Privacy Policy

NexGen eHub Limited (“NexGen eHub”, “we”, “us”) provides the NexGen eHub platform, AI tools and related managed services. We are a company registered in England and Wales under company number 15533142, with our registered office at 72 Sparrow Hall Road, Liverpool, L9 6BU.

For the personal data described in this notice, we are the data controller. When a business customer sends us personal data to process on its behalf — for example, customer records included in a managed service or an uploaded dataset — we act as a data processor and the customer is the controller. Our Data Processing Agreement covers that role.

We are registered with the UK Information Commissioner’s Office (ICO) as a data controller.

Privacy questions and requests can be sent to info@nexgenehub.com or through our contact form. Please use the subject line “Privacy request” so it reaches the right person.

This notice covers personal data we handle through the public website, the client portal and staff-supported services, including the AI tools, Help Centre, support tickets, partner applications, billing and managed services. It does not cover third-party websites or services you choose to use, which have their own privacy notices.

Depending on how you use NexGen eHub, we may handle:

• Account and identity data — your name, email address, account reference, sign-in method and, where you use Google sign-in, the identifier and profile details Google returns. Passwords are handled by our authentication provider in hashed form; we never see your plain password.
• Business profile and preferences — company name, country, currency, language, brand voice and the settings you save to make the tools work for your business.
• Content you create or submit — prompts, drafts, documents, knowledge articles, workflow definitions, records, spreadsheets and CSV data, support messages, feedback and the outputs generated for you.
• Uploaded files — for example PDFs, images and spreadsheets that you ask a document, OCR or data tool to read. Text and images from an upload may be sent to our AI provider to perform the task you requested.
• Voice data — audio you choose to transcribe or analyse. Audio is sent to our AI provider for processing. We do not keep the recording after processing unless a feature explicitly saves it; a transcript is stored only when you choose to save it.
• Subscription and payment data — plan, billing interval, subscription status, invoice records, credit balances and transaction references. Card details are entered on Stripe’s checkout and are not stored on our servers. We receive limited payment metadata such as card brand and the last four digits.
• Enquiries and partner applications — the details you submit through our contact or partner forms, such as name, business email, company, country, website, areas of expertise and your message.
• Technical and security data — IP address, browser and device information, timestamps, error reports, audit records and rate-limit counters used to keep the service secure and working.

We do not ask for special category data (such as health, political opinions or biometric data) and our AI tools are not designed for it. Please do not submit it.

• Directly from you when you register, use a tool, upload a file, contact us or apply to partner with us.
• Automatically as you use the website and portal, including security and error logs.
• From Stripe when you subscribe, renew, cancel or request a refund.
• From Google when you choose Google sign-in, and from our AI provider when it returns a result.
• From cookies and similar storage described in our Cookie Policy.

We use personal data for the following purposes. The lawful basis is the UK GDPR basis we rely on.

• Providing the service you asked for — creating your account, running the tools, storing your work, managing your plan and support tickets (performance of a contract, Article 6(1)(b)).
• Taking payment and keeping records — subscriptions, invoices, refunds and accounting (contract; legal obligation, Article 6(1)(c)).
• Keeping the service secure and reliable — authentication, access control, abuse prevention, rate limiting, error monitoring and audit logs (legitimate interests, Article 6(1)(f)). We balance these interests against your rights and keep the data to what is needed.
• Answering enquiries and assessing applications — responding to contact messages and partner applications (legitimate interests; contract where you are already a customer).
• AI processing you initiate — when you confirm that content may be sent to our AI provider, we process it to produce the result you requested (contract, and consent where we ask for a specific confirmation). You can stop at any time by not submitting the request.
• Optional marketing — only where you have opted in, or where the soft opt-in applies to an existing customer (consent, Article 6(1)(a), and PECR). Marketing consent is separate from the consent needed to run a service request.
• Legal claims and compliance — establishing or defending legal claims and responding to lawful requests (legitimate interests; legal obligation).

Where we rely on legitimate interests, you can ask us for a summary of the assessment we made. Where we rely on consent, you can withdraw it at any time; that does not affect processing carried out before withdrawal.

Our AI tools send the content needed for a request to a third-party AI provider. Depending on the feature, that can include your prompt, the context you select, a sample of up to 20 rows from a CSV, extracted text or images from an uploaded document, an audio recording you choose to transcribe, or a web-research question. We do not send your whole account or other customers’ content.

Our current AI provider is Google, using its Gemini API. We may configure additional providers in the platform; the providers in use for a contracted service are listed in the DPA schedule at the time you sign. AI providers process content under their own terms as our processor or sub-processor.

Training and retention. We do not use your content to train our own models. Whether a provider retains API content or uses it for model improvement depends on the provider and the service tier in use. We are reviewing the current provider tier against our retention position and will state the confirmed position here when that review is complete. If you need the current position before sending particular content, contact us first.

