Privacy Policy

Last updated: April 2026

Nextraxion ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform at nextraxion.com.

1. What Data We Collect

Account data: Your name, email address, and organisation details provided during registration.

Documents: Files you upload to the platform for processing (PDFs, Word documents, and other supported formats).

Extracted data: Structured data fields produced by our AI extraction engine from your uploaded documents.

Billing data: Payment information processed by Stripe. We do not store full card details — these are handled directly by Stripe.

Usage data: Information about how you use our platform, including pages visited, actions taken, and feature interactions, collected via Google Analytics.

Support communications: Any messages you send to us via email or our enquiry form.

2. How Your Data Is Used

To provide, operate, and improve the Nextraxion platform.
To extract and structure data from your documents as requested.
To manage your account, subscription, and billing.
To send transactional emails such as invitations, receipts, and service notifications.
To analyse usage patterns and improve the platform experience.
To respond to support enquiries.

Important: Your documents and extracted data are never used to train shared AI models. Any corrections you make to extracted fields only improve accuracy within your own organisation and are never shared with other organisations or used to train general-purpose models.

3. Data Retention

Documents: Uploaded documents and all associated extracted data are automatically and permanently deleted 30 days after upload. This deletion is irreversible.

Account data: Retained for as long as your account remains active. Upon account deletion, your personal data is removed within a reasonable period.

Billing records: Retained as required for legal and financial compliance purposes.

Credit logs: Aggregated usage and credit history may be retained for billing audit purposes.

4. Security Measures

Infrastructure: Nextraxion is hosted on Google Cloud Platform (GCP), one of the world's leading cloud providers with enterprise-grade physical and network security.

Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).

Encryption at rest: All stored data — including documents and extracted data — is encrypted at rest using AES-256 encryption.

Third-party compression: Documents exceeding 10MB are automatically compressed via iLoveAPI prior to extraction. During this process, the document is temporarily transmitted to iLoveAPI's GDPR-compliant servers and deleted within 2 hours. If you have data residency or sub-processor restrictions that prevent this, please contact us before uploading documents of this size.

Access controls: Role-based access controls ensure team members only see data relevant to their permissions within your organisation.

Audit logs: All document access and validation actions are logged for security and compliance purposes.

5. Third-Party Services

We use the following third-party services to operate the platform:

Google Analytics

Used to analyse platform usage and improve the user experience. Google may process anonymised usage data in accordance with their privacy policy.

Stripe

Used to process subscription payments and top-up credit purchases. Stripe handles all payment card data directly and is PCI-DSS compliant.

Base44

The underlying application platform that provides authentication, database infrastructure, and serverless functions. Your data is stored within Base44's infrastructure on Google Cloud Platform.

SendGrid

Used to send transactional emails such as invitations and notifications. Email content may pass through SendGrid's servers.

iLoveAPI

Used to compress PDF documents that exceed 10MB in file size prior to extraction. Documents are transmitted to iLoveAPI's servers over encrypted HTTPS, processed, and automatically deleted within 2 hours of processing. iLoveAPI servers are located in Europe and are GDPR compliant and ISO/IEC 27001 certified.

6. Your Rights

Under applicable data protection law (including GDPR), you have the following rights:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your personal data.
Restriction: Request that we limit the processing of your data in certain circumstances.
Portability: Request your data in a structured, machine-readable format.
Objection: Object to processing of your data for certain purposes.

To exercise any of these rights, contact us at hello@nextraxion.com. We will respond within 30 days.

7. Cookies

We use cookies and similar technologies to maintain your session, remember your preferences, and collect anonymised analytics data via Google Analytics. By continuing to use Nextraxion, you consent to our use of cookies. You can disable cookies in your browser settings, though this may affect platform functionality.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on the platform. Continued use of Nextraxion after changes are posted constitutes your acceptance of the updated policy.

9. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

Nextraxion

hello@nextraxion.com