Legal & trust
This policy explains how this website handles information, and which privacy principles apply when Rexora works on a client engagement.
These documents describe how the service operates and are provided for information. They are not legal advice.
The controller of the personal data described in this policy is UAB Nonstop Group, a private limited company established in Lithuania, which operates this service under the Rexora brand. Contact: info@nonstopgroup.lt. Formal registration details — company code, VAT identification and registered address — are provided on request and in each engagement's written agreement.
The pages of this website are static files, but the site is not backend-free: it also runs small server-side endpoints under /api at our hosting provider, and the optional AI assistant is one of them. The site sets no tracking cookies and runs no third-party analytics.
The inquiry form submits directly to our own /api/lead endpoint: only the fields you filled in are transmitted, and only after you press the submit button and tick the box confirming this policy. What happens to that submission is described in section 5.
If secure recording is unavailable, the form says so and offers your own email application as a clearly-labelled alternative. Information then reaches us only if you choose to send that email, and is processed as ordinary business correspondence.
The site offers an optional AI assistant. It does nothing until you open it and send a message: using it is entirely voluntary, and you can write to info@nonstopgroup.lt instead.
What you type, the last few turns of that conversation and your interface language are sent to our /api/rexora-assistant endpoint. While the AI assistant is switched on, that text is forwarded from there to Google (Gemini API, generativelanguage.googleapis.com) for the single purpose of generating the answer shown to you. Google processes the request under the terms of the Gemini API account used by Rexora. We do not send your name, email address or any account identifier with it.
The categories of data therefore depend entirely on what you write. Please do not enter personal data, confidential information or client data into the assistant — a short description of the process is enough. The assistant states this before you type, and every answer says whether it came from the external provider or from Rexora's own templates.
Rexora does not store the conversation and does not write it to an application log: the endpoint keeps nothing once it has answered. Your details are recorded only when you explicitly submit an inquiry. How long Google retains an API request is governed by the Google terms that apply to the account used, not by us.
The site is served by a hosting provider (currently Vercel), which processes technical request data (such as IP addresses) in server logs as part of operating the infrastructure. We do not enrich or combine this data.
When you submit the inquiry form, the fields you filled in are sent to our /api/lead endpoint: your name, your email address, your company if you entered one, the offer you selected, your description of the process, and the budget range and timeline if you chose them. The endpoint also records the page you submitted from, your interface language, and the campaign source in the link you arrived on if there was one. Nothing is sent before you press the button.
From there the inquiry is delivered as an email to our own inbox, info@nonstopgroup.lt, for the single purpose of letting a person read it and answer you. That mailbox is operated by Hostinger, our email hosting provider, which therefore stores the message on its servers. The email carries the fields listed above and uses your address as the reply address so that answering you takes one click; it is sent only to us and to no one else. Which safeguards apply, where the mailbox is hosted and how long messages are kept there are governed by the terms of the Hostinger account used by Rexora rather than by this website; you can ask us at info@nonstopgroup.lt which ones apply before you send anything.
If Rexora has configured owner notifications, a short alert is also sent to Telegram (api.telegram.org), operated by Telegram Messenger, so that a person is told an inquiry has arrived. That alert contains only your company name and the source of the inquiry — for example whether you arrived from the website, the guided check or an ad — and, if you gave no company name, an internal reference in its place. It does not contain your name, your email address, your message, your budget or your timeline, and it is never sent to you.
This recording is active only while it is configured. When it is not, the endpoint refuses the submission, tells you so on screen with a reference code, and stores nothing at all: it never reports an inquiry as received when it has not been recorded. No inquiry is passed to an advertising network, and no automated outreach follows from it — every inquiry is reviewed by a person.
The legal basis is Article 6(1)(b) of the GDPR: the processing is necessary in order to take steps at your request before entering into a contract. The tick box on the form is not that legal basis — it confirms only that you have read this policy. It is not marketing consent, and no marketing email is sent as a result of it.
Inquiries are kept for 24 months from the date we receive them, and are then deleted or anonymised. If an inquiry leads to a client engagement, the retention agreed in that engagement applies to it from that point instead.
Under the GDPR you may at any time request access to your data, its rectification or erasure, restriction of processing, and portability, and you may object to processing. Write to info@nonstopgroup.lt and we will answer within one month.
Because the inquiry form relies on Article 6(1)(b) and not on consent, there is no consent to withdraw for it. Where any processing does rely on consent, you may withdraw that consent at any time, and doing so does not affect the lawfulness of the processing carried out before you withdrew it.
You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or with the supervisory authority of the country where you live or work.
We will update this policy as the service evolves; the current version is always published on this page.