Privacy Policy

NextGen Intelligence LLC (“NextGen Intelligence”, “we”, “us”, “our”) is the data controller for the personal data described in this policy. We operate the website at nxtgen-intel.com and the software products and services available through it (the “Services”), including VeriMed, Shesha Pay, ConsortAI, Operna, PeoplePulse, Calibre, Lync Africa, Euktos, Arc, Relay and Velos (each a “Product”).

NextGen Intelligence LLC is a remote-first company operating across South Africa, the United States, Mauritius, Brazil and Sri Lanka.

• Privacy contact: [email protected]
• Data Protection Officer: [email protected]
• EU/UK data protection enquiries: [email protected]
• General: [email protected]

This policy applies to personal data we process as a controller through the Services and our marketing. It does not apply to: (a) third-party websites or services linked from the Services; (b) personal data we process on behalf of a customer organisation as a processor (governed by our Data Processing Addendum and that customer’s own privacy policy); or (c) data you choose to share publicly.

3.1 Information you provide

Account and registration data (name, work email, employer, role, password); profile data; content and inputs you submit to the Services (“Content”, including prompts and files); billing and contact details; and communications you send us (support requests, applications to [email protected]).

3.2 Information we collect automatically

Usage and telemetry data (features used, actions taken, timestamps); device and connection data (IP address, browser, operating system, approximate location derived from IP); and cookies and similar technologies (see Section 6 and our Cookie Policy).

3.3 Information from third parties

Authentication data from single sign-on and identity providers you choose; data from integration partners you connect; and business-contact data from publicly available or commercial sources used for B2B marketing.

3.4 Sensitive information

We do not seek special-category data. Some Products may process data a customer designates as sensitive (for example, workforce data in PeoplePulse). Where this occurs, we process it as a processor on that customer’s instructions under the DPA, not for our own purposes.

4.1 To provide the Services

Create and manage accounts, deliver Product features (including AI features), process Content, and provide support. Legal basis: contractual necessity.

4.2 To communicate

Service messages, security and billing notices, and (with your consent or as permitted for existing B2B relationships) marketing you can opt out of at any time. Legal basis: contractual necessity; legitimate interests; consent where required.

4.3 To secure and improve the Services

Fraud and abuse prevention, diagnostics, and improving features. We improve the Services using aggregated and de-identified data and our own operational telemetry. We do not use your Content to train AI models (Section 11). Legal basis: legitimate interests.

4.4 To comply with law and protect rights

Meet legal obligations, enforce our terms, and protect users and the public. Legal basis: legal obligation; legitimate interests.

4.5 With your consent

For any purpose we describe to you and you agree to. Legal basis: consent (withdrawable at any time).

Certain Products — for example PeoplePulse and Arc — are built so that an individual’s private Content is separated from organisational administrator access. Where a Product operates this way:

• What is walled off from organisational admins: an individual’s private inputs, prompts, draft work, individual AI Outputs, and individual-level responses.
• What an organisational admin can see: aggregate and de-identified engagement and utilisation metrics, licence usage, and anonymised themes that cannot reasonably identify an individual.
• What an organisational admin cannot see: specific individual Content, individual responses, or identified individual analytics.
• How the Wall is enforced: role-based access controls, logical separation between individual and administrative data, and encryption. The Wall is described at the implementation level in DPA Annex 2.
• Exceptions: the Wall yields only where (a) legally compelled, (b) the individual consents to share, or (c) a safety escalation is necessary to prevent serious harm. Each exception is handled narrowly and, where lawful, with notice.

Where a Product does not provide individual workspaces, this section does not apply and the customer organisation controls the relevant data.

We use essential, functional and analytics cookies and similar technologies. Non-essential cookies are set only with consent where required (EU/UK). See our Cookie Policy for categories, durations and how to manage your choices.

7.1 With customer organisations

For Services used through an employer or other organisation, that organisation may access account and usage data associated with its accounts, subject to the Privacy Wall in Section 5 where it applies.

