Privacy Policy

This policy explains what personal information NexiNext collects, why we collect it, who we share it with, and what you can ask us to do about it. It is written to be read, not to be survived.

1. Who we are

NexiNext is operated by NexiNext LLC, a Texas limited liability company, with its registered address at 26119 Interstate 45 N, Suite 305, Spring, TX 77380, United States.

For privacy questions or to exercise any of the rights in section 13, write to privacy@nexinext.com.

2. What this policy covers

• The marketing website at www.nexinext.com
• The NexiNext application at app.nexinext.com
• The NexiNext mobile apps for iOS and Android

Together we call these “the Service”.

3. Our two roles — please read this one

NexiNext is a business tool. Companies subscribe to it, and their employees use it to run their work and to manage their own customers. That means we handle two different kinds of personal information, under two different responsibilities.

We are the controller for the information about the companies that subscribe and the people who hold accounts with us — their names, email addresses, sign-in records, billing details, and the list of records each person opened recently (section 4), which we keep for that person alone and which their employer cannot see. We decide how that information is used, and this policy governs it.

We are a processor for everything a subscribing company puts into the Service about its own customers, leads, vendors and contacts — the prospect records, contracts, invoices, appointments and messages, and the answers its customers give to the questions it sends them (section 4). We hold and process that information on that company’s instructions, for that company’s purposes. We do not decide what goes in it, and we do not use it for our own ends. The same is true of the employment details a company records about its own staff — a job title, a department, a date of birth, a hire date, the time off its staff ask for and are given, their contracted hours and pay, and the points, badges and bonuses Compete records for them (section 4): the company decides whether to record them and why, and if you want yours seen, corrected or removed, that request goes to your employer.

So if you are a customer of a business that uses NexiNext and you want to see, correct or delete your records, your request goes to that business, not to us. They control that data; we are the filing cabinet. If you contact us anyway, we will pass your request to them and tell you we have done so.

4. What we collect

Account and profile

Your name, email address, phone number, language preference, job title, and profile photo if you upload one. Your password is stored only as a bcrypt hash — we never hold the password itself. If you turn on two-factor authentication, we store the encrypted secret and your backup codes.

Date of birth, if your employer records one

A company can record a date of birth for each of its staff. It is optional, most companies will not use it, and it is entered by your employer rather than by you — from a spreadsheet they upload or by typing it on your record — though you can edit your own.

It is held separately for each company you work for, so one employer’s entry is never visible to another. Within a company it can be read only by owners and administrators and by you — not by your colleagues, and never by that company’s customers. It is deleted when you delete your NexiNext account.

One company may also use it to create your first password. Where a company adds staff from a spreadsheet, it can choose to have us build each person a starting password from their own details — a first name and six digits from a date of birth or a phone number — which the company then gives you in person or on paper. A password made this way is deliberately short-lived: you must replace it with one of your own the first time you sign in, before you can reach anything else, and it stops working after fourteen days. Because it is built from details other people at your company may know, treat the one you choose as the real one. We never store either password in a readable form; both are kept only as a bcrypt hash.

Time off and your hire date, if your employer uses Personal time off

If a company you work for uses NexiNext’s Personal time off feature, we hold the time off its staff ask for, and the yearly allowances it is counted against, on that company’s behalf, as its processor (section 3).

What a request holds. Each request has a kind — Vacation, Sick or Unpaid — its dates, the working days it costs, an optional note for the people who approve it, an optional out-of-office message and a colleague to contact while you are away, and the decision on it: who approved, declined, cancelled or shortened it, when, and any reason they gave. You make your own requests; someone who approves your time off can also record it on your behalf.

Sick leave. Choosing Sick tells your employer one thing: that those days were taken as sick leave. NexiNext never asks for, and has no place to store, a diagnosis, a symptom, a medical certificate or any other document, and a request takes no attachment. The note is optional free text written for your approvers, and you do not need to say anything in it about your health.

Your allowance and your hire date. For each year: the vacation days the company’s policy gives you, what carried over from the year before, a cap on sick days if the company sets one, what you have used, and any change made to your figures, with the reason given for it. Your hire date is entered by your employer — on your employee record, on the allowances page, or from a spreadsheet it uploads — not by you, and is used to work out your years of service.

Who sees what. Inside the company:

• the kind of each request, your note, any reason given, your allowance and balances, and your hire date can be read only by you, your direct manager, the company’s owners and administrators, and the members of the department the company names to approve time off;
• that you are out, on which dates, your out-of-office message and the colleague to contact are shown to every employee of the company, so they know you are away — never the kind;
• the company’s customers never see any of it.

Phone notifications about a request never mention its kind; the emails sent to you and to your approvers about it may. All of it is kept for as long as the company’s account exists (section 12), and a request about it goes to your employer (section 3).

Your working hours and pay, if your employer records them

If a company you work for uses NexiNext’s Team capacity or Compensation features, we hold what it records about your working hours and your pay on that company’s behalf, as its processor (section 3). Your employer enters all of it — its owners, or the people they have given access to pay — never you, and you cannot change your own figures.

What is recorded. With Team capacity: the hours a week you are contracted to work, how often you are paid, your employment type (full-time, part-time or contractor), and any correction to your hours for a pay period, with its reason. With Compensation, as well: your base pay and its currency, and whether it is a yearly, per-period or hourly figure; the employer’s own costs on top of it, as a percentage; and any bonus, commission, allowance or other payment the company records for you, with its date and an optional note. Each change takes effect from a date and the earlier figures are kept, so the record is a history of your pay, not only today’s figure.

What it is used for. From your pay and contracted hours, NexiNext works out what an hour of your time costs the company — or the company types that figure in directly — and attaches that cost to each hour you log, so the company can see what its work costs: by customer, project and department, and for the company as a whole, in its profitability figures, budgets and financial reports. Your contracted hours also show how much of them is left in the current period, where work is handed out. NexiNext does not run payroll: nothing here pays you, and we hold no payslip, bank account or tax withholding for it.

