Privacy Policy

This Privacy Policy explains what personal data Nexthome Labs collects when you use NexHost, ProperInbox, Nextsend, and our websites, why we collect it, how long we keep it, and the rights you have over it.

When you use our Services to process personal data of your own customers or users (for example, their email content or delivery events), you are the data controller and we act as your processor under our Data Processing Addendum.

• Account data: name, email address, password hashes, billing details, and organization membership.
• Service data: projects, releases, build logs, domains, DNS records, mailboxes, aliases, sending domains, API tokens, and configuration you create.
• Content you store: source uploads, release artifacts, and email content stored in ProperInbox mailboxes. We do not read mailbox content except as described in this policy.
• Usage and telemetry: log data, IP addresses, device and browser information, delivery events (sends, bounces, complaints), and audit trails needed to operate, secure, and bill the Services.
• Support data: tickets and correspondence you send us.

• Provide, operate, secure, and maintain the Services.
• Process deployments, DNS changes, and email delivery.
• Authenticate users, prevent abuse, spam, fraud, and security incidents.
• Bill you and enforce plan limits.
• Send service communications (receipts, security alerts, incident notices) and, with consent, product updates.
• Comply with legal obligations.

We do not sell personal data. We do not use your mailbox content, source code, or release artifacts to train machine-learning models.

Where the GDPR or UK GDPR applies, we process personal data on the bases of: performance of our contract with you; our legitimate interests in securing and improving the Services; compliance with legal obligations; and, where required, your consent (which you may withdraw at any time, including via Cookie Settings).

We share personal data only with: infrastructure and service providers acting as subprocessors (hosting, DNS, email transport, payment processing, error monitoring) bound by confidentiality and data-protection terms; law enforcement where legally required; and parties to a merger or acquisition, subject to this policy.

The current list of material subprocessors and processing locations is maintained on our Compliance page.

We keep account and service data while your account is active. After account closure, Customer Content is retained for a 30-day grace period to allow recovery, then deleted from active systems; encrypted backups roll off within a further 30 days. Billing and audit records are retained as required by tax and law. Transactional email event data is retained for the analytics window shown in your dashboard, then aggregated or deleted.

We protect data with encryption in transit, access controls, isolated build and runtime environments, audit logging, and least-privilege operational access. Details and our responsible disclosure process are on the Security page.

Depending on your location, you may have rights to access, correct, export, restrict, object to, or delete your personal data, and to lodge a complaint with a supervisory authority. Many actions are self-service in the dashboard; otherwise email [email protected]. We respond within 30 days.

Data may be processed in the regions where our nodes and subprocessors operate. Where data leaves the EEA/UK, we rely on adequacy decisions or Standard Contractual Clauses, as described in our Data Processing Addendum.

We may update this policy from time to time. Material changes will be announced through the dashboard or by email before taking effect. The "last updated" date above shows the current version.