Privacy policy

1. Data controller

Cosmolabs OÜ (trading as NextAI), registry code 17106582, Ahtri tn 12, 15551 Tallinn, Estonia. Email for privacy matters: hola@nextai.pro.

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Estonian data protection law.

2. Data we process and purposes

• Contact form and email: name, email and message, in order to handle your request and continue the commercial conversation.
• Digital audit and session booking: name, job title, email, phone, company, website, sector and description of the challenge, in order to produce the assessment, book the slot and send you the report.
• IMAN test: the questionnaire answers together with company and email, in order to calculate your maturity index and send you the result.
• Paid services: billing and order data. Payment is processed by Stripe; NextAI does not store full card numbers.
• User account (private areas): email, name and role, in order to authenticate you and give you access.
• Browsing: aggregated technical and usage data and —only with your consent— analytics and advertising measurement cookies.

3. Legal bases

• Performance of a contract or of pre-contractual steps: delivery of services, audits, bookings and payments.
• Consent: sending commercial communications and non-essential cookies. Revocable at any time.
• Legitimate interest: site security, abuse prevention and contacting professionals about services related to their activity.
• Legal obligation: retention of accounting and tax records.

4. Retention periods

We keep the data for as long as there is a relationship with NextAI and, afterwards, blocked for the applicable limitation periods. Contact requests and unconverted leads are kept for a maximum of 24 months; accounting records, 7 years; data processed on the basis of consent, until you withdraw it.

5. Recipients and processors

To deliver the service we rely on suppliers acting as data processors, under a contract in line with Article 28 of the GDPR: hosting and application platform (Base44), AI model providers used to generate assessments and content, transactional email delivery, and Stripe for payments.

Some suppliers may process data outside the European Economic Area. In that case, transfers are covered by adequacy decisions or by the European Commission's Standard Contractual Clauses, with supplementary measures.

We do not sell personal data and we do not pass it on to third parties for their own advertising purposes.

6. AI-generated content

The assessments, reports and analyses on the site are produced with artificial intelligence systems, based on the information you provide and on public sources. They are indicative, they are reviewed by people before any significant decision, and they are not used to take automated decisions with legal effects on you.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent by writing to hola@nextai.pro. We will reply within one month at the latest.

If you believe we have not handled your request properly, you can lodge a complaint with the Estonian data protection authority (Andmekaitse Inspektsioon, aki.ee) or with the authority in your country of residence.

8. Security

We apply technical and organisational measures proportionate to the risk: encryption in transit, role-based access control, data minimisation and activity logging. No system is infallible; should a breach occur that poses a risk to your rights, we would inform you in accordance with the GDPR.