Who sees what. Inside the company:

• your pay, the payments recorded for you and the cost of an hour of your time can be read only by you, the company’s owners, and the people an owner has given access to pay, within the part of the company they look after. An administrator without that access sees none of it, and no labour cost anywhere in NexiNext;
• your contracted hours and the hours you have left can be seen by the company’s owners, administrators and Product Champion, by the people you report to, directly or further up, and, when they assign you a task, by colleagues in your department;
• the figures built from these costs — labour cost, margins and the like — are shown only to the owners and to the administrators who have access to pay;
• every change to anyone’s pay is recorded in the company’s audit log: who changed whose pay, and when, never the amounts, and only the people who can see pay can see those entries;
• colleagues without access to pay, the company’s accountant and its customers never see your pay.

None of it goes to an AI. No one’s pay, recorded payments or hourly cost is sent to Anthropic, or to any AI assistant a person connects (section 8). The quarterly AI profitability analysis receives labour cost only as totals by department and for the whole company (section 8) — but in a department of one or very few people, that total can show what those people cost the company, a figure worked out from their pay, and it goes to Anthropic for the analysis. The mobile app shows you your own pay but never keeps a copy of it on the phone (Mobile app, below). None of it is shared with any other service beyond our hosting provider (section 10).

All of it is kept for as long as the company’s account exists (section 12), and a request about it goes to your employer (section 3).

Compete: points, badges and bonuses, if your employer uses it

If a company you work for uses NexiNext’s Compete feature, we hold what it records about you on that company’s behalf, as its processor (section 3). Most of it NexiNext works out from work already recorded in the Service; nobody types it in about you, except where said below.

What is recorded.

• Points. When certain outcomes happen — an invoice you created is paid, a customer accepts a quote or signs a contract you created, a task assigned to you passes someone else’s review, a prospect assigned to you is won, a ticket a customer opened is solved by you, an appointment assigned to you is completed — we record an entry for you: what happened, the record it came from, when, and the points. Creating records, logging hours and posting messages earn no points.
• Streaks and badges. How many days in a row you have done some work in NexiNext, your longest run, and the badges you earn, with when and why. An owner or administrator can also award you a badge by hand, with a short citation.
• Weekly totals of your points and outcomes, for the Productivity Impact view described below.
• Bonus programs and awards. A company can run a monthly bonus program for a department or for the whole company, with its own rules and prize pool. When the month ends, NexiNext calculates who qualifies and how much from those rules; an owner — or an administrator with access to pay, where the company allows it — then approves, adjusts or rejects each award, with a note where it is changed or rejected, and marks it paid. NexiNext does not pay bonuses: the company pays them through its own payroll. An award you receive appears on your pay record (Your working hours and pay, above).

Who sees what. Inside the company:

• the standings of a bonus program — names, points, rank and streak — and a live feed of the outcomes that earned points, with the person’s first name, the kind of outcome, the customer’s name and the points, are shown to every employee taking part in that program, and to the company’s owners and administrators for every program;
• the badges you have earned can be seen by every employee of the company;
• you can choose Hide me from leaderboards: colleagues then see you as an anonymous member on standings and in the feed, and cannot open your badges. Owners and administrators still see your name, because they approve the money, and you still earn points and can still be paid;
• the Productivity Impact view, which compares each employee’s weekly output before and during a program, is for owners and administrators only;
• the amount of a bonus award can be read only by you, the company’s owners and the people with access to pay; an administrator without that access sees an award’s points and status but not its amount;
• the company’s customers never see any of it.

When your award is approved you are told by email and by phone notification, and both include its amount; a phone notification can show on your lock screen. Nothing in Compete is sent to an AI provider, and the live standings are never kept on the phone.

All of it is kept for as long as the company’s account exists (section 12), and a request about it goes to your employer (section 3).

Sign-in records

Each sign-in updates a count, a timestamp, and the IP address you signed in from. We keep the current and previous values. This is standard account-security telemetry: it is how you and we can tell whether someone else has been in your account.

Recent work: a list of the records you opened recently

If you use NexiNext as an employee of a company, we keep a short list of the records you opened there recently — a customer, an invoice, a task, a conversation, a chat with a colleague, a colleague’s profile, and the like — so that you can get back to what you were working on in one click. It is shown back to you as the Recent work strip at the bottom of the web app; in search, and when you pick a record to link into a message, before you type; and on the mobile app’s Home as Pick up where you left off. Opening a list, a report or a settings page adds nothing to it, and nothing you type or search for is recorded.

For each record, our servers keep only three things: what kind of record it is, its internal identifier, and when you last opened it — one entry per record, not a history of every visit. Our servers never store the record’s name or anything in it. The name you see on each card is looked up afresh each time the list is shown to you, and a record you can no longer open — because it was deleted or your access changed — simply drops out of view.

Only you can see your list. It is kept separately in each company you work for, and nobody at your company can see it — not its owners, not its administrators. There is no report, export or search of it for anyone but you, and nobody at NexiNext reads it. The one exception is the one that applies to everything in your account: when our support team signs in as you to help with a problem — an access that is recorded in your company’s audit log — they see your screens as you do, this list included. Nothing they open while signed in as you is added to it, and they cannot change it.

We use it for nothing else. It is not a measure of your work, it appears in no report, and it is not used for statistics or to improve the product.

It is yours to manage: you can remove any entry at any time, on the web or in the mobile app, and clear the whole list from the web app. You can also turn it off altogether with Keep my recent work in My account, on the web or in the mobile app: turning it off deletes your list in every company, and nothing is recorded until you turn it back on. We keep the 50 records you opened most recently in each company and show you up to 20 of them; how long the list is kept is in section 12. Your data export (My account → Your data → Export my data) includes it — for each entry, the company, the kind of record, its identifier and when you last opened it, but not the record’s name.

The mobile app also keeps a copy of the list on your phone, as it was last shown to you, so that it opens instantly. That copy does include the names you saw; it is encrypted, kept only on that phone, excluded from device backups, and never uploaded. It is deleted when you sign out, when you lose access to the company or it closes, and after 30 days without opening the app in that company.

If you use NexiNext as a company’s customer, or as its accountant, nothing of this kind is recorded.

Company and tax information

For companies that issue Mexican CFDI invoices, we store the RFC, fiscal legal name, postal code, régimen fiscal, and the related SAT fields. We also store the company’s Certificado de Sello Digital — the certificate, its private key, and its password — because stamping an invoice requires them. These are encrypted at rest and are the most sensitive material we hold. See section 10 for who else touches them.

Customer records entered by a subscribing company

Under our processor role: prospect and contact names, email addresses, phone numbers, Instagram usernames and Instagram-scoped IDs, organisation names, notes and message history; vendor names and tax IDs; appointments; support tickets; uploaded files; and, where a company connects WhatsApp, its customers’ WhatsApp numbers and profile names, their consent to receive WhatsApp messages, and the WhatsApp messages exchanged with them.

WhatsApp messages a company sends through NexiNext

A company can connect its own WhatsApp Business account and number. NexiNext then sends its quotes, invoices and payment reminders as WhatsApp messages, from the company’s number and in the company’s name, to customers who have agreed to receive them, and shows the company’s staff the replies. We do this as the company’s processor (section 3).

What a message carries: the customer’s WhatsApp number, the company’s name, the document’s number and amount (and, for a reminder, its due date), and a link to the document’s page. Anyone holding that link can open the document without signing in, as with the link in the company’s email. A message never carries the customer’s name, email address or postal address, the document’s lines, or any file. Replies the company’s staff type are sent as written.

What comes back: the customer’s replies (their text; images, audio and other attachments are not downloaded or kept, only noted), the customer’s WhatsApp profile name, and whether each message was delivered and read. The company’s staff can see these on the customer’s record, and its owners and administrators are told of replies by email and phone notification.

Consent. A company may message a customer on WhatsApp only after the customer agrees, in one of four ways: the company records the agreement and states how it was given; the customer turns WhatsApp on in their NexiNext notification preferences; the customer turns it on from a quote or invoice the company sent, after confirming with a code sent to the email address the document was sent to; or a customer who stopped the messages turns them back on by replying START. We keep a record of each agreement: who gave or recorded it, how and when, which wording was shown, and, for the emailed code, the address it went to and when it was entered.

Stopping the messages. A customer can stop them at any time by replying STOP, by turning WhatsApp off in their preferences, or by asking the company. Deleting a NexiNext account ends its WhatsApp agreements too.

WhatsApp is operated by Meta, and messages on it are also subject to WhatsApp’s own terms and privacy policy.

Answers you give to a company’s questions

A company on the Pro or Business plan can send one of its customers a short set of questions about work it is doing for them: a title the company wrote, an optional note, and the questions. If you are that customer, you see only those — never the company’s own record of the work, its name, the people working on it, or anything else internal to the company. You can answer in the customer portal, in the customer app, or, if you do not have an account yet, on a public page opened from the email we send you. On that page, answering needs the six-digit code we email to the address the questions were sent to, exactly as for deciding on a quote from its public page.

For each question you can give an answer, choose I don’t know, or leave it blank, and you can attach files: at most five per question, each within the per-file size limit of the company’s plan, or 100 MB on the public page. We keep your answers, which questions you marked I don’t know, the files, who answered and when, and whether you answered in the portal, in the app or on the public page. On the public page we also keep the email address that was verified, which stays with your answers as their proof, and the email address, IP address and browser recorded when the code was requested, which we delete after 90 days (section 12).

Your answers and files become part of the company’s own record of that work, readable by the company’s employees who can see it. Where the company lets its employees connect their own AI assistants, an employee’s assistant may read them inside a task’s brief, and they then go to that assistant’s provider (section 8). We hold all of this on the company’s behalf, as its processor (section 3), so a request about it goes to that company.

Payments

We store Stripe customer and connected-account identifiers, and for saved cards only the brand, last four digits, and expiry date. Full card numbers and security codes go directly from your browser or device to Stripe and never reach our servers. For Mexican OXXO and SPEI payments we store the voucher link and the receipt email address.

Electronic signature evidence

When a contract is viewed, signed or declined in the Service, we record the signer’s name, IP address, browser user-agent string, and the timestamps of each step, along with the signature image and the resulting signed PDF. We are explicit about this because it is the point: an electronic signature is only worth something if there is evidence attached to it. That evidence is retained with the contract.

Support reports and diagnostics

If you report a problem, the report carries the app version, device model, operating system, device type, screen and viewport size, timezone, language, browser user-agent, your IP address, and the page you were on. It also carries a screenshot of the screen you were on: it is attached by default, you see it before you send the report, and you can remove it. On screens that show your company’s information, we ask you before including it. Only NexiNext support staff can see the screenshot, and our automatic fixer may be given it, as described below. A report sent from the app or the web application also carries the activity log described below.

How a report is read. When a report arrives, an AI classifier — Anthropic, the provider in section 8 — reads it once to sort it: what kind of problem it is, how serious it is, where the fault lies, and whether it repeats a report already open. It is given what you wrote, the kind of problem you chose, and some of the technical details captured with it: the app version, the browser or operating system, the type of device, the title of the page or screen, and, when a request had just failed, that request’s address, its result and the type of error. It is never given the screenshot, the error’s own message, the address of the page you were on, your IP address, your browser’s user-agent string, who you are, or the activity log. Rules we set then use the result to prioritise the report and route it to our team; they may also send you one of our standard, pre-written replies, or mark the report as not a fault, which a person can reopen. Nothing the classifier writes is ever sent to you. Some reports may then be given to NexiNext’s automatic fixer, an AI that tries to correct the fault in our code: it receives what you wrote, the kind of problem, the details of the failed request and error type above, which screen you were on (without the numbers that identify a record), whether you used the web, iPhone or Android app, your screen size, whether dark mode was on, the app version, and the screenshot and any images you attached. Those pictures can show anything that was on your screen, including names and figures; they are used only for that attempt. Nothing from your report is written into our code or its history. Both are NexiNext’s own processing: the reading on arrival runs whatever your company’s plan, and neither spends any of your company’s AI allowance.

