Privacy Policy

01Who we are & scope

This Privacy Policy explains how Nextio Technologies, Inc. and its affiliates, including Nextio Technologies B.V. (together, "Nextio", "we", "us"), collect, use, disclose and protect personal information in connection with our websites (including nextio.ai), the Nextio applications and APIs, and our sales, marketing and support activities (together, the "Services").

This policy applies to visitors of our websites, people who contact us or attend our events, and the administrators and users of Nextio workspaces. It should be read together with our Terms & Conditions and, for business customers, our Data Processing Addendum.

02Controller & processor roles

Nextio acts in two different capacities:

• As a controller for personal information we collect for our own purposes — for example, website analytics, account registration details, billing information, marketing communications and support requests.
• As a processor (or service provider) for personal information contained in Customer Data — the content our business customers connect, upload or generate in Nextio. Our customer (usually your employer) is the controller of that data and decides how it is used. If you have questions about how a customer uses Nextio, please contact that customer directly.

03Information we collect

3.1 Information you give us

• Contact and demo requests: name, work email, company, company size, job title, data stack and the content of your message.
• Account information: name, email, password hash or SSO identifier, profile photo, role and workspace settings.
• Billing information: billing contact, address, VAT number and payment details. Card numbers are collected and stored by our payment processor; we only receive the card type, last four digits and expiry date.
• Support and feedback: information you provide when you contact support, report an answer or take part in research.

3.2 Information collected automatically

• Usage data: features used, pages viewed, clicks, timestamps, error reports and performance metrics.
• Device and log data: IP address, browser type, operating system, device identifiers and referring URLs.
• Audit events: security-relevant actions in your workspace, such as sign-ins, permission changes, queries run and actions taken by Agents.

3.3 Information from third parties

We may receive information from identity providers you use to sign in (such as Okta, Google or Microsoft), from partners and resellers, from event organisers, and from publicly available business sources used to understand which companies are interested in Nextio.

04Customer Data & connected sources

When a customer connects sources such as Postgres, Snowflake, BigQuery, Google Drive, Notion, HubSpot, Salesforce, Stripe, Slack or Jira, or uploads files, Nextio accesses that data using the credentials and scopes the customer provides. Depending on the source, we either query data live without storing it, or create encrypted indexes and caches (for example, of documents and messages) to enable search and citations.

We process Customer Data only to provide the Services to that customer, in line with their instructions and our Data Processing Addendum. We respect the access controls of each connected source, so users only see information through Nextio that they could already access in the original system. Customers can disconnect a source at any time, which deletes associated indexes and caches within 7 days.

05AI processing & no training

To answer questions, Nextio sends the minimum necessary context (such as your question, relevant schema information and retrieved records) to AI model providers listed in our subprocessor list. Those providers are contractually bound to process data only to return a response to us, not to use it for training, and to delete it immediately or within a short abuse-monitoring window under zero-data-retention terms.

Enterprise customers can route all model calls to their own model endpoints, cloud accounts or self-hosted models, in which case Customer Data is not shared with our model providers at all. We do not use Nextio to make automated decisions about individuals that produce legal or similarly significant effects.

06How we use information

We use personal information we control to:

• provide, operate, maintain and secure the Services, including authentication and permission synchronisation;
• respond to demo requests, contact forms and support tickets;
• process payments, send invoices and manage subscriptions;
• send service announcements, security notices and, where permitted, marketing emails (you can unsubscribe at any time);
• understand and improve how the Services are used, using aggregated and de-identified metrics;
• detect, investigate and prevent fraud, abuse, security incidents and violations of our Terms; and
• comply with legal obligations and enforce our agreements.

07Legal bases for processing (EEA & UK)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases when acting as a controller:

• Contract — to provide the Services you or your organisation signed up for;
• Legitimate interests — to secure and improve the Services, respond to business inquiries and market to business contacts, balanced against your rights;
• Consent — for non-essential cookies and certain marketing communications, which you may withdraw at any time; and
• Legal obligation — to keep financial records and respond to lawful requests.

