Privacy Policy.Plain words, kept current.

The short version

• Our website doesn't use cookies, advertising, or tracking pixels. We count visits with privacy-first analytics that doesn't use cookies or follow you across sites.
• We collect what you choose to send us, what's needed to sign documents with us, and the basic records our systems keep to stay secure.
• We don't sell or share personal information for advertising, and we don't use it to train AI models.
• Data we process for customers is governed by our agreement with that customer, including a business associate agreement (BAA) when health information is involved.
• You can ask us to access, correct, or delete your information at any time: privacy@nextcoreai.ai.

1. Who we are and what this covers

Nextcore AI Inc. ("Nextcore," "we," "us") is a Florida corporation based in Miami, Florida. This Privacy Policy explains how we collect, use, share, and protect personal information when you:

• visit nextcoreai.ai and its pages (the "Site");
• contact us by email, phone, or the form on the Site;
• review or sign documents with us electronically, including at crm.nextcoreai.ai;
• apply to or take part in our partner program; or
• otherwise do business with us, for example in meetings, assessments, or proposals.

What this policy doesn't cover. When we provide services to a customer, such as NextOS, Edward cyber defense engagements, or AI-first operations work, we process that customer's data on its behalf and under its instructions. That processing is governed by our written agreement with the customer, not by this policy. If your employer or a company you deal with uses our services, please refer to that company's privacy notice.

2. Information we collect

Information you give us

• Contact details and messages. When you use the form on our Site, we receive what you enter: typically your name, company, industry, email address, and what you need. The form sends your message to our team by email through our email provider. We also receive whatever you include when you email or call us.
• Business information. Your job title, company, and the details you share about your operations, systems, or goals when we talk, meet, or prepare a proposal.
• Electronic signatures. When you sign a document with us, we record your name, email address, signature, the date and time, and the IP address and browser used, so the signature can be verified later.
• Partner program information. If you apply to our partner program, the details on your application, such as your name, company, region, contact information, and signature on any agreement.

Information collected automatically

• Server and security logs. Like most websites, our hosting providers record basic technical information when pages are requested: IP address, browser type, the page requested, the referring page, and the date and time. We use these logs to run, secure, and troubleshoot the Site.
• Cookies. The public Site does not set cookies. Signed-in areas, such as our client and document-signing portal, use essential cookies only, to keep you signed in and protect your session. We don't use advertising or analytics cookies.
• Visit statistics. We use Cloudflare Web Analytics to understand how the Site is used, such as which pages are visited and how quickly they load. It doesn't use cookies or local storage, doesn't build profiles, and doesn't track you across other websites. Cloudflare receives technical information such as your IP address and browser to produce aggregate statistics for us.
• Fonts. The Site loads its fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address. Google's handling of that information is described in Google's own privacy policy.

Information from other sources

We may receive business contact information from colleagues who introduce us, from partners, or from public professional sources such as company websites and professional networks.

3. How we use information

• To respond to you and provide the information, assessments, or services you ask for.
• To prepare, sign, deliver, and keep records of proposals, agreements, and other documents.
• To run our partner program.
• To operate, secure, and improve the Site and our systems, including detecting and preventing fraud, abuse, and security incidents.
• To send business communications you'd reasonably expect, such as follow-ups to a conversation. You can opt out of non-essential emails at any time.
• To comply with law, enforce our agreements, and protect our rights and the rights of others.

AI tools. We're an AI-first company, and we use AI tools, such as Anthropic's Claude through Amazon Bedrock, to help us draft, organize, and manage our business communications and records. We use enterprise services that don't train their models on our data by default, and we don't use your personal information to train AI models. A person at Nextcore stays responsible for decisions that affect you.

4. How we share information

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We share it only as follows:

• Service providers who process information for us under contract, such as cloud hosting (for example, Amazon Web Services, Render, and Replit), website analytics and delivery (for example, Cloudflare), email and productivity (for example, Google Workspace and Resend), and AI services (for example, Anthropic models through Amazon Bedrock). They may use the information only to provide their services to us.
• Partners and professional advisers, such as our lawyers and accountants, where needed for the purpose you engaged us for, or under confidentiality obligations.
• Legal and safety reasons, when we believe disclosure is required by law, regulation, or legal process, or is needed to protect the rights, property, or safety of Nextcore, our customers, or others.
• Business transfers, as part of a merger, acquisition, financing, or sale of assets, subject to this policy's protections.
• With your consent, or at your direction.

5. Health information

Please don't send protected health information (PHI) through our Site, contact form, or general email. When a healthcare customer engages us to handle PHI, we do so only under a signed business associate agreement and the customer's instructions, in environments set up for that purpose. We provide BAA documentation and contracts on request.

6. How long we keep information

We keep personal information only as long as we need it for the purposes above. That includes keeping signed agreements and their signature records for as long as the agreement is in effect and for the period afterward needed to meet legal, tax, and accounting obligations or to resolve disputes. Server logs are kept for a limited period for security and troubleshooting. When information is no longer needed, we delete or de-identify it.

7. How we protect information

We use administrative, technical, and physical safeguards appropriate to the information we hold. These include access limited to the people who need it, encryption in transit, credentials kept out of logs, and records of access and changes. No system is perfectly secure, so we can't guarantee absolute security. If we learn of a security incident that affects your personal information, we'll notify you as the law requires.

8. Your choices and rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct information that's inaccurate;
• delete your information;
• object to or restrict certain processing, or withdraw consent you've given; and
• opt out of the sale or sharing of personal information. We don't sell or share it, and we honor Global Privacy Control signals as an opt-out request.

To make a request, email privacy@nextcoreai.ai. We'll confirm your request and may need to verify your identity before acting on it. You can use an authorized agent where the law allows. We won't discriminate against you for exercising these rights. If we deny your request, you may appeal by replying to our decision, and you may contact your state attorney general or data protection authority if you're not satisfied.

Visitors from the EEA, UK, and Switzerland. We process personal information to take steps you ask for before entering a contract, to perform a contract, to meet legal obligations, and for our legitimate interests in running and securing our business, which we balance against your rights. You may lodge a complaint with your local data protection authority.

9. Where information is processed

We're based in the United States, and our service providers primarily process information in the United States. If you contact us from another country, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards for these transfers.

10. Children

Our Site and services are for businesses and aren't directed to children under 16. We don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we'll delete it.

11. Other websites

Our Site may link to other websites, such as LinkedIn. We aren't responsible for their privacy practices, and we encourage you to read their policies.

12. Changes to this policy

We may update this policy as our practices or the law change. We'll post the updated version here with a new "Last updated" date, and if a change is significant, we'll take reasonable steps to let you know.

13. Contact us

Questions or requests about privacy: