Privacy Policy

Updated: 2025-03-01

NEXTSTEP AI – Privacy Policy

This Privacy Policy explains how NEXTSTEP AI ("we", "us", "our") collects, uses, discloses, and protects information in connection with our applications, services, and website (collectively, the "Services"). By using the Services, you agree to this Policy. If you do not agree, please do not use the Services.

Legal notice (Iran): In the event any provision of this Policy conflicts with mandatory laws of the Islamic Republic of Iran for users in Iran, the mandatory Iranian laws shall prevail. Data hosting, processing, and content governance may be subject to Iranian regulations and competent authorities.

1. Information We Collect

Account Information: name, email address, and other details you provide during registration or purchase.
Usage Data: interactions with the Services, device information, approximate location derived from IP, and diagnostics.
Content: data you submit or generate while using the Services (e.g., prompts, outputs), which may be stored locally by default and optionally in our cloud if you enable sync.
Payment Data: limited billing information processed by third-party processors (e.g., Zarrinpal); we do not store full card numbers.
Contact and identity data (when needed for invoicing or enterprise support), such as phone number or company tax ID, in compliance with Iranian e-commerce regulations.

2. How We Use Information

Provide, operate, and improve the Services;
Personalize experiences and support;
Manage subscriptions, payments, and fraud prevention;
Comply with legal obligations and enforce our terms;
Research and develop new features.

3. Legal Bases for Processing

Where applicable, we rely on one or more of the following bases: performance of a contract; legitimate interests; compliance with legal obligations; and your consent (e.g., for optional features like cloud sync).

4. Sharing and Service Providers

We may share information with:

Service providers (e.g., hosting, analytics, email, payment) under contracts requiring appropriate safeguards;
Third-party AI providers when you choose features that call their APIs;
Authorities where required by law or to protect rights and safety;
In a merger, acquisition, or asset transfer, subject to appropriate protections.
We do not sell personal information.

5. International Data Transfers

Your information may be processed and stored in jurisdictions outside your country. We implement safeguards appropriate to the sensitivity of the data and applicable law. For users in Iran, we preferentially use regional hosting where feasible to ensure compliance.

6. Data Retention

We retain information as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. You may delete local content on your device at any time. For cloud data, you may request deletion through in-product controls or by contacting us.

7. Security

We implement industry-standard technical and organizational measures to protect information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your information, as well as data portability and the right to object. To exercise rights, use in-product tools (where available) or contact us at the address below. We may request verification of your identity.

9. Children

The Services are not intended for individuals under 18. If you believe a child has provided information, contact us to request deletion.

10. Changes to This Policy

We may update this Policy from time to time. The "lastUpdated" date above reflects the latest version. Material changes will be notified within the Services where appropriate. Continued use after changes become effective constitutes acceptance.

11. Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of the Islamic Republic of Iran. The courts of Tehran, Iran shall have exclusive jurisdiction over any dispute arising out of or relating to this Policy or the processing of personal data under the Services, unless mandatory law requires a different forum or procedure.

Contact Us

Please send any questions or requests related to this policy to legal@nextstep.ir.