Files you upload

Receipts, bills, contracts, library documents, quote and invoice attachments, profile photos, company logos, CFDI XML and PDF files, and the voice notes you choose to record and send in Team chat (see Mobile app below).

Mobile app

When you sign in on a phone we store the device name, the platform, and a Firebase push token so we can deliver notifications. The app asks for camera and photo access when you take or pick a picture to upload, and for contacts access only when you refer someone to a company. Your contacts are read on your device and shown to you in a picker — the list is never uploaded. Only the single contact you actually choose is sent, and only so the referral can reach them.

Microphone, for Team chat voice notes. If you use NexiNext as a company’s employee, you can hold the record button in a Team chat room to send your colleagues a short voice note, of up to five minutes. The app asks for microphone access the first time you hold that button, and it uses the microphone only while you are recording a voice note — never in the background, and never at any other time. A voice note is stored like any other file sent in Team chat: with our file-storage provider in the United States (sections 10 and 11); playable only by the people who can read that room’s messages; counted toward your company’s storage; and kept and deleted under the same rules as the room’s other messages — a voice note that is deleted disappears from the room at once and is kept in a deleted state, like any record deleted in the app (section 12). Team chat is for a company’s staff: its customers never see it. No transcript is made, and no AI provider or other third party — other than our file-storage provider, which only stores it — processes the recording. We do not use a voice note to recognise or identify anyone by their voice, for advertising, or to train any model. The web application plays voice notes but never uses your computer’s microphone. Anyone who can play a voice note can also save a copy (on the web) or share it from their phone; what they do with that copy is up to them, as with any file sent in Team chat.

What the app keeps on your phone. So that screens open instantly and can be read without a connection, the app keeps a copy of the records you have opened — customers, tasks, invoices, messages and the like — exactly as NexiNext sent them to you. The copy is encrypted, in a separate store for each account, each company and each way you use it (as an employee or as a customer), each locked with its own key in your phone’s secure keychain. It stays in the app’s private storage, is excluded from your phone’s backups, and is never uploaded: it is a copy of what our servers sent you, not a source. Some things are never kept on the phone — among them pay and compensation figures, a company’s financial overview, the daily briefing and saved payment cards — and are loaded fresh each time you open them.

Activity log on your phone and in your browser, and when it leaves your device

The mobile app, and the web application in your browser, each keep a log on your own device of what they did and how you used them. It is the same kind of record in both places and is described once here; where the phone and the browser differ, the difference is stated.

• every call made to our servers — the method, the address including the identifiers of the records you opened, the result, how long it took, and the request id. In the browser this is every request a page made, and the page itself; a request to another service — a file upload to our storage provider, for instance — is logged by that service’s address alone, never the file or its link;
• every error hit — the error’s type, its message, and the first few lines of its stack. On a page that shows your company’s information, the browser leaves the message out and keeps only the type and the page;
• every screen you visited, in order, along with the one you came from — in the browser, every page you opened, by its address;
• when the app was opened, brought to the foreground or sent to the background, and whether its previous run ended while it was open — the app cannot tell a crash from a force-quit, and the log claims neither. In the browser: when a tab opened NexiNext, and when that tab was hidden and shown again; the browser never records that a tab closed unexpectedly;
• when you signed in or out, when your session expired, when you switched to another account on the same device, and when you switched company, with the identifier of the company that became active;
• the notifications you received or opened on your phone — only their category and, if you opened one, the screen it took you to; never their title or text. The web application sends no notifications and records none;
• the buttons, tabs and menu items you pressed or clicked, with the label shown on them (up to 80 characters) and the screen or page they were on. When you tap or click an item in a list — a customer, an invoice — or a link in a page, the log notes only that a row was opened, with no text at all.

Nothing you type is ever recorded, in any field, on either device. The log holds seven days and overwrites itself. In the browser it lives in the browser’s own storage for the NexiNext site on that computer — not in a cookie — and clearing the site’s data clears it.

Plainly stated: it is a record of which records you opened, where you went and what you pressed or clicked — not an anonymous usage count, and not a recording of your screen.

It does not leave your device unless you ask it to. In your browser there is exactly one way to ask: you send a problem report from the web application, and the report form tells you, before you send it, that the log is attached and how many pages, errors, requests, clicks, tab opens and switches, and sign-ins and switches it holds. On your phone there are two: the same problem report, and turning on developer mode, which takes eight taps on the app’s version number — a deliberate act nobody performs by accident. Nothing else sends it: not a timer, not signing out, not closing the app or the tab. A phone or a browser whose owner never does one of these keeps its week to itself, indefinitely.

What is sent. When you file a problem report — from the phone or from the browser — it sends the whole week of screens or pages visited, errors, app or tab openings and changes, sign-in and company events, notifications (on the phone), and requests that failed or got no answer; plus the 500 most recent requests, successful ones included, and the taps or clicks from the last 24 hours — not older ones. Everything else stays on your device. With developer mode on, the phone sends its most recent events in batches. In the browser the log travels inside the report itself and is always linked to it; on the phone it is linked when your version of the app supports it. The link shows only that the log exists, how many events it holds and when it arrived; its contents do not become part of the report and can be read only as described below.

When you sign out. Signing out — or removing an account from the device, signing out of all accounts, or requesting the deletion of your account — deletes that account’s log from that phone or browser. If instead we end your session — it expired, you changed your password or two-factor settings, or you signed out from another device — the log stays on the device, readable by nothing and sent by nothing, until you sign in there again or its seven days run out.

