Privacy Policy

Who is responsible

The controller of personal data collected through this website is AppVanta OÜ, trading as Next Era Solutions, registered in the Estonian Business Register under code 17188835, at Tornimäe tn 5, 10145 Tallinn, Estonia.

For any question or request about your data, write to welcome@nexterasolutions.app.

Contact and project forms

When you send one of our forms (project enquiry, partnership meeting, or a calculator review), we receive:

• your name and email address (required, so we can reply);
• your company, message, and answer to “How did you find us?”, if you give them;
• for calculator requests, the options you selected and the estimate shown;
• the type of request, the page you sent it from, the address of the page that brought you to our site (the referrer), your browser language, and the time of sending;
• which button on that page took you to the form, if you used one, or else that you came from another page of our site and which page it was. This is a fixed name for the button (for example “hero-form”), the same for every visitor. It is held only in the open page's memory until you send the form: nothing is stored in your browser, and it is gone when you leave or reload the page.

We use this to reply, to discuss and prepare a possible project or partnership, to keep a record of the conversation in our CRM, and to learn which channels bring enquiries.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and our legitimate interest in keeping business records of enquiries and understanding where they come from (Art. 6(1)(f) GDPR).

To protect the forms from spam, our server keeps counters named by a keyed one-way hash of your IP address (for IPv6, of your /64 network). They are used only to allow one submission every 20 seconds and five in 24 hours from each address or network, are kept outside the website folder, are never stored with your enquiry, and are deleted after two days without use. While we send automatic confirmation emails, we also keep a keyed one-way hash of your email address, so that one address gets at most one confirmation in 24 hours; it is deleted after 24 hours without use. Legal basis: our legitimate interest in keeping the forms usable and free of abuse (Art. 6(1)(f) GDPR).

Booking a call

The “book a call” links open NeetoCal, the scheduling service we use. The details you enter there go to NeetoCal and are passed on to our CRM so we can prepare for the call. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Each booking link on our site carries fixed tags that name the page and the button it sits on (for example utm_campaign=app-cost-calculator and utm_content=result-book). They are the same for every visitor and say nothing about you. NeetoCal may store them with your booking, and then they reach our CRM with the rest of the booking details, so we know which page and button bookings come from. Legal basis: our legitimate interest in understanding where enquiries come from (Art. 6(1)(f) GDPR).

Anonymous statistics

We count visits with our own counter on our own server, not with a third-party analytics service. It sets no cookies and writes no IP address, browser user agent or other identifier into its logs, so nothing in its logs can tell that a visitor has been here before. To stop floods of fake events, the server counts the events from each IP address (for IPv6, each /64 network) in the current clock hour (for example, 14:00 to 14:59), in a counter named by a keyed one-way hash of the address. The key is random and belongs to that hour only: the key and all of that hour's counters are deleted with the first event of any later hour, after which no counter can be linked to an address.

For each counted event it stores only: what happened (for example a page view, a calculator step, or a click on a booking link) and, for a click, which button it was (a fixed name such as “hero-book”, the same for every visitor), the page path without any query string, the hour, and, on the first page of a visit only, the host name of the site that referred you (for example www.google.com, never the full address). The user agent is read once to leave out bots and is never written down.

We use these counts to see which pages and channels are useful. Legal basis: our legitimate interest in understanding how the site is used, in a way that does not identify anyone (Art. 6(1)(f) GDPR). The logs are kept in one file per month, and each file is deleted with the first event recorded after 25 full months have passed since the end of its month.

If your browser sends Global Privacy Control, nothing is counted. You can also switch the counter off for this browser here:

Server logs

Like any website, the web server run by our hosting provider records technical request logs, including IP address, requested address, time and browser user agent, to operate and secure the service. We use them only for security and troubleshooting, and they are removed on the hosting provider's regular log rotation.

Who receives your data

We share personal data only with the providers that run these services for us, and only as far as each one needs it:

• Pipedrive, our CRM, which stores enquiries and our follow-up;
• our email provider, which delivers each enquiry to the team's mailboxes;
• our website hosting provider, which runs the site and the form endpoint;
• NeetoCal, when you book a call.

We may also disclose data to professional advisers or to authorities where the law requires it. We do not sell personal data and do not share it for advertising.

Transfers outside the EEA

Some of these providers, or companies they rely on, may process data outside the European Economic Area, and members of our team who handle enquiries may work outside the EEA, including in Ukraine. Where data leaves the EEA, it is protected by the safeguards the GDPR provides, such as an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguards that apply.

How long we keep it

• Enquiries (email, CRM and notes): while we discuss or deliver work with you, and afterwards only as long as needed for follow-up and to answer legal claims. Enquiries that do not lead to work are deleted once they are no longer needed for that purpose.
• If we sign a contract, contract and accounting records are kept for 7 years, as Estonian accounting law requires.
• Anonymous statistics: each month's log is deleted once 25 full months have passed since the end of that month.
• The statistics flood counters (a keyed hash of your IP address or network, under a random key for the current clock hour): the key and the counters are deleted with the first event of any later hour.
• The spam-protection counters (a keyed hash of your IP address or network): deleted after two days without use. The confirmation-email hash of your email address: deleted after 24 hours without use.
• Values in your browser's storage: until you clear them.

Our server runs no scheduled clean-up, so the site's own code deletes expired files: the spam-protection counters and the confirmation-email hash when someone sends an enquiry (at most once a minute), and every expired file above once an hour, with the first event the visit counter receives that hour. A file can therefore outlast its period until one of those happens.

Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests, including the statistics. We reply within one month.

To use any of these rights, write to welcome@nexterasolutions.app.

You also have the right to complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); you can also contact the authority where you live or work, such as the ICO in the United Kingdom.

Cookies and browser storage

This site sets no cookies and loads no third-party scripts, fonts or trackers. It keeps a few small values in your browser's local storage, which are never sent to us:

nes-home-last-submitnes-partner-last-submitnes-app_cost_calculator-last-submitnes-roi_calculator-last-submit

The time you last sent a form (one key per form: home, partners and each calculator), so a double click does not send it twice.

nes-calc-currency

The currency you picked in the calculators.

nes-app-cost-estimate

Your latest cost-calculator estimate (three numbers), so the ROI calculator can start from it.

nes-analytics-optout

Set only if you turn off statistics below.

You can remove them at any time by clearing this site's data in your browser settings.

Automated decisions

We do not make decisions about you based solely on automated processing, including profiling.

Security

The forms use validation, a spam trap and rate limits. Credentials for our CRM and email are kept in private server configuration, not in the site's code. The statistics logs are stored outside the public web folder.

Changes to this policy

We update this page when our processing changes. The date at the top shows the current version.