7.2 Service providers (subprocessors)

We share data with vetted providers who process it on our behalf under contract, including cloud hosting, AI model providers, communications and payments. Our AI model providers are Anthropic (Claude models) and OpenAI (GPT models), engaged solely to generate the AI Output you request. We do not permit our AI model providers to use your data to train AI models (Section 11). The current subprocessor list is maintained in DPA Annex 3.

7.3 Legal compliance and protection

We disclose data where required by law or to protect the rights, safety and property of users, the public or NextGen Intelligence.

7.4 Business transfers

In a merger, acquisition, financing or sale of assets, data may transfer subject to this policy; we will notify you of any material change in how your data is handled.

7.5 With your consent

Otherwise, only as you direct.

We do not sell personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.

Because we operate across South Africa, the United States, Mauritius, Brazil and Sri Lanka and use global service providers, personal data may be transferred internationally. For transfers of EU/UK/Swiss personal data, we rely on the European Commission’s Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and the Swiss adaptation, as applicable. The operative transfer terms are in the DPA, Section 6.

We maintain administrative, technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access controls, logging and monitoring, and vendor due diligence. The full description is in DPA Annex 2. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

• Account data: for the life of the account plus up to 12 months after closure, unless a longer period is legally required.
• Content: deleted or made available for export within 30–90 days of account termination, unless legally required to retain.
• Telemetry: retained in identified form for up to 24 months, longer in aggregate/de-identified form.
• Backups: purged within 90–180 days of primary deletion.
• Legal holds override the above where applicable.

Some Products use third-party AI models (Anthropic’s Claude and OpenAI’s GPT models) to generate AI Output from your inputs.

We do not make solely automated decisions that produce legal or similarly significant effects about you. Where AI assists a decision, a human remains the decision-maker. You may request human review of any AI-assisted output that affects you (GDPR Article 22 where applicable). See our AI Use & Transparency Policy.

12.1 EU/UK/Swiss (GDPR/UK GDPR)

Access, rectification, erasure, restriction, portability, objection, and rights regarding automated decision-making, plus the right to withdraw consent and to complain to a supervisory authority.

12.2 California (CCPA/CPRA)

The right to know, delete, correct, opt out of sale/sharing (we do neither), and limit use of sensitive personal information, free from discrimination for exercising these rights.

12.3 Other US states

Virginia, Colorado, Connecticut, Utah, Texas and others as enacted: comparable rights to access, correct, delete, port and opt out of targeted advertising and certain profiling.

12.4 South Africa (POPIA)

Rights to access, correct and delete personal information and to object to processing, and to complain to the Information Regulator.

12.5 How to exercise

Email [email protected]. We verify requests and respond within the timeframe the applicable law requires (generally 30–45 days). Authorised agents may submit requests with proof of authority. Where a customer organisation controls your data, we will refer your request to that organisation and assist as a processor.

The Services are intended for users aged 18 or over and for professional/organisational use. We do not knowingly collect personal data from children in the consumer sense. Where a Product is intended for use by minors through an institution (for example, Arc used by a school), that use is governed by a separate agreement and the applicable child-data protections (including parental/institutional consent and, where applicable, FERPA/COPPA-equivalent safeguards). If we learn we have collected a child’s data without a proper basis, we will delete it.

We may update this policy. For material changes, we will notify active users by email or in-product notice before the change takes effect. The “Effective date” above reflects the current version.

We do not sell or share personal information for cross-context behavioural advertising. We do not offer financial incentives for data. Categories of personal information collected, purposes, and retention are described in Sections 3, 4 and 10. To exercise CCPA/CPRA rights, contact [email protected]; you may use an authorised agent.

Legal bases are stated in Section 4. You may contact our Data Protection Officer and EU/UK data protection enquiries point at [email protected]. You may lodge a complaint with your local supervisory authority (for example, the Irish Data Protection Commission or your member-state authority; in the UK, the ICO).

• Privacy: [email protected]
• Data Protection Officer: [email protected]
• Legal notices: [email protected]
• General: [email protected]