When you do send it, it carries the app’s version (in the browser, the release the application is running), the platform, the device model and operating system — which a problem report already records — and an opaque installation identifier generated on the device: no name, no email address, no phone number. In the browser that identifier names that browser profile and lasts until you clear the site’s data. Paths are sanitised on arrival: record identifiers are kept, but no token or credential is stored.

Only NexiNext staff with superadmin access can read it, on an internal page where every viewing is logged. No company ever sees it — not the one you work for, not its owners or administrators. It is never shared, never emailed, and never sent to the AI providers in section 8 — including the log that arrives inside a report sent from your browser, which is kept apart from the report. You can get your own, in full, through the data export.

Audit history

The Service keeps a version history of record changes and an audit log of significant actions. Both are keyed to the acting user’s ID — not to an IP address. When a member of our support team needs to work inside a company’s account to help with an issue, they do so by signing in as one of its owners or administrators — never as anyone else — only after confirming their own identity with a second factor, and for at most 60 minutes at a time. The company’s audit log, which its owners and administrators can read, records each such access, when it started and ended, and each area of the account opened during it, without naming the records themselves.

5. What we do not collect

We think this is as informative as the list above.

• No location data. The mobile apps request no location permission of any kind, and there is no latitude, longitude or coordinate field anywhere in our database.
• No advertising identifiers. We do not read IDFA or the Android advertising ID, we show no App Tracking Transparency prompt, and we are in no ad network.
• No third-party analytics or tracking. There is no Google Analytics, no tag manager, no advertising pixel, no session-recording tool, and no heatmap script — not on the marketing site, not in the application, not in the mobile apps. The only log of how you use the mobile app and the web application, screen by screen, is our own, described in section 4: no third party runs it, it does not replay what is on your screen or record anything you type, and it reaches us only if you choose to send it.
• No full card numbers or security codes, no biometric data, and no bulk upload of your contact list. A Team chat voice note is a message, not biometric data: we never use it to recognise or identify anyone by their voice.
• No microphone use except while you record a voice note. The mobile app uses the microphone only while you are recording a voice note in Team chat (section 4); the web application never uses it.

6. Cookies

The application at app.nexinext.com sets the cookies below. All of them are first-party — set by NexiNext, for NexiNext, and sent to no one else. Each is sent only over an encrypted connection, only to app.nexinext.com, and cannot be read by scripts on the page. Most are set only when you choose to do something; four are set without any action of yours, because the application needs them to work as you use it, and the table says which.

Cookie	What it is for	When it is set	How long it lasts
_nexinext_session	Keeps your visit together: whether you are signed in and as whom, the company you are working in, your language before you sign in, a protection against forged requests, and short steps such as a sign-in waiting for its two-factor code. Encrypted.	Without any action of yours, on the first page of the application you open, signed in or not.	Until you close your browser.
remember_user_token	Signs you back in after you close your browser. Signed.	Only if you tick Remember me when signing in with your email and password.	30 days from that sign-in. Deleted when you sign out, and signing out also stops it working on your other browsers.
remember_two_factor_device	Lets this browser skip the two-factor code when you sign in. Signed.	Only if you tick Remember this device for 30 days when entering a two-factor code.	30 days. It stops working at once if you change your password, your phone number or your two-factor settings. Signing out does not remove it.
signed_in_accounts	Lets you move between your own accounts on this browser without typing a password again. It holds sign-in tokens — never a password — for at most five accounts. Encrypted.	Only if you choose Add another account.	30 days from the last time you added, switched or removed an account. Each token stops working at once if that account’s password or two-factor settings change, if the account is suspended or deleted, if our staff revoke its sessions, or if you remove it or sign out of all accounts. The cookie is deleted when its last account is removed.
qr_scanner	A random identifier, so that when a company’s printed QR code starts an automated action, scanning the same code twice from the same browser within an hour starts it only once.	Without any action of yours, when you open a company’s QR code link while not signed in.	1 day.
assistant_consent_return	Brings you back to the page where you are approving an AI assistant’s access to your account, if you sign in or switch account on the way.	When you open that approval page, which the assistant opens when you start connecting it.	15 minutes; deleted when you allow or cancel.
nx_error_nudge	Remembers that a page just failed for you, so that Report an issue can point to the failed request if you choose to report it. It holds that request’s reference and time, nothing else.	Without any action of yours, when a page fails with a server error while you are signed in.	1 hour, or until the next page that shows Report an issue.
recent_work_strip	Remembers whether you keep the Recent work strip open or closed in this browser, so that each page is drawn the way you left it. It holds nothing else: no identifier, and nothing about what you opened.	Only when you open or close the strip.	One year from the last time you opened or closed it.
nx_diag_redirect	Tells the next page which request sent you there — its address, outcome, reference and how long it took — so that the activity log this browser keeps (above) can record it. It holds nothing else. Signed.	Without any action of yours, when a page of the application sends you on to another.	1 minute, or until the next page of the application, which deletes it.
nx_diag_ended	Tells the next page which of your accounts you just signed out of or removed, so that this browser deletes those accounts’ activity log. It holds the accounts’ identifiers, and whether you signed out of all of them, and nothing else. Signed.	When you sign out, remove an account, sign out of all accounts, or ask us to delete your account.	1 minute, or until the next page of the application, which deletes it.
dv_ followed by a code, one per document or set of questions	Shows, for one quote, invoice or set of a company’s questions only, that you entered the verification code we emailed you.	Only when you enter a correct code on a public quote or invoice page, or on the public page of a company’s questions.	30 minutes.

You can block or delete cookies in your browser; without the session cookie you cannot sign in.

There are no advertising or analytics cookies, which is why you have not seen a cookie banner here.

Settings kept in your browser, not in cookies. The application keeps a few display preferences in your browser’s own storage — its layout settings, banners you have dismissed, how you last chose to view a budget, whether a notes panel is open — and the marketing site remembers which market you chose, the United States or Mexico. None of this is sent to us. The one thing the application keeps in your browser’s storage that can reach us is the activity log described in section 4, and it reaches us only inside a problem report you send.