08How we share information

We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under California law. We disclose personal information only:

• with subprocessors and service providers who help us operate the Services, under written contracts with confidentiality and data-protection obligations;
• within your workspace, according to the roles and sharing settings your administrators configure;
• with third-party services you connect, when an Agent takes an action you have authorised (for example, posting to Slack);
• in connection with a merger, acquisition or sale of assets, subject to this policy's protections;
• when required by law or to protect the rights, safety and security of Nextio, our customers or others. We review every government request, challenge requests we consider overbroad, and notify affected customers where legally permitted.

09Subprocessors

We use the following subprocessors to process Customer Data. We give workspace administrators at least 30 days' notice before adding a new subprocessor.

A machine-readable version of this list and subscription to change notifications is available on request at privacy@nextio.ai.

10Data residency & international transfers

Customers choose whether each workspace is hosted in our EU region (Frankfurt, Germany) or US region (Virginia, United States). Customer Data at rest — including indexes, caches, logs and backups — remains in the selected region. Limited personal information may be accessed from other locations by our support engineers, on a need-to-know basis and only with customer authorisation for support cases.

Where personal information is transferred out of the EEA, UK or Switzerland, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary measures such as encryption and access controls.

11Data retention

• Customer Data is retained for the duration of the subscription and deleted within 30 days of termination from production systems and within 90 days from backups, unless the customer requests earlier deletion.
• Conversation history follows workspace retention settings, which administrators can set from 7 days to indefinitely.
• Audit logs are retained for 1 year (Business) or up to 7 years (Enterprise), or as configured.
• Account and billing records are kept for as long as the account is active and afterwards as required for tax and accounting purposes (typically 7 years).
• Marketing and contact-form data is retained for up to 24 months after our last interaction, unless you ask us to delete it sooner.

12Security

We protect information with industry-standard safeguards, including encryption in transit (TLS 1.2+, TLS 1.3 preferred) and at rest (AES-256), customer-managed encryption keys for Enterprise customers, SSO and SCIM, role-based access controls, least-privilege employee access with hardware-key MFA, logical tenant isolation, continuous vulnerability scanning and annual independent penetration tests. Nextio is audited annually against SOC 2 Type II and ISO/IEC 27001.

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify affected customers and, where required, regulators and individuals, in accordance with applicable law. To report a vulnerability, contact security@nextio.ai.

13Your privacy rights

Depending on where you live, you may have the right to:

• access and receive a copy of your personal information;
• correct inaccurate or incomplete information;
• delete your personal information;
• object to or restrict certain processing, including direct marketing;
• port your information to another service in a machine-readable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with your local data protection authority.

Residents of California and other U.S. states with comprehensive privacy laws have the right to know, delete and correct personal information, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising these rights. You may use an authorised agent to submit a request.

To exercise your rights, email privacy@nextio.ai. We will verify your request and respond within 30 days (or 45 days where permitted). If your request concerns Customer Data processed on behalf of your employer, we will forward it to that customer and assist them in responding.

14Cookies & analytics

We use a small number of cookies and similar technologies:

• Strictly necessary cookies for sign-in, security and load balancing. These cannot be switched off.
• Preference cookies to remember settings such as your workspace region and display preferences.
• Analytics cookies, used only with your consent in the EEA and UK, to understand how our marketing website is used in aggregate. We use privacy-friendly analytics with IP anonymisation and no cross-site tracking.

We do not use advertising cookies inside the Nextio application. You can change your cookie choices at any time through the cookie settings link in our website footer or through your browser settings. We honour Global Privacy Control signals.

15Children's privacy

The Services are designed for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

16Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and notify workspace administrators by email or in-app notice at least 30 days in advance, unless a change is required sooner by law. Previous versions are available on request.

17Contact & Data Protection Officer

If you have questions about this policy or how we handle your information, please contact us:

Nextio Technologies, Inc.
Attn: Privacy & Legal
548 Market Street, Suite 300
San Francisco, CA 94104, United States
Email: privacy@nextio.ai · Legal: legal@nextio.ai

EU establishment & Data Protection Officer: Nextio Technologies B.V., Keizersgracht 241, 1016 EA Amsterdam, the Netherlands — dpo@nextio.ai

You also have the right to contact your local supervisory authority. Our lead supervisory authority in the EU is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).