Ruddr account to third-party applications, including AI services such as ChatGPT or Claude (“Connected Applications”). Connecting an application authorizes Ruddr to exchange information with that application to carry out your requests, subject to your Ruddr workspace permissions and the permissions granted to the connection.

Information we receive. Ruddr receives the inputs submitted when a Connected Application invokes a Ruddr tool, together with authentication information needed to authorize the request. Tool inputs may include search terms, record identifiers, date ranges, and other information needed to perform the requested task. Ruddr does not receive automatic access to your full conversation history. However, a tool input may contain information from your conversation that the Connected Application includes to carry out your request.

Information we return. Ruddr returns information relevant to the requested task, which may include personal data and client, project, time, expense, financial, or other workspace information. Each request is subject to Ruddr’s access controls. A Connected Application cannot obtain information through your connection that you are not authorized to access in Ruddr.

How we use this information. We process information exchanged through Connected Applications to authenticate and authorize access, carry out your requests, and secure and troubleshoot the service. We do not use this information for advertising, ad targeting, or training or improving our own or third-party AI models. These restrictions apply notwithstanding broader descriptions of data use elsewhere in this policy.

Third-party providers. When you use a Connected Application, you direct Ruddr to disclose the information needed to fulfill your request to that application’s provider, such as OpenAI. That provider processes information it receives under its own applicable terms, privacy policy, and your account or workspace settings. The provider’s retention and model-training practices may differ from Ruddr’s practices described here.

Retention and disconnection. Authorization tokens have validity periods ranging from one hour to 30 days, depending on the token type. You can disconnect an application at any time through Connected Apps in Ruddr. Disconnecting immediately revokes the connection’s authorization tokens and prevents further access through that connection.

Ruddr does not store the content of Connected Application requests or responses as part of normal operation. We keep limited security and diagnostic logs, including IP address, timestamps, request path, response status and user agent. When a request fails, we also keep an error report, which may include the request details and tool inputs, so we can investigate the problem. These logs are kept for up to 30 days. We keep a record of each connection (the application, the member who authorized it, and when it was created, last used and revoked) until the member or workspace is deleted.  Records already stored in Ruddr, and records you create or update through a Connected Application, remain subject to the retention practices applicable to those records. Disconnecting does not delete your Ruddr workspace data or information already received by the Connected Application’s provider.

For questions about this processing or to exercise your applicable privacy rights, contact privacy@ruddr.io.

We may provide paid products and/or services within the service. In that case, we use third-party services for payment processing (e.g. payment processors).

We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

Our payment processor is Stripe, Inc. Their Privacy Policy can be viewed at https://stripe.com/us/privacy.

Our service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Our service does not address anyone under the age of 18 ("children").

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

It’s your personal data and you have certain rights relating to it. When it comes to marketing communications, you can ask us not to send you these at any time – just follow the unsubscribe instructions contained in the marketing communication.

You also have rights to:

You can exercise these rights at any time.

If you’re not happy with how we are processing your personal data, please let us know by getting in touch with us via email. We will review and investigate your complaint, and try to get back to you within a reasonable time frame. You can also complain to your local data protection authority. They will be able to advise you how to submit a complaint.

This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act, as amended (CCPA).

Subject to applicable law, you have the following rights with respect to your personal information.

If you or your authorized agent wishes to exercise any of these rights, please contact us via the information provided at the bottom of this Privacy Policy. Please note that we may ask you or your agent to provide us with additional information to confirm your identity.

The personal information that we’ve collected in the past 12 months falls into the following categories specifically established under the CCPA:

The personal information that we’ve disclosed for a business purpose (including to our service providers) in the past 12 months falls into the following categories specifically established under the CCPA:

For more information about the recipients of personal information and the purposes of disclosure, please see the “How we can share your data” and “Connected Applications” sections above.

We do not sell or share (for the purpose of cross-context behavioral advertising) your personal information, as those terms are defined under the CCPA.

This section provides additional information for residents of Virginia and the rights afforded to them under the Virginia Consumer Data Protection Act (VCDPA).

Subject to applicable law, you have the following rights with respect to your personal information.

To exercise your rights, please contact us via the information provided at the bottom of this Privacy Policy. Please note that we may ask you to provide us with additional information to confirm your identity.

If you submit a request to exercise one of the above rights and you disagree with our decision regarding your request, you may appeal our decision by replying to our response.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). To make use of your data subject rights or to view our EU or UK certificate of representation, you can contact our representative, Prighter, via the following link or by clicking on the image below: https://prighter.com/q/13590678575

For privacy or data protection inquiries, please contact us via email at privacy@ruddr.io.

For all other purposes, please contact us via email at legal@ruddr.io.

Last updated: October 21, 2026