One page loads a third party. If an owner or administrator connects WhatsApp in Settings → Integrations, that page loads Meta’s sign-up script, and the window it opens is Meta’s own site, under Meta’s cookies and privacy policy.

The marketing site sets no cookies. It loads its typefaces from Google Fonts, so Google receives your IP address and user-agent when a page loads; it shows company logos stored with Amazon Web Services; and its company pages and request forms exchange what you see and type with the NexiNext application. None of these requests carries a cookie or an identifier of you.

Emails from outreach sequences. When a company emails a prospect through a NexiNext outreach sequence, each email carries a small image that tells the company the first time it was opened. It sets no cookie.

7. Why we use it, and on what basis

Purpose	Basis
Providing the Service, your account, and support — including sorting the problem reports you send us (sections 4 and 8)	Performance of our contract with you
Labelling the messages a company receives from outside, where it uses AI lead triage (section 8)	The company’s instructions, as its processor (section 3)
Billing, invoicing, collections	Performance of contract; legal obligation
Issuing and storing CFDI and tax records	Legal obligation (Mexican tax law)
Security, fraud prevention, rate limiting, audit logging	Legitimate interest
Service emails you cannot opt out of (password resets, security alerts, billing)	Performance of contract
Product news and marketing email	Consent — withdrawable at any time
Optional integrations (Gmail, Instagram, WhatsApp, calendar)	Your consent, given per integration

8. Artificial intelligence features

Some features use a large language model to draft text, summarise records, and extract data from documents. These run on Anthropic’s Claude API.

Be aware of what this means in practice. When you use an AI feature, the relevant record content is sent to Anthropic. For the document-extraction features specifically — reading a bill, a receipt or an invoice so its line items can be filled in for you — the contents of the uploaded file itself are transmitted.

Anthropic processes this as our sub-processor, under commercial terms that do not permit the content to be used to train their models.

When AI runs. Most AI features run only when a person asks for them, including work that finishes after you have moved to another screen, such as the suggestions prepared while a company is being set up. In these cases an AI feature runs with nobody asking for it at that moment:

• When a message reaches a company from outside. On the Business plan, each message a company receives — an enquiry sent through one of its website or campaign-page forms or through the Discover directory, an email synced from a connected Gmail account, an Instagram message, and a call, email, meeting, text or WhatsApp message an employee logs by hand with its text — is read once, when it arrives, to label what it is asking for and how urgent it is, with a one-line summary. What goes to Anthropic is the message’s own subject and text, with the lead’s source and organisation name; the person who wrote it may never have had a NexiNext account. The label is advisory: it is shown beside the message and never hides, reorders, routes or assigns anything. We do this as the company’s processor (section 3). The company’s owners and administrators can turn it off (AI lead triage, on the company’s AI usage settings page), and it also stops when the company’s monthly AI allowance runs out.
• When a company’s own rule runs it. A company can write an automation that generates a prospect’s AI summary, or drafts an outreach sequence for a prospect, when something happens to that prospect. The company writes the rule once and it runs each time; a drafted sequence waits for a person to review and start it.
• When a quarterly budget review is applied. Applying a company’s quarterly budget review also prepares that quarter’s AI profitability analysis, from the company’s figures by department and for the company as a whole — never from an individual employee’s pay, cost or hours. In a department of one or very few people, though, the department’s labour cost can show what those people cost the company, a figure worked out from their pay, and it goes to Anthropic with the rest.
• When you send us a problem report. Every report is read on arrival to sort it, and some are given to our automatic fixer, as section 4 describes. This is NexiNext’s own processing, and it spends none of the company’s AI allowance.

AI output is assistive and can be wrong. Review it before relying on it, particularly for anything fiscal.

Your own AI assistant. You can connect an AI assistant you already use — Claude, ChatGPT or another app that supports the Model Context Protocol — to your own NexiNext access, in the companies you choose. It is available on the Pro and Business plans, and only where that company’s owners or administrators have turned it on, which they do separately for the company’s employees and for its customers. When you connect, you choose one of two kinds of connection:

• Read only. The assistant looks things up — only what you could see yourself in NexiNext — and cannot change anything. Every connection a customer makes is of this kind. On an employee’s connection it can also read a task’s brief and the contents of its files, as described below; a customer’s connection never receives the contents of a file, only links to the pages that hold them.
• Read and suggest. Available only to a company’s employees, and only in a company whose owners or administrators have also turned on AI assistants can work on tasks, which is off until they do. Besides looking things up, the assistant can leave drafts on tasks: draft answers to a task’s brief, a draft of ideas and files, and draft replies in the conversation on an idea. A draft is visible only to you, and nothing in it is live until you publish it in NexiNext. Publishing is your own act: it notifies your team and applies the next steps you kept, as if you had done each one yourself. Published ideas appear on the task’s AI work tab. An assistant can never publish, delete, see what you can’t, or set off an automation.

What an employee’s assistant reads on a task. On either kind of connection, an employee’s assistant can read a task its person can open, and its brief: the answers to the task’s questions, including the answers the company’s customer gave to the questions the company sent them (section 4), and, while the company has AI work turned on, the task’s Notes for the AI; the company’s How we work page and the library documents an owner, an administrator or the company’s Product Champion has marked to go to outside AIs; the notes in What we know about the task’s customer or project; the decisions recorded on the task, the ideas declined with their reasons, and the conversations on ideas; related tasks and earlier examples that you can see; and the list of the task’s files. It can also read the contents of those files: an image itself; the text of a PDF, Word document or spreadsheet, which we extract on our own servers without any AI; or, for a video or audio file, a link to that one file that works for five minutes. Hours, labour cost and pay never reach anyone who cannot already see them.

