Privacy policy

1. Who the controller is

The controller of the data described in this policy is:

• Identity: [PENDING: owner's name] (tax ID [PENDING: NIF]), trading as NextAura
• Address: [PENDING: address]
• Privacy contact email: [PENDING: email]

If a data protection officer is appointed (article 37 of Regulation (EU) 2016/679, GDPR, and article 34 of Spanish Organic Law 3/2018, LOPDGDD), their contact details will appear in this section and will be notified to the Spanish Data Protection Agency. In the meantime, any privacy matter is handled at the email address above.

2. Two different roles: controller and processor

We process personal data in two different roles, and it is worth telling them apart:

• As controller, we process the data of people who visit the website, create an account, use the dashboard, subscribe to the service or write to us: this is what this policy explains.
• As processor, we process on behalf of each customer organisation the data of its devices, its network and the people who use those devices (inventory, metrics, vulnerabilities, alerts, network discovery, remote access sessions, scripts and, if the organisation turns it on, activity history). That organisation is the controller of that data and we only process it on its instructions, under the Data processing agreement (article 28 GDPR).

If you use a device on which your organisation has installed the NextAnalyzer agent, the controller of your data on that device is your organisation, not us: contact it to exercise your rights. If you write to us, we will forward your request to your organisation.

3. What data we process and where it comes from

We process the following categories, which we obtain from you, from your organisation (for example, when it invites you or signs you in with its identity provider) or from your use of the service:

• Account data: name, email address, language, password (only its irreversible derivation), second-factor settings, your identifier at your organisation's identity provider if it uses single sign-on (SSO), open sessions (browser and IP) and notification preferences, including your subscription to the weekly summary.
• Organisation data: name, each person's role, members and invitations.
• Billing data: company name or full name, tax ID, address, country, billing email, the result of validating your intra-EU VAT number in the VIES system and the invoicing records required by law (VeriFactu). Card details are collected directly by the payment gateway; we neither see nor store them.
• Support data: the tickets you open, their messages, the attachments you upload (images or PDF), the affected devices you indicate and your rating of the support received.
• Data on the use of artificial intelligence features: which analyses are requested, when and by whom, and the generated result.
• Security and audit logs: actions performed in the dashboard and the API, sign-ins and their origin, API keys (only their fingerprint) and accesses by our support team to your organisation.
• Proof of acceptance of legal documents: document, version, date, IP and browser.
• Visitors to the public website: the IP address and technical request data, which the server uses to serve the page and protect itself against abuse, and the currency you choose to view prices in. The server's technical logs are kept for a maximum of thirty days and then deleted. We do not use analytics or visitor profiling.

The data that forms mark as mandatory (name, email and password to create the account; tax details to invoice) is necessary to enter into and perform the contract or is required by law: without it we cannot create the account or issue invoices. The rest is optional.

4. Why, on what legal basis and for how long

• To create and manage your account and provide the contracted service (including the free trial, single sign-on and the API). Basis: performance of the contract (art. 6.1.b GDPR); for members invited by a customer, that customer's and our legitimate interest in providing the service to it (art. 6.1.f). Retention: while the account is active. When deletion of the organisation is requested, its data is deleted after thirty days (until then, it can be cancelled), and your account when it no longer belongs to any organisation.
• To invoice, collect payments and comply with tax and accounting obligations, including VeriFactu records and their submission to the Spanish Tax Agency. Basis: legal obligation (art. 6.1.c; Law 37/1992 on VAT, Royal Decree 1619/2012 on invoicing, Royal Decree 1007/2023 on invoicing software, the General Tax Law and article 30 of the Commercial Code). Retention: six years from the end of the financial year, and longer if a tax procedure is ongoing.
• To ensure the security of the service, detect fraud and abuse and keep the audit log. Basis: legitimate interest (art. 6.1.f) and the security obligation (art. 32 GDPR). Retention: failed sign-in attempts, fifteen minutes; sessions, with their browser and IP, twelve months after they expire or are closed; the audit log, while the organisation exists and, after its deletion, the audit log is kept blocked for up to three years to handle claims and requests (limitation period for infringements under article 72 of the LOPDGDD).
• To handle your enquiries and support tickets. Basis: performance of the contract or pre-contractual steps (art. 6.1.b). Retention: resolved tickets are deleted with their messages and attachments twelve months after being resolved (configurable period); earlier if your user or the organisation is deleted.
• To ask you once, by email, to rate the support received after a ticket is resolved, if you have not done so yet. Basis: legitimate interest in measuring and improving support quality (art. 6.1.f). There are no reminders or promotional content, and you can object by writing to us.
• To generate, when you or your organisation request it, analyses and texts with artificial intelligence (vulnerability explanations, priorities, device analyses, report summaries, remediations written for vulnerabilities without a remediation in the catalogue and the weekly email summary). Basis: performance of the contract (art. 6.1.b). Before sending them to the AI provider, we minimise the data (see below). Retention: the latest result of each analysis is kept while the organisation exists, to show it in the dashboard.
• To send you the weekly security summary by email, if you turn it on in your account (Business and Enterprise plans). Basis: your request within the contract (art. 6.1.b). You can turn it off at any time from My account.
• To send you necessary service communications (verification, security notices, alerts you have enabled, invoices and changes to the terms). Basis: performance of the contract. They are not commercial communications.
• To prove that you accepted the terms and legal documents. Basis: legitimate interest in being able to prove it and defend against claims (art. 6.1.f). Retention: the duration of the relationship and, afterwards, blocked for the limitation periods of any claims.

