Privacy Policy

1. Who is responsible

NXO Group Private Limited (“NXO”, “Tez”, “we”, “us”, or “our”) operates Tez from 2nd Floor, Core 1, PACIFICA TECH PARK, Rajiv Gandhi Salai, Navalur, Chennai, Tamil Nadu 600130, India.

We act as the data controller or data fiduciary for information used to operate our website, accounts, subscriptions, security, support, and business. For Customer Content placed in a Tez workspace, the customer organization generally decides why and how that information is used, and we process it on the organization’s instructions as its processor or service provider.

2. Scope

This Policy applies when you visit tezworks.com, create or use a Tez account, use the Tez Vault browser extension, join a workspace, contact us, receive communications, connect an integration, or interact with billing and support. It does not govern a third-party service or a customer organization’s independent handling of personal information.

3. Information we collect

Depending on how Tez is used, we may collect:

• Account and profile information: name, business email, password hash, optional phone number, profile details, company, workspace membership, role, and permissions.
• Customer Content: projects, tasks, requests, approvals, chat messages, comments, notes, goals, forms, files, attachments, custom fields, and related activity.
• Billing information: plan, paid-seat quantity, subscription status, transaction and invoice references, billing contact, tax identifiers, and payment status supplied by Paddle. We do not receive or store full payment-card numbers.
• Device, usage, and security information: IP address, browser and device type, operating system, pages and features used, dates and times, session information, audit events, error records, and security signals.
• Support and communications: messages, requests, feedback, and information included when you contact sales, support, billing, legal, or privacy teams.
• Integration information: identifiers, configuration, and content made available when an authorized administrator connects a third-party service.

4. Where information comes from

We receive information directly from you; from your organization and other authorized workspace users; automatically from your browser or device; from integrations you choose to connect; and from service providers such as Paddle that support billing and account administration.

5. How and why we use information

We use personal information to:

• create accounts and provide projects, tasks, requests, approvals, chat, notes, goals, reporting, files, and related workspace functions;
• authenticate users, maintain roles and permissions, prevent abuse, investigate incidents, and secure Tez;
• administer plans, paid seats, subscriptions, invoices, renewals, cancellations, and refunds;
• send service, account, security, billing, invitation, and notification messages;
• provide support, diagnose errors, maintain reliability, and improve usability and performance;
• comply with legal obligations, enforce agreements, establish or defend claims, and protect rights and safety; and
• send marketing communications where permitted, with an unsubscribe option.

6. Legal grounds

Depending on your location and our role, we process information because it is necessary to perform a contract or take requested steps before a contract; for legitimate interests such as operating, securing, supporting, and improving Tez; to comply with law; with consent where required; or to establish, exercise, or defend legal claims.

Where a customer organization controls Customer Content, that organization is responsible for its legal basis, notices, and instructions. If we rely on consent, you may withdraw it without affecting earlier lawful processing.

7. Cookies and device storage

Tez uses essential cookies and similar browser storage for sign-in, session security, active-workspace selection, appearance and interface preferences, and recently used functions. These are necessary to provide the requested service.

We do not use personal information for third-party behavioural advertising and do not sell personal information. If we introduce optional analytics or advertising cookies, we will update this Policy and request consent where required.

8. How we share information

We may share information only as reasonably necessary with:

• authorized members and administrators of the relevant company or workspace;
• service providers supporting cloud hosting, databases, file storage, email delivery, security, monitoring, customer support, and business operations;
• Paddle for checkout, subscription administration, tax, invoicing, fraud prevention, cancellation, and refunds;
• third-party services that an authorized user chooses to connect;
• professional advisers, auditors, insurers, and financing parties under appropriate confidentiality duties;
• government authorities, courts, or others when required by law or necessary to protect rights, safety, and security; and
• a buyer, investor, successor, or affiliate in a merger, financing, reorganization, or sale, subject to appropriate safeguards.

We do not sell Customer Content or personal information.

9. International transfers

Tez and its service providers may process information in India and other countries where they operate. Those countries may have different data-protection laws. Where required, we use appropriate safeguards such as contractual protections, transfer assessments, approved standard contractual clauses, or another lawful transfer mechanism.

10. Retention and deletion

We keep account information and Customer Content while the relevant account or workspace is active and for a reasonable period afterward to support authorized export, recovery, security, dispute resolution, and account closure. Security, audit, support, billing, tax, and transaction records may be kept longer where needed for legitimate business records or required by law.

When information is no longer required, we delete it, anonymize it, or isolate it until deletion is possible. Backup copies are removed through normal backup rotation. Legal holds, fraud prevention, unresolved disputes, and mandatory recordkeeping may delay deletion. Retention criteria include the nature of the data, account status, customer instructions, security needs, limitation periods, and applicable tax and legal requirements.

11. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, tenant and workspace permissions, encryption in transit, credential protection, logging, backups, and incident-response practices. No system can guarantee absolute security. Customers must use appropriate permissions, protect credentials, and promptly report suspected incidents to support@tezworks.com.

