1. Introduction, Scope & Privacy Commitment

Nextstep Dev LLC ("Nextstep Dev", "we", "us", or "our") operates as a specialized software engineering and digital growth agency. This Privacy Policy governs all data collected via our website (nextstepdev.com), client onboarding workflows, strategy consultation bookings, automated growth funnels, and enterprise development engagements.

2. Categories of Information We Collect

We process information under three primary categories to execute our software engineering and growth management services:

A. Information Voluntarily Provided by You

• Consultation & Discovery Inquiries: Full name, corporate email address (e.g. via [email protected]), contact phone number, company legal name, industry, current website URL, estimated project budget, and engineering goals.
• Client Commercial Credentials: CMS credentials (WordPress, Shopify), GitHub/GitLab repository invitations, DNS records, API keys, and advertising platform manager authorizations (Google Ads MCC, Meta Business Manager) provided under mutual confidentiality.
• Billing & Financial Information: Billing address, EIN / corporate tax ID number (or Sales Tax ID), and payment processing tokens handled securely via Stripe or bank wires (we never store raw credit card numbers on our servers).

B. Telemetry Collected Automatically

• Technical Device Data: Public IP address, browser type and version, language settings, operating system, network provider, referral headers, and screen dimensions.
• Usage & Performance Telemetry: Session duration, pages viewed, scroll depth, click tracking on case studies, and Core Web Vitals telemetry collected via performance monitoring scripts.

3. Google Analytics 4 & Google Ads Compliance

To optimize our digital engineering funnels and measure advertising performance, our platform integrates official Google marketing solutions in full compliance with Google Advertising Policies and Google Consent Mode v2:

• Google Analytics 4 (GA4): We utilize GA4 to analyze traffic patterns and user behavior. GA4 processes first-party cookies (_ga, _ga_*) with automatic IP anonymization enabled. User-level data retention is restricted to 14 months before automated purge.
• Google Ads Remarketing & Conversion Tracking: When visitors click our Google Ads, conversion cookies (_gcl_au, _gcl_aw) measure whether actions like booking a strategy call or downloading a playbook occur. We do not transmit personally identifiable information (PII) to Google Ads without explicit consent.
• Google Consent Mode v2: We support Google's four distinct consent parameters: ad_storage, analytics_storage, ad_user_data, and ad_personalization. For visitors in the EEA and international jurisdictions requiring consent, tags remain blocked or operate in cookieless state until explicit consent is granted.

You can manage or opt out of personalized Google advertising at any time through Google My Ad Center or by installing the Google Analytics Opt-out Browser Add-on.

4. Meta Pixel & Conversions API (CAPI) Disclosures

In accordance with Meta Business Tools Terms and Meta Advertising Standards, we disclose our use of both client-side and server-side Meta marketing instrumentation:

• Meta Pixel (Browser-Side): The Meta Pixel (_fbp cookie) tracks visits to key landing pages to evaluate our performance marketing campaigns on Facebook and Instagram.
• Meta Conversions API (CAPI - Server-Side): To ensure accurate conversion measurement independent of browser tracking blockers, we utilize Meta CAPI. When a user submits an inquiry form, server events are securely dispatched to Meta's servers.
• Advanced Matching & Cryptographic Hashing: Any customer data transmitted via CAPI (such as email addresses or phone numbers) is cryptographically hashed using the industry-standard SHA-256 algorithm on our server before transmission. Plaintext personal data is never transmitted to Meta.
• Event Deduplication: Unique event_id tokens are assigned to each user action to ensure events are counted exactly once between the client pixel and server CAPI.

You can inspect and adjust your Meta advertising preferences directly inside your Meta Ad Preferences Center.

5. Lawful Basis & How We Use Your Information

We process collected data exclusively under established legal bases defined by GDPR Article 6:

6. 100% Client Intellectual Property & Data Confidentiality

All engineers, designers, and consultants engaged by Nextstep Dev are bound by comprehensive, written Non-Disclosure Agreements (NDAs). Your strategic growth plans and technical architectures are held under strict confidential custody.

7. Your Statutory Privacy Rights Under GDPR & International Frameworks (EEA & Global)

If you reside within the European Economic Area (EEA), Switzerland, or other covered international jurisdictions, you possess the following statutory rights under Chapter III of the General Data Protection Regulation:

• Right to Access (Art. 15): Request confirmation and an electronic copy of all personal records we hold regarding you.
• Right to Rectification (Art. 16): Require prompt correction of inaccurate or incomplete personal data.
• Right to Erasure / "Right to Be Forgotten" (Art. 17): Request permanent deletion of your data when it is no longer required for contractual or legal purposes.
• Right to Restriction of Processing (Art. 18): Restrict the processing of your data during active disputes.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (e.g. JSON or CSV).
• Right to Object (Art. 21): Object to processing based on legitimate interest or direct marketing at any time.
• Right to Withdraw Consent (Art. 7(3)): Revoke previously granted marketing or analytics consent without affecting prior lawful processing.

To exercise any GDPR right, email our Data Protection Team at [email protected]. We fulfill verified requests free of charge within 30 calendar days.

8. Notice to California Residents (CCPA & CPRA)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents are entitled to specific disclosures regarding personal information:

• Notice at Collection: We collect identifiers (name, email, IP address), commercial information (purchase history, service inquiries), and internet activity telemetry (page interactions).
• We Do Not Sell Personal Information: Nextstep Dev has not sold any personal information in the preceding 12 months, and will never sell personal information.
• Right to Opt Out of "Sharing" for Cross-Context Behavioral Advertising: You have the right to direct us not to share your personal information for targeted cross-context ads. We honor browser-level Global Privacy Control (GPC) signals automatically.
• Right to Non-Discrimination: We will never deny services, charge different rates, or alter quality of service if you exercise statutory CCPA rights.

9. Data Security, Encryption & Retention Schedules

We maintain rigorous technical, physical, and administrative safeguards designed to protect commercial client assets:

• End-to-End Encryption: All website traffic is secured via TLS 1.3 with 256-bit AES encryption. Server databases are encrypted at rest.
• Access Controls: Principle of Least Privilege (PoLP). Only authorized lead architects assigned to your project obtain credential access via encrypted password managers.
• Retention Schedule: General discovery inquiries without active contracts are permanently purged after 24 months. Contractual records and accounting invoices are retained for 7 years to satisfy federal tax obligations.

10. Authorized Subprocessors & Cloud Infrastructure

To deliver robust web applications and performant marketing systems, we engage certified enterprise subprocessors:

11. Contact Our Data Protection Officer (DPO)

For inquiries, data access requests, or compliance reviews concerning this Privacy Policy, contact our team: