Privacy Policy

Who operates the service

The operator and data controller is NEXTED GROUP SOCIEDAD LIMITADA, NIF B56576259, VAT ESB56576259, Calle Gregal, 8, 46117 Bétera, Valencia, Spain. Contact service@nextmba.com for support or privacy requests, or telephone +34 667 939 082.

Account and assistant information

We process your account identifier, email address, display name and authentication session to provide your account. We store conversations, memories, uploaded files, preferences, learning progress and schedules when you use those features. Membership and transaction references are used to provide paid access; payment details are processed by the payment provider shown at checkout.

Microphone audio is processed when you choose a voice feature. Relevant conversation context, files and images may be processed to provide the help you request. The Live work voice preview currently uses sample emails; it does not access your Gmail inbox or send real email.

What Gmail access allows

Gmail is optional and requires separate Google authorization. With your permission, the email assistant uses gmail.readonly to read recent inbox messages, including sender and recipient details, subject, message text and thread identifiers, so it can display messages and help prepare replies. It uses gmail.send to send a reply when you explicitly choose to send it after review.

It does not use these permissions to delete, move or mark your messages as read. Connecting Gmail does not give us your Google password. We store the connected Gmail address, granted scopes, connection timestamps and encrypted access and refresh tokens.

For drafts, we store reply text and the message metadata needed to show and send the reply, including sender, recipient, subject and thread identifiers. Original message text is fetched as needed; relevant excerpts can appear in saved drafts or conversations. Disconnecting Gmail removes its connection credentials, but does not by itself delete existing drafts or conversations.

Optional Calendar access

If you separately enable a Calendar feature and grant calendar.readonly, the assistant reads upcoming events to help prepare plans and reminders. It cannot create, change or delete events with this permission. Event information used in a delivered plan or reminder may remain in your conversation history. Calendar permission is not required just to read and reply to Gmail.

AI processing and sharing

Before AI features run, we ask for permission to share relevant content with OpenAI. Email drafting can send the selected or newly retrieved message text, sender, subject, your instructions and relevant saved context to OpenAI. Voice features send microphone audio and relevant context to OpenAI. If you enable a scheduled email or assistant skill, it may process newly retrieved content while you are away.

We use OpenAI to return the requested assistance. We do not use Google user data to train or improve general-purpose AI models. Our email drafting requests disable API response storage; this does not imply that a provider has no security or legally required retention. See OpenAI’s data processing terms for its processing commitments.

Other service providers support authentication, hosting, database and file storage, and payments. These include Supabase for authentication, Google for Google account integrations, OpenAI for AI processing, and the hosting infrastructure serving Workplace. Providers process data to operate these features, subject to their applicable agreements. Data may be processed outside your country; where required, applicable data protection safeguards apply.

Google API Limited Use

NEXT MBA’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is not sold, shared for advertising, used for credit decisions, or transferred for unrelated purposes. Human access is limited to cases permitted by that policy, such as access you explicitly authorize for support, necessary security investigations or legal obligations.

Storage, security and deletion

Google OAuth tokens are encrypted at rest. Access to account data requires authentication. Tokens remain stored until you disconnect the integration or delete the account. Disconnecting Google access deletes the stored shared Google credentials and requests revocation; it also disconnects Calendar if it uses those credentials.

Saved conversations, drafts, memories, files and preferences remain until deleted through available account controls, account deletion, or when no longer needed to provide the service. Deleting the account initiates removal of its stored content and connected-account credentials. Limited deletion records and records required for security, billing or law may remain. Provider retention is governed by the applicable provider agreements.

Your choices and rights

Use Account & privacy to review or withdraw AI permission and initiate account deletion. Withdrawal stops new AI requests and scheduled AI work; it cannot recall information already processed. Close any active voice session when withdrawing permission. You can also revoke Google access in your Google Account connections.

Contact service@nextmba.com to request access, correction, deletion or a copy of your personal data, or exercise applicable objection and restriction rights. You may also complain to your competent data protection authority. We may need to verify your identity before acting on a request.

Changes to this policy

We publish updates here and change the date above. New permissions or materially different uses of Google data require appropriate notice and consent before they take effect.