At the end of each period, data is deleted or, where the law requires it, kept blocked and available only to courts and public authorities for the limitation period of any liabilities (art. 32 LOPDGDD).

5. Artificial intelligence

The artificial intelligence features use Claude models from the provider Anthropic, through its commercial API. Under its commercial terms, Anthropic does not use data received through the API to train its models.

Before sending anything, the platform minimises the data: device names are replaced by aliases, and no user names, email addresses, full page addresses, public IP addresses or MAC addresses are sent, and only the range of private IP addresses. Activity history, event logs, serial numbers and support chat content are never sent. Remediations written by AI for vulnerabilities without a remediation in the catalogue only send the CVE identifier, the operating system and the language, with no organisation data.

All AI-generated content is identified as such in the dashboard, in PDF reports and in emails («AI-generated»), in accordance with article 50 of Regulation (EU) 2024/1689 on artificial intelligence, and must be reviewed before acting on it. The AI does not take decisions about people or apply changes on its own: a remediation is only executed if a person in the organisation creates and approves it.

The artificial intelligence features are not intended to monitor or evaluate the performance or behaviour of employees, or to take decisions about their employment relationship, and may not be used for that purpose (which would make them a high-risk system under Annex III of the AI Act). That is why they do not receive the activity history, account names or the data that identifies who uses each device.

6. Who we share data with

We do not sell your data or share it for commercial purposes. We only share it with:

• Providers of necessary services acting as processors, under a contract in accordance with article 28 GDPR: server hosting, transactional email, the payment gateway and the artificial intelligence provider (Anthropic), the latter only with minimised data. The current list, with their location and safeguards, is in Annex III of the Data processing agreement.
• The payment gateway, Stripe Payments Europe Ltd. (Ireland), which also processes payment data as an independent controller for its own legal obligations, such as fraud and money-laundering prevention.
• The Spanish Tax Agency and the European Commission (VAT number validation in VIES), when tax law requires it.
• The services your organisation connects on its own (Microsoft Teams, Slack, webhooks, Jira, Freshdesk, HaloPSA, its identity provider or others): they receive what the organisation configures, on its instructions and under its responsibility.
• Public authorities, judges and courts where required by law.

7. International transfers

We host the platform in the European Economic Area. Some providers process data outside it: the artificial intelligence provider (Anthropic, in the United States) and, where applicable, companies in the payment gateway's group. In those cases we apply appropriate safeguards: the adequacy decision for the EU-US Data Privacy Framework where the entity is certified and, in any case, the standard contractual clauses approved by the European Commission included in their data processing agreements, with supplementary measures such as encryption in transit and prior minimisation (articles 45 and 46 GDPR). You can ask us for a copy of those safeguards at [PENDING: email].

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, by writing to [PENDING: email] and stating the right you are exercising. We may ask you to prove your identity if there are reasonable doubts. You can view, correct or export much of your data yourself from the dashboard (My account, Billing and the exports); the owner of an organisation can download a complete export of its data in JSON from Settings at any time. You can also object to processing based on legitimate interest on grounds relating to your particular situation.

We will reply within one month, extendable by two further months if justified by the complexity or number of requests (article 12 GDPR). Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

If you consider that your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid). Beforehand, if you prefer, you can write to us to try to resolve it.

9. Automated decisions

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (article 22 GDPR). The security score of devices is informative, is calculated by the platform with a deterministic formula on technical data and does not profile people.

10. How we protect your data

We apply technical and organisational measures appropriate to the risk (article 32 GDPR), including: communications encrypted with TLS and mutual certificate authentication between devices and the platform; passwords stored with a slow key derivation function (scrypt); two-factor authentication; sessions with encrypted, protected cookies; strict separation between customer, staff and device access; role-based access control; encrypted secrets; an audit log of sensitive actions; and minimisation of the data sent to artificial intelligence models. Details are in Annex II of the Data processing agreement.

If a personal data breach occurs, we will notify the supervisory authority within seventy-two hours where required and, if it entails a high risk for you, we will inform you without undue delay (articles 33 and 34 GDPR).

11. Minors and professional use

The service is aimed at professionals and organisations. It is not intended for children under 14 and we do not knowingly collect their data as controller. If you believe a minor has provided us with data, write to us and we will delete it. If an organisation uses the service on devices used by minors (for example, a school), that organisation is responsible for that processing.

12. Cookies

We only use technical cookies and local storage, or those for preferences you choose. Details are in the Cookie policy.

13. Changes to this policy

We may update this policy to reflect legal or service changes. When the change is significant we will notify you by email and in the dashboard, and the current version and its date will always be on this page.