Legal & trust
This policy explains how this website handles information, and which privacy principles apply when Rexora works on a client engagement.
These documents describe how the service operates and are provided for information. They are not legal advice.
The controller of the personal data described in this policy is UAB Nonstop Group, a private limited company established in Lithuania, which operates this service under the Rexora brand. Contact: info@nonstopgroup.lt. Formal registration details — company code, VAT identification and registered address — are provided on request and in each engagement's written agreement.
The pages of this website are static files, but the site is not backend-free: it also runs small server-side endpoints under /api at our hosting provider, and the optional AI assistant is one of them. The site sets no tracking cookies and runs no third-party analytics.
The inquiry form submits directly to our own /api/lead endpoint: only the fields you filled in are transmitted, and only after you press the submit button and tick the box confirming this policy. What happens to that submission is described in section 5.
If secure recording is unavailable, the form says so and offers your own email application as a clearly-labelled alternative. Information then reaches us only if you choose to send that email, and is processed as ordinary business correspondence.
The site offers an optional AI assistant. It does nothing until you open it and send a message: using it is entirely voluntary, and you can write to info@nonstopgroup.lt instead.
What you type, the last few turns of that conversation and your interface language are sent to our /api/rexora-assistant endpoint. While the AI assistant is switched on, that text is forwarded from there to Google (Gemini API, generativelanguage.googleapis.com) for the single purpose of generating the answer shown to you. Google processes the request under the terms of the Gemini API account used by Rexora. We do not send your name, email address or any account identifier with it.
The categories of data therefore depend entirely on what you write. Please do not enter personal data, confidential information or client data into the assistant — a short description of the process is enough. The assistant states this before you type, and every answer says whether it came from the external provider or from Rexora's own templates.
Rexora does not store the conversation and does not write it to an application log: the endpoint keeps nothing once it has answered. Your details are recorded only when you explicitly submit an inquiry. How long Google retains an API request is governed by the Google terms that apply to the account used, not by us.
The site is served by a hosting provider (currently Vercel), which processes technical request data (such as IP addresses) in server logs as part of operating the infrastructure. We do not enrich or combine this data.
When you submit the inquiry form, the fields you filled in are sent to our /api/lead endpoint: your name, your email address, your company if you entered one, the offer you selected, your description of the process, and the budget range and timeline if you chose them. The endpoint also records the page you submitted from, your interface language, and the campaign source in the link you arrived on if there was one. Nothing is sent before you press the button.
From there the inquiry is delivered as an email to our own inbox, info@nonstopgroup.lt, for the single purpose of letting a person read it and answer you. That mailbox is operated by Hostinger, our email hosting provider, which therefore stores the message on its servers. The email carries the fields listed above and uses your address as the reply address so that answering you takes one click; it is sent only to us and to no one else. Which safeguards apply, where the mailbox is hosted and how long messages are kept there are governed by the terms of the Hostinger account used by Rexora rather than by this website; you can ask us at info@nonstopgroup.lt which ones apply before you send anything.
If Rexora has configured owner notifications, a short alert is also sent to Telegram (api.telegram.org), operated by Telegram Messenger, so that a person is told an inquiry has arrived. That alert contains only your company name and the source of the inquiry — for example whether you arrived from the website, the guided check or an ad — and, if you gave no company name, an internal reference in its place. It does not contain your name, your email address, your message, your budget or your timeline, and it is never sent to you.
This recording is active only while it is configured. When it is not, the endpoint refuses the submission, tells you so on screen with a reference code, and stores nothing at all: it never reports an inquiry as received when it has not been recorded. No inquiry is passed to an advertising network, and no automated outreach follows from it — every inquiry is reviewed by a person.
The legal basis is Article 6(1)(b) of the GDPR: the processing is necessary in order to take steps at your request before entering into a contract. The tick box on the form is not that legal basis — it confirms only that you have read this policy. It is not marketing consent, and no marketing email is sent as a result of it.
Inquiries are kept for 24 months from the date we receive them, and are then deleted or anonymised. If an inquiry leads to a client engagement, the retention agreed in that engagement applies to it from that point instead.
Separately from the inquiry form, this site offers a "what do you need?" page. It asks you to describe a task you would like automated, and it sends that description to our own /api/need endpoint when you press the button. No email address is requested and none is stored, so the submission carries no contact details. What comes back to you is a reference code and the result of matching your description against what Rexora already offers — never your own text repeated back.
That description is stored durably in a database operated by Supabase, which acts as our processor for this purpose. The database is hosted in the European Union, in Supabase's Ireland region (eu-west-1). What you type is stored as you wrote it, together with a redacted copy used for our own reporting, the outcome of the match, your interface language, the page you submitted from, and the campaign source in the link you arrived on if there was one. The redacted copy has contact details removed for display; it is not anonymous data and is treated as personal data throughout.
Because the field is free text, please do not enter names, contact details, confidential information or client data — a description of the process is enough. Nothing is emailed to us from this page, no alert is sent, no automated outreach follows, and the submission is never passed to an advertising network. If the database cannot be reached, the page says so and stores nothing at all: it never reports a need as recorded when it has not been.
We rely on Article 6(1)(f) of the GDPR for this processing: our legitimate interest in learning which tasks people want automated, so that what we build next is decided from evidence rather than from guesswork. You may object at any time at info@nonstopgroup.lt. Because the submission carries no contact details, quoting the reference code shown to you on screen is what lets us find and delete it.
Our retention rule for this data is twelve months from the date of submission. After that the text you typed is cleared, and only the non-personal fact — what kind of task was asked for, and whether Rexora could already serve it — is kept. Where a submission concerns a personal matter in a sensitive category, the whole record is instead reduced to a monthly count and deleted. The mechanism that carries this out is built and tested but is not yet running on a schedule; until it is switched on, the clearing is performed manually, and you can ask us to delete your submission at any time at the address above.
Under the GDPR you may at any time request access to your data, its rectification or erasure, restriction of processing, and portability, and you may object to processing. Write to info@nonstopgroup.lt and we will answer within one month.
Because the inquiry form relies on Article 6(1)(b) and not on consent, there is no consent to withdraw for it. Where any processing does rely on consent, you may withdraw that consent at any time, and doing so does not affect the lawfulness of the processing carried out before you withdrew it.
You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or with the supervisory authority of the country where you live or work.
We will update this policy as the service evolves; the current version is always published on this page.