GDPR & UK Data Protection Compliant

Privacy Policy

Effective Date: September 20, 2026•Version: 2.0 (Production Candidate)•Data Controller: NextPagee Inc.

Legal Disclaimer — Draft Baseline Notice

This Privacy Policy has been drafted as a comprehensive, compliant-structured baseline reflecting NextPagee's real architecture, third-party sub-processors, and data workflows. However, this document does not constitute formal legal counsel. Before serving paying customers or conducting public commercial business in production, you should have qualified legal counsel review and tailor this policy to your specific corporate structure, jurisdiction, and regulatory requirements (such as the EU/UK GDPR, ePrivacy Directive, and CCPA/CPRA).

1. Overview & Scope

NextPagee Inc. ("NextPagee", "we", "our", or "us") provides a software-as-a-service platform that enables creators, software developers, and businesses to build, customize, and publish high-converting landing pages for mobile and web applications.

This Privacy Policy describes our practices regarding the collection, storage, use, and protection of personal data when you:

Register an account, manage subscriptions, or use our visual landing page editor as a Platform Creator.
Browse our primary marketing website at nextpagee.com as a Site Visitor.
Access or view public landing pages published by creators on custom domains or NextPagee subdomains as an End User / Tenant Visitor.

2. What Data We Collect and Why

We adhere strictly to the data minimization principle under Article 5(1)(c) of the GDPR. We only collect personal data strictly necessary to fulfill our service commitments:

A. Creator Account & Identity Data

Creators

What we collect: Name, email address, external OAuth profile identifiers (e.g., Google or GitHub authentication ID), profile image avatar, and unique internal customer ID.

Why we collect it: To authenticate your login sessions via Clerk, provision your multi-tenant workspace, send transactional notifications (e.g., password resets, page publishing alerts), and provide customer support.

B. Landing Page Configurations & Media Assets

Content Storage

What we collect: Page schemas (headlines, feature copy, layout options, FAQs), custom domain names, app store URL links, uploaded application screenshots, brand logos, and customer testimonials.

Why we collect it: To persist your page design in our database (Supabase) and render public web pages at edge nodes (Vercel CDN).

C. Payment & Subscription Data

Billing

What we collect: Stripe Customer ID, active subscription plan, billing cycle dates, country/postal code for tax calculation, and transaction history.

Important: We never store or receive full credit/debit card numbers or CVV codes on our servers. All cardholder payments are encrypted and processed directly by Stripe under PCI-DSS Level 1 compliance.

D. Public Visitor Telemetry & Analytics

Visitors

What we collect: Page view timestamps, anonymized HTTP referrer, device category (desktop, mobile, tablet), browser user-agent, and country-level geolocation derived transiently from IP headers.

Privacy guarantee: Our visitor telemetry does not use persistent cross-site tracking cookies, does not correlate identities across separate creators, and does not build advertising profiles. Full IP addresses are discarded immediately after geolocation aggregation.

E. Tenant Waitlist / Newsletter Submissions

End Users

What is collected: Email addresses and submission timestamps submitted voluntarily by visitors on a creator's published landing page waitlist form.

Controller distinction: The creator operating the landing page acts as the independent Data Controller for their collected subscriber list. NextPagee processes and stores these records solely as a Data Processor on behalf of the creator.

3. Legal Bases for Processing (GDPR Article 6)

Under European Union and United Kingdom data protection law, we must maintain a valid legal basis for every processing activity:

Performance of a Contract (Art. 6(1)(b))

Processing necessary to deliver the NextPagee service in accordance with our Terms of Service: provisioning creator accounts, hosting pages, saving configurations, executing publishing requests, and handling customer support.

Consent (Art. 6(1)(a))

Where you have granted explicit opt-in consent: non-essential analytics tracking, marketing communications, and third-party functional video embeds. Consent can be withdrawn at any time without detriment.

Legitimate Interests (Art. 6(1)(f))

Processing necessary for our legitimate operational interests: safeguarding platform security, mitigating DDoS attacks, preventing malicious fraud, and storing strictly necessary session and consent tokens.

Legal Obligation (Art. 6(1)(c))

Compliance with binding legal and regulatory requirements: retaining financial invoices, VAT/sales tax records, corporate accounting logs, and honoring lawful law enforcement subpoenas.