Where it goes. What your assistant reads, on either kind of connection, is sent to the company that provides the assistant, at your request and under your own agreement with that provider. That provider is not one of our sub-processors and is not in the table in section 10: we do not choose it, we have no contract with it, and we send it nothing on our own initiative — only answers to the requests your assistant makes while it is connected. How the provider handles what it receives is governed by its terms with you, not by this policy. What your assistant writes stays in NexiNext, visible only to you until you publish it. The company’s owners and administrators can see how much each connection reads in their company — counts only, never what was read — and can revoke it. A connection your assistant has not used for 90 days stops working, and you can disconnect it at any time from your Security page.

Tasks that never leave NexiNext. A company can mark a kind of task — tax filings, payroll, legal matters and the like — as Never leaves NexiNext. Nothing about the brief or the files of such a task goes to any AI model, whether a person’s own assistant or NexiNext’s own AI features: no assistant receives its brief, the contents of its files or a prompt written for it; NexiNext’s AI does not suggest answers for it or draft a task type from it; and it is never used as related work or an earlier example for another task, or as the source of a note about a customer or project. What a connected assistant still sees of such a task is what its person’s ordinary look-ups show of any task: its name and its dates.

The AI tools list. Where a company uses AI work, NexiNext shows a short list of well-known AI tools for each kind of output, labelled as examples, not endorsements. A company ticking the tools it uses sends no data anywhere: the tick only decides which tool names its tasks and their briefs show. For a tool that cannot connect to NexiNext, your own assistant may write a prompt that you copy into that tool yourself; NexiNext sends nothing to any listed tool.

9. We do not sell your information

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have never done so. There is no advertising business here to sell it to.

10. Who we share it with

We use the following sub-processors. Each receives only what its job requires.

Sub-processor	What it does	What it receives	Where
DigitalOcean	Hosting and managed PostgreSQL database	All application data	United States
Amazon Web Services (S3)	File storage	All uploaded files, including digital seal certificates	United States
Stripe (incl. Connect)	Card payments, payouts, identity verification	Card data directly from your device; receipt email; payout account identity	United States
Facturapi	Authorised Mexican PAC — seals and stamps CFDI with the SAT	Issuer and receiver RFC, legal names, invoice contents, digital seal certificate	Mexico
Anthropic	AI features (see section 8)	Prompt content and uploaded document contents	United States
GitHub	Runs NexiNext’s automatic fixer for problem reports (see section 4)	A problem report’s subject, description and failure details; the report’s screen and device details, its screenshot and attached images	United States
Postmark	Sending email	Recipient name, email address, message contents	United States
Google Firebase Cloud Messaging	Mobile push notifications	Device push token, notification title and body	United States
Twilio	SMS delivery of two-factor codes	Phone number, verification code	United States
Google (Gmail API)	Optional, per user — mailbox sync for logging client email	OAuth token, message headers, message contents for messages you send	United States
Meta (Instagram)	Optional, per company — Instagram direct message integration	OAuth token, Instagram-scoped ID, username, message contents	United States
Meta (WhatsApp)	Optional, per company — sending a company’s quotes, invoices and payment reminders on WhatsApp from its own business number, and receiving replies	The company’s WhatsApp Business access token; recipients’ WhatsApp numbers; message contents, including the link to the document; replies, profile names, and delivery and read status	United States
Google / Microsoft	Single sign-on, if you use it	Provider account ID, email address	United States
Cloudflare	Delivering the marketing website	Request IP address	Global edge network

Two clarifications. The Gmail, Instagram and WhatsApp integrations are off unless you turn them on, per user and per company — if you never connect them, nothing is ever sent. And we determine a visitor’s country from their IP using a local database so the site can pick a language: that lookup happens on our own server, and nothing is sent to the database vendor.

Beyond this list, we disclose personal information only when the law requires it, and to professional advisers under confidentiality. If NexiNext is ever acquired or merged, your information would transfer with the business; we would tell you before that happened.

11. Where your information is stored

All personal information is stored in the United States — our servers and database are in DigitalOcean’s New York region, and uploaded files are in Amazon S3 in the US East region. This is true no matter where you or your customers are located.

For users in Mexico, this is an international transfer of personal data, made so that we can provide the Service you have contracted for. For users in the European Union or the United Kingdom, transfers rely on the European Commission’s Standard Contractual Clauses and the equivalent UK addendum.

The single exception is CFDI stamping: invoice data goes to our PAC, Facturapi, in Mexico, because Mexican law requires a Mexican authorised provider to stamp it.

12. How long we keep it

Honestly stated, including where the answer is “indefinitely”.

