Draft privacy notice

1. Who this draft describes

NEXTXEN Technology is the brand used on this website. Contact: info@nextxentech.com. The responsible legal entity, address and applicable jurisdiction must be confirmed before this notice is finalized.

2. Information in the current website

The enquiry form asks for your name, business email, optional store URL, platform, service/package selection, requirements, preferred timeline and consent. These fields are used in your browser to validate and prepare a brief. When online submission is enabled, these details and your consent record are sent to the configured Supabase backend and stored for authorized staff to handle the enquiry. When the form says submission is unavailable, it only prepares a brief in your browser.

The form can read UTM source, medium, campaign, term and content labels from its URL. It keeps the current enquiry-page path and the referrer’s origin, excluding referrer paths and query strings. When enabled, this attribution is included in the submitted enquiry. Otherwise it stays in browser memory with the draft. No localStorage lead database is used.

Optional Google Analytics is disabled unless configured by the owner and allowed by the visitor. Before consent, its script is not loaded. If you allow it, it measures public page interest, catalog selections and confirmed enquiry or signup events using analytics cookies. The integration excludes form details, names, email addresses, phone numbers, requirements, Auth tokens, URL queries and fragments from its explicit events. You can decline or withdraw permission through Analytics preferences when analytics is configured. Google processes technical data to provide analytics; the final notice must confirm the actual account configuration, retention and transfer arrangements. Advertising trackers are not included. When submission is enabled, Cloudflare Turnstile processes verification signals and its token is checked by the backend. IP addresses are used transiently for verification and converted to a keyed hash for rate limits; raw IP addresses are not stored in the application tables. Rate-limit records expire after two hours and replay-protection records after 24 hours; scheduled cleanup must be configured. Infrastructure providers may retain their own logs. Fonts and brand images are served locally. Your hosting provider may process technical request logs, such as IP addresses and browser information; hosting arrangements and log retention still need confirmation.

3. If you choose to email us

You may copy the prepared brief or open an email draft. Opening the draft does not send it. If you choose to send it, your email service and NEXTXEN’s email provider will process the message. Your enquiry details would be used to understand the request, respond and discuss a potential service. Do not include passwords, payment details or private customer records.

4. External product websites

Product links open third-party platform listings. Their privacy notices govern your use of those sites. This website does not install products, accept card details or share your form fields with those listings.

5. Before backend collection begins

A final notice must identify the controller, processing purposes and lawful bases, actual processors and recipients, any international transfers and safeguards, retention periods or criteria, and the rights and complaint routes that apply. Supabase lead storage is available when configured and enabled. Configured service notifications use Bird for request acknowledgements and customer/staff conversation or fulfillment alerts. Notification payloads contain request references rather than message or requirements text. General Bird sending is currently paused pending release approval. Supabase Auth uses the existing Namecheap SMTP configuration for verification and recovery emails. Payment processing remains deferred.

The implementation restricts lead access to authorized staff. Business-specific lead retention/deletion rules and a process for handling data requests must be finalized before collection starts. Staff and customer authentication use tab-scoped session storage. Customer registration requires email verification and never grants staff access; staff membership is provisioned separately.

6. Questions and requests

Contact info@nextxentech.com about information you have chosen to send by email. Depending on applicable law, rights may include access, correction, deletion, restriction or objection. This draft does not assert a particular legal jurisdiction or completed compliance review.