AI outputs are saved in your account only when you choose to save them, and are used to provide the service to you. We do not use them for advertising. See our AI Usage Policy for the safeguards and limits that apply.

Subscriptions and one-off payments are processed by Stripe. Card details are entered on Stripe’s secure checkout and are not received or stored by us. Stripe provides us with transaction references, amounts, status, billing details and limited card metadata so we can manage your subscription, invoices, refunds and accounting records. Stripe acts under its own terms and privacy notice, and may act as an independent controller for some payment processing.

We keep billing records for as long as required for tax and company law, which is normally six years after the end of the relevant financial year.

When you contact us, we record your name, contact details and message so we can respond, investigate and keep a record of the advice given. Signed-in customers can raise tickets in the client portal; those tickets are visible to authorised staff. Transactional email is sent through our email provider. Please do not send passwords, full card numbers or other secrets in a support message.

If you apply to our partner programme, we use the details you submit to assess your application, contact you about it and keep a record of the decision. Marketing updates are optional and are controlled by a separate choice on the form. The marketplace is not yet open for third-party listings and we do not operate seller onboarding or seller payouts; if that changes, this notice and our Terms of Service will be updated first.

We do not sell personal data and we do not use advertising networks or third-party behavioural analytics. We share data only with providers that help us run the service, and only as needed:

• Hostinger — website and application hosting.
• Supabase — authentication, database and application storage.
• Stripe — payments, subscriptions and invoicing.
• Google — AI model, web research and transcription processing.
• Our email provider — transactional and support email.

We may also share data with professional advisers (such as accountants and lawyers) where necessary, and with regulators, courts or law enforcement where the law requires it. Our staff and contractors access personal data only where their role requires it and are bound by confidentiality obligations. Some back-office support is provided from our teams in India.

A current sub-processor list forms part of our DPA.

Some of our providers process data outside the UK, including in the European Union and the United States, and some support is delivered from India. Where data leaves the UK, we rely on an appropriate transfer mechanism — such as an adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses — together with the provider’s security terms.

We are reviewing the executed transfer terms for each provider and will confirm the specific mechanism for a provider on request. The DPA schedules identify the providers and the safeguards recorded for them.

We keep personal data only for as long as we need it for the purposes above. In practice:

• Account and content data is kept while your account is active.
• After an account is closed, we delete or anonymise data that is no longer needed, allowing a short period for backups and for resolving any open dispute.
• Billing and accounting records are kept for six years after the end of the relevant financial year, as required by tax and company law.
• Security and error logs are kept for a limited period set by our retention schedule; older entries are pruned automatically.
• Partner applications that do not proceed are kept only as long as needed to deal with the application and any follow-up.

We can confirm the current retention period for a specific record type on request. AI providers may hold request data for their own limited periods under their terms; see section 6.

We use technical and organisational measures that include encryption in transit, authentication and role-based access control, database row-level security, audit logging, least-privilege staff permissions and restricted administrative access. Our staff security controls include multi-factor authentication where enabled for an account and prompt removal of access when a role ends.

No service can guarantee absolute security. If a personal data breach is likely to result in a risk to your rights, we will notify the Information Commissioner and affected individuals as required by law, and we will tell you what happened and what we have done.

Under UK data protection law you have the right to:

• be informed about how we use your data (this notice);
• access a copy of your personal data;
• have inaccurate data corrected;
• have data erased where there is no good reason for us to keep it;
• restrict or object to processing, including direct marketing;
• receive data you provided in a portable format;
• withdraw consent where we rely on it; and
• complain to the Information Commissioner’s Office (ICO).

To exercise a right, email info@nexgenehub.com with the subject “Privacy request”. We may ask for information to confirm your identity. We respond within one month, and will tell you if we need to extend that period. There is normally no charge. Signed-in customers can also use the data request options in the client portal.

You can complain to the ICO at ico.org.uk or on 0303 123 1113. We would welcome the chance to resolve your concern first.

We send service messages (such as security notices, billing confirmations and material changes to terms) because they are part of the service. Marketing email is sent only where you have opted in, or where the soft opt-in applies because you are an existing customer and the message concerns similar services. Every marketing message includes an unsubscribe route, and you can change your preference at any time by contacting us. Opting out of marketing does not stop service messages.

NexGen eHub is a business service for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will investigate and delete the account where appropriate.

We do not make solely automated decisions that have a legal or similarly significant effect on you. AI tools produce suggestions and drafts for you to review; they do not decide your access, price or legal position. See the AI Usage Policy.

We update this notice when our services, providers or legal duties change. The “last updated” date at the top shows the current version. If a change materially affects how we use your data, we will notify account holders by email or in the client portal before it takes effect.

NexGen eHub Limited, 72 Sparrow Hall Road, Liverpool, L9 6BU. Email info@nexgenehub.com with the subject “Privacy request”, or use the contact form. Our Company Information page has our registered details.