• Account and company data — for as long as the account is open, and then until deletion is requested.
• Fiscal and CFDI records — retained for five years, as Mexican tax law requires. We cannot delete these on request within that period.
• Contracts and their signature evidence — retained for the life of the account, since their evidentiary value is the reason they exist.
• Audit and version history — retained for the life of the account.
• Suppressed-notification and automation logs — automatically deleted after 90 days.
• Activity log, on your phone and in your browser — seven days on the device, counted from when each event happened, and seven days on our servers, counted from when we received it, whether it came from the phone or inside a problem report sent from your browser. The two windows are independent and run on different clocks: the one on your device runs whether or not you ever send us anything. On the device, signing out — or requesting the deletion of your account — deletes that account’s log; if we end your session instead, the log stays there, readable by nothing and sent by nothing, until you sign in on that device again or the seven days run out. The server-side deletion runs nightly and no setting can extend it. When an account is closed, its logs are erased outright — not anonymised, not kept in any aggregate — whether or not the seven days have run.
• Your Recent work list — kept by number, not by time: the 50 records you opened most recently in each company, each with only the last time you opened it. Each time you open another, any entry beyond the 50 is permanently deleted, and anything you remove or clear is deleted at once, not hidden. There is otherwise no time limit: if you stop using NexiNext, your last 50 entries stay until one of the following happens. The whole list is deleted when you turn it off in My account or your NexiNext account is deleted, and a company’s list when that company closes; an entry is deleted when the record it points to is permanently deleted. If your employer deactivates your access to a company, your list there is deleted at once; if your access returns, the list starts empty. If the company moves to a plan that pauses your seat, nothing is deleted, and the list is there again when the seat is restored.
• Time off and hire date — kept for as long as the company’s account exists, with nothing deleted on a schedule: every request with the days it cost and the decision on it, each year’s allowance with any change made to it, and the hire date. They stay when an employee leaves the company, and if you delete your NexiNext account they stay in the company’s records, attributed to an anonymised placeholder. They are deleted or anonymised with the rest of the company’s data when its account closes.
• Working hours and pay — kept for as long as the company’s account exists: every change to your contracted hours and pay, with the earlier figures, and every payment recorded for you. The cost of each hour you logged stays with that hour. They stay when an employee leaves the company. If you delete your NexiNext account, an hourly cost typed directly on your profile is cleared, and the rest stays in the company’s records, attributed to an anonymised placeholder. A pay record the company deletes is erased at once, not kept in a deleted state. All of it is deleted or anonymised with the rest of the company’s data when its account closes.
• Compete — points, streaks, badges, weekly totals and bonus awards are kept for as long as the company’s account exists, with nothing deleted on a schedule. They stay when an employee leaves, and when the record that earned the points is deleted. If you delete your NexiNext account they stay in the company’s records, attributed to an anonymised placeholder. A badge awarded by hand can be withdrawn within 24 hours, and the Product Champion badge moves with that role; nothing else is taken back. All of it is deleted or anonymised with the rest of the company’s data when its account closes.
• Records you delete in the app — removed from your view immediately and retained in the database in a deleted state, so that an accidental deletion can be undone. They are permanently erased when you close your account or ask us to erase them — except the AI work records of the next item, which are erased on their own fixed windows.
• AI work on tasks — a draft of ideas and files that an employee’s assistant left on a task (section 8), and that its person never published, is discarded with its files 30 days after it last changed, or at once if the task is deleted; while the company has AI work turned off, such drafts are hidden and the 30 days still run. Ideas the person unticks before publishing are discarded when the draft is published. A deleted idea can be restored exactly as it was — the idea, its files and its conversation together — for 7 days, and is then erased. A published idea that nobody chose, and whose file nobody moved into the task’s files, is erased 30 days after its task is completed or deleted; reopening the task starts the 30 days again. Erasing removes the idea’s contents, its files that were not moved into the task, and its conversation with its attachments. Kept for as long as the task is: chosen ideas, ideas whose file was moved into the task, the summary of each published draft and the conversation on it, the decisions recorded from ideas, and the task’s history of what happened.
• What the app keeps on your phone — deleted when you sign out, remove the account from the app or delete your account. A company’s copy is deleted when you lose access to that company or it closes, and after 30 days in which you have not opened it in the app. Changing the app’s language deletes all of it.
• WhatsApp messages and agreements — kept as long as the customer record they belong to, and deleted with it when the company removes that customer. Messages from a number that is never matched to a customer are deleted 90 days after the last one. The email address, IP address and browser recorded when a confirmation code is sent are deleted after 90 days; the address and the time the code was entered stay with the agreement as its proof. When a company closes, its WhatsApp is disconnected and nothing more is received.
• Answers to a company’s questions — kept with the company’s own record of the work, as long as the company keeps it. The questions stop taking answers 30 days after they were sent, or sooner if the company closes them or the work is completed or deleted. On the public page, the email address, IP address and browser recorded when a code is requested are deleted after 90 days; the verified address stays with the answers as their proof.

When an account is closed, we delete or anonymise its data within 90 days, except for records we must keep to meet the tax and legal obligations above.

13. Your rights

Wherever you live, you may ask us to:

• Access the personal information we hold about you, and get a copy of it
• Correct anything inaccurate or incomplete
• Delete it, subject to the retention obligations in section 12
• Object to or restrict how we use it
• Port it to another provider in a machine-readable format
• Withdraw consent you have given, at any time, without affecting what was done before

If you are in Mexico, these are your ARCO rights — Acceso, Rectificación, Cancelación and Oposición — under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares. The Spanish-language Aviso de Privacidad sets out the procedure and the statutory deadlines in full.

If you are in the European Union or United Kingdom, these are your rights under the GDPR, and you may complain to your national supervisory authority.

If you are in California, you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing — though as section 9 says, there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.

How to make a request. Email privacy@nexinext.com with what you want and enough detail for us to find your records. We may ask you to verify your identity — we are not going to hand over someone’s data to whoever asks for it. We will respond within 30 days (for ARCO requests, within 20 business days, and if granted we will act on it within a further 15 days). Requests are free; we may charge only for repeated or excessive copies, and we will tell you before we do.

One limit, repeated from section 3: if your data was entered into NexiNext by a business you deal with, that business decides what happens to it. We will forward your request to them.

14. How we protect it

• All traffic is encrypted in transit with TLS, and it is enforced — there is no unencrypted route in.
• Passwords are hashed with bcrypt at a deliberately slow work factor.
• Two-factor secrets, integration access tokens, and digital seal passwords are encrypted at rest with authenticated encryption.
• Two-factor authentication is available by authenticator app, SMS or email, with backup codes, and is mandatory for our own administrative accounts.
• Sign-in, password reset, two-factor and payment endpoints are rate-limited, and accounts lock after repeated failed attempts.
• Access within a company is governed by roles; data belonging to one company is scoped away from every other.
• When our support staff need to work inside a company’s account, they must first confirm their identity with a second factor, the access ends after 60 minutes, and it is recorded in the company’s audit log.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you and the relevant authority as the law requires.

15. Children

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

16. Changes to this policy

We will update this page when our practices change, and the date at the top will change with it. For anything that materially affects your rights we will notify account holders by email before it takes effect. Continuing to use the Service after that means you accept the updated policy.

17. Contact

NexiNext LLC
26119 Interstate 45 N, Suite 305
Spring, TX 77380
United States
Privacy: privacy@nexinext.com
General: hello@nexinext.com

If you are unhappy with how we have handled a privacy request, please tell us first — we would rather fix it. You also have the right to complain to your data protection authority.