4. Third-Party Sub-processors and Infrastructure

We engage carefully selected third-party service providers ("Sub-processors") to supply mission-critical infrastructure. Each provider is bound by strict Data Processing Addenda (DPAs) ensuring equivalent security and data protection standards:

Provider	Function	Data Processed	Location & Safeguards
Clerk, Inc.	User Authentication & Sessions	Email, name, OAuth tokens, login IP, session tokens	United States (EU-US DPF / SCCs)
Supabase Inc.	Cloud Database & Media Storage	Page configurations, waitlist emails, uploaded image files	AWS EU/US regions (Encrypted at rest, AES-256)
Stripe, Inc.	Payment Processing & Subscriptions	Billing name, address, payment tokens, invoice records	United States / Global (PCI-DSS Level 1)
Vercel Inc.	Edge Hosting & Content Delivery	Transient HTTP requests, edge cache, SSL certificates	Global Edge Anycast Network (SCCs)
Google Fonts (Alphabet)	Typography Delivery	Font stylesheet requests (zero cookies set)	United States / Global CDN

5. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered:

Active Creator Accounts: Account profiles and published landing pages are retained for the duration of your active account subscription.
Deleted Pages & Closed Accounts: When you delete a landing page or close your account, associated databases records and uploaded storage assets are flagged immediately and permanently purged from primary storage within 30 days.
Visitor Telemetry: Raw telemetry events are aggregated into high-level daily metrics (views, referrers) and raw logs are purged within 90 days.
Tax & Billing Invoices: Payment transaction records are archived for 7 years to comply with federal, state, and international corporate tax legislation.
Cookie Consent Records: Consent status cookies are stored on your local device for up to 12 months (365 days) unless cleared earlier by the user.

6. Your Rights & Right to Erasure ("Right to be Forgotten")

Under the GDPR (Articles 15–22), UK Data Protection Act 2018, and California Consumer Privacy Act (CCPA/CPRA), you have significant legal rights over your personal data:

The Right to Erasure / Deletion ("Right to be Forgotten")

You have the absolute right to request the permanent deletion of your personal data. When you initiate an account deletion request, NextPagee will:

Purge your profile and identity credentials from our authentication system (Clerk).
Permanently erase all landing page configurations and custom domain mappings.
Delete all image assets, screenshots, and logos uploaded to our Supabase object storage buckets.
Erase any collected waitlist submissions associated with your account.

Right of Access (Art. 15)

Request a complete copy of the personal information we maintain regarding your account.

Right to Rectification (Art. 16)

Update or correct inaccurate or incomplete profile and organization details anytime via account settings.

Right to Data Portability (Art. 20)

Export your landing page design schemas and section configurations in standard, machine-readable JSON format.

Right to Withdraw Consent (Art. 7(3))

Revoke previously granted consent for analytics or marketing cookies at any time via our Cookie Settings controls.

To exercise any of these rights, email our data privacy team at privacy@nextpagee.com. We respond to all verified requests within 30 calendar days as required by law.

7. International Data Transfers

NextPagee operates globally. Your information may be transferred to, stored, and processed in the United States and other countries where our sub-processors maintain cloud facilities.

When transferring personal data originating in the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not received an adequacy decision from the European Commission, we implement legally recognized safeguards, including:

Standard Contractual Clauses (SCCs) adopted by the European Commission.
The UK International Data Transfer Addendum.
Participation by our sub-processors in the EU-U.S. Data Privacy Framework (DPF).

8. Cookies & Tracking Technologies

In accordance with the EU ePrivacy Directive and UK PECR, we classify cookies and browser storage technologies into three distinct categories:

Strictly Necessary CookiesExempt from prior opt-in

Essential for user authentication (Clerk session tokens), CSRF attack prevention, and persisting your cookie consent decision (nextpagee_consent). Under GDPR Article 6(1)(f), prior consent is not required because these are technically indispensable to deliver the service you explicitly requested.

Privacy-First AnalyticsRequires Opt-In Consent

Measures page view volumes, referrers, and device types. Our analytics script is completely blocked from firing until you explicitly select "Accept All" or enable analytics in your preferences.

Functional & External MediaRequires Opt-In Consent

Enables third-party embedded widgets (such as YouTube or Vimeo video previews) on landing pages. Blocked until explicit consent is granted.

You can adjust or revoke your consent preferences at any time by clicking the "Manage Cookie Preferences" button above or using the "Cookie Settings" link in any page footer.

9. Data Security Commitments

We implement industry-standard technical and organizational security measures to protect your data against unauthorized access, loss, or alteration:

Encryption in Transit: 100% of traffic is encrypted via TLS 1.3 with automatic HSTS.
Encryption at Rest: All database records and storage buckets are encrypted using AES-256.
Row-Level Security (RLS): Supabase PostgreSQL policies ensure creators can only access data belonging to their verified user identifier.
Least Privilege Access: Production credentials and database access are strictly restricted and audited.

10. Privacy Contact & Complaints

If you have any questions, requests, or grievances regarding this Privacy Policy or our data practices, please contact our Data Protection team:

NextPagee Inc. — Data Protection Officer

Email: privacy@nextpagee.com

Legal Contact: legal@nextpagee.com

If you reside in the European Union or United Kingdom and are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority (such as the UK Information Commissioner's Office - ICO, or your national Data Protection Authority).