12. Your choices and rights

Subject to applicable law, you may have rights to obtain information about processing; access, correct, update, complete, delete, or receive a copy of personal information; restrict or object to processing; withdraw consent; opt out of marketing; and raise a grievance or complaint with a regulator.

For Customer Content controlled by your organization, submit the request to the organization’s administrator first. We will assist the organization where required. For information controlled by NXO, email privacy@tezworks.com. We may verify identity and authority before acting and may retain information where an exception or legal obligation applies.

13. India privacy rights and grievances

Individuals covered by India’s Digital Personal Data Protection framework may request information about processing, correction, completion, updating, or erasure of personal data, withdraw consent where applicable, nominate another person as permitted by law, and use our grievance process.

Send a grievance to our Privacy and Grievance Officer at privacy@tezworks.com. Please describe the concern and the account or organization involved without sending passwords, card details, or authentication codes. We will acknowledge and address the request within the period required by applicable law. You may approach the Data Protection Board of India after using our grievance process where the law permits.

14. Other regional rights

People in the EEA, United Kingdom, and other jurisdictions may have additional rights, including data portability, objection to legitimate-interest processing, restriction, and complaint to a local data-protection authority. Residents of jurisdictions with applicable US state privacy laws may also have rights to know, correct, delete, or receive personal information and to appeal certain decisions. We will not discriminate against anyone for exercising a legal privacy right.

15. Children

Tez is a workplace service intended for adults and organizations. It is not directed to children, and users must be at least 18 years old. If you believe a child has provided personal information, contact privacy@tezworks.com.

16. Updates to this Policy

We may update this Policy to reflect changes to Tez, our practices, or the law. We will post the revised date and give reasonable notice of a material change through Tez, email, or our website where required.

17. Contact

Privacy questions, rights requests, and grievances may be sent to privacy@tezworks.com or by post to: Privacy and Grievance Officer, NXO Group Private Limited, 2nd Floor, Core 1, PACIFICA TECH PARK, Rajiv Gandhi Salai, Navalur, Chennai, Tamil Nadu 600130, India.

18. Tez Vault browser extension

Tez Vault is provided by NXO Group Private Limited. Its single purpose is to help you use and manage encrypted Vault logins on a website you select: fill a login, generate a password, or review credentials before saving or updating them. It requires a Tez account, an open signed-in Tez tab, and a configured Vault.

Information used and your choices

The extension handles the selected website’s origin, relevant login form fields, usernames, passwords, saved Vault contents, and account and workspace identifiers needed to authorize access. It decrypts saved contents locally while unlocked. It does not request browsing-history or cookies permissions, continuous access to all websites, or access to unrelated page content. The extension contains no advertising or analytics SDKs.

Opening the extension grants temporary access to the selected tab. Fill puts the login you choose into supported fields without submitting the form. Generate & fill creates a password for supported signup fields. Capture next login watches a form submission only after you enable it for the current document; Read filled form reads supported login fields when you request it. Capturing a form does not confirm that a website accepted your login or signup.

Local memory and temporary captures

Decryption keys and decrypted saved logins are held in popup memory. Closing the popup clears its unlocked state; the popup also locks after five minutes without interaction. Your Vault password is used locally to unlock encrypted keys and is not sent to Tez.

A generated or captured credential awaiting your review is temporarily held in plaintext in browser session memory restricted to trusted extension contexts. It is eligible for review for five minutes and is not written to extension local or sync storage. Closing the popup alone does not discard this queue; you must unlock again to review it. Discard, explicit Lock, tab closure and expiry clear pending entries. Expiry cleanup runs when the browser can execute the extension; expired entries cannot be reviewed or saved. Browser restart or extension reload clears session storage.

Transmission, storage and sharing

Only after you confirm Save or Update does the extension encrypt changed Vault contents locally and synchronize them with Tez over HTTPS through your signed-in Tez tab. Tez stores the encrypted contents and processes authorization metadata and service records needed to provide and secure the feature. Tez hosting providers process this information on our behalf. Vault and item permissions determine which authorized users can retrieve shared encrypted contents.

When you choose Fill, the destination website receives plaintext field values, which its scripts may read. Exact-origin matching and your explicit choice limit unintended filling but cannot protect against a compromised destination website. The website’s own privacy policy applies to its processing.

Retention, deletion and support

Uninstalling the extension does not delete encrypted items saved in Tez. Manage saved items and sharing in Vault, or contact your workspace administrator. Account closure, backups, security records and legal retention follow section 10 of this Policy. Contact privacy@tezworks.com for privacy requests and support@tezworks.com for product help. Never send passwords or recovery keys in a support request.

Limited use of extension data

Our use of information obtained through the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We use extension data only for the disclosed password-management purpose and related operation and security. We do not sell it, use it for advertising, or use it to determine creditworthiness or lending eligibility.

Transfers are limited to providing the disclosed purpose, complying with law, protecting against malware, phishing, fraud or abuse, or a merger, acquisition or sale of assets after obtaining the user’s explicit prior consent. Human access is limited to specific user consent, aggregated and anonymized internal operations, necessary security investigations, or legal requirements. These restrictions also apply to derived data and take precedence over any broader use or sharing provision elsewhere in this Policy for information obtained through the extension.