Privacy Policy
Your privacy is our top priority. This policy explains how NextStepApi collects, uses, stores, and protects your information when you use our platform and APIs.
NextStepApi collects information to provide, improve, and secure our services. The types of information we collect include:
| Category | Examples | Purpose |
|---|---|---|
| Account Info | Name, email, phone, company | Account creation & support |
| API Request Data | Request payload, timestamps, IP address | Service delivery & debugging |
| Payment Info | Transaction ID, amount (not card details) | Billing & invoicing |
| Usage Analytics | API call counts, error rates, latency | Service improvement |
| Device Info | Browser, OS, user agent string | Security & fraud detection |
We use the information we collect for the following purposes:
- To provide, maintain, and improve the NextStepApi platform and APIs
- To process payments and maintain accurate billing records
- To send transactional emails (API key confirmations, invoices, alerts)
- To monitor API usage and detect fraudulent or abusive behavior
- To provide technical support and respond to your inquiries
- To send product updates and feature announcements (with your consent)
- To comply with legal obligations and enforce our Terms of Service
- To conduct analytics and research to improve our services
We process your data based on legitimate business interests, contractual necessity, and where required, with your explicit consent. You can withdraw consent for marketing communications at any time.
We never sell your personal data. We may share your data only in the following limited circumstances:
- Service Providers: Payment processors (Razorpay), cloud infrastructure (AWS), email delivery (SendGrid) — bound by strict DPAs
- Government/Regulatory: UIDAI, RBI, or other authorities when legally required to fulfill API verification requests
- Legal Requirements: In response to valid court orders, subpoenas, or government requests
- Business Transfers: In case of merger or acquisition, with prior notice to users
- With Your Consent: Any other sharing will require your explicit consent
All third-party service providers are contractually obligated to use your data only for the specified purpose and to maintain appropriate security measures.
We retain your data for as long as necessary to provide our services and comply with legal obligations:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 3 years after closure |
| API request logs (metadata) | 90 days |
| API response payloads | Not stored (deleted immediately after delivery) |
| Payment records | 7 years (as per Indian tax law) |
| Support tickets | 3 years from resolution |
| Analytics data (anonymized) | Indefinite |
Upon account deletion, we will delete or anonymize your personal data within 30 days, unless retention is required by law.
NextStepApi implements industry-leading security measures to protect your data:
- Encryption in Transit: All API communications use TLS 1.3 encryption
- Encryption at Rest: All stored data is encrypted using AES-256
- Access Controls: Role-based access control with principle of least privilege
- Infrastructure: Hosted on ISO 27001 certified data centers within India
- Monitoring: 24/7 security monitoring with automated threat detection
- Pen Testing: Regular penetration testing by certified security professionals
- Certifications: ISO 27001:2013 certified, SOC 2 Type II in progress
Our website uses cookies and similar technologies to enhance your experience:
- Essential Cookies: Required for login sessions and security — cannot be disabled
- Analytics Cookies: Google Analytics for understanding usage patterns (can be opted out)
- Preference Cookies: Remember your settings and preferences
- Marketing Cookies: Only with your explicit consent
You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of our dashboard and developer portal.
As a user of NextStepApi, you have the following rights regarding your personal data:
- Right to Access: Request a copy of all personal data we hold about you
- Right to Rectification: Correct any inaccurate or incomplete personal data
- Right to Erasure: Request deletion of your personal data ("right to be forgotten")
- Right to Portability: Receive your data in a machine-readable format
- Right to Restrict: Limit the processing of your data in certain circumstances
- Right to Object: Object to processing based on legitimate interests or direct marketing
- Right to Withdraw Consent: Withdraw consent for optional data processing at any time
To exercise any of these rights, please email privacy@nextstepapi.in. We will respond within 30 days.
Our website and documentation may contain links to third-party websites, including government portals (UIDAI, MCA21, GST Portal) and partner services. These links are provided for your convenience.
We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit. This Privacy Policy applies solely to information collected by NextStepApi.
NextStepApi's services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at privacy@nextstepapi.in and we will take steps to delete such information.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
- Update the "Last Updated" date at the top of this policy
- Send an email notification to all registered users
- Display a prominent notice in your dashboard for 30 days
Your continued use of our Services after the effective date of the revised policy constitutes your acceptance of the changes. We encourage you to review this policy periodically.
For privacy-related inquiries, data requests, or to report a privacy concern, please contact our Data Protection Officer:
Data Protection Officer
Our DPO is responsible for overseeing our data protection strategy and ensuring compliance with Indian and international privacy regulations. We take all privacy concerns seriously and respond promptly.