Global Privacy Policy

NxtVault (operated by Vizain Educational Services, trading globally as "NxtVault", "we," "us," or "our") provides this Global Privacy Policy to explain how we collect, process, store, and safeguard your personal information when you visit nxtvault.cloud, purchase digital products, or utilize our AI-powered business software.

Because we serve creators, entrepreneurs, and agencies worldwide — including the United States, United Kingdom, European Union, India, Canada, Australia, and 120+ other jurisdictions — this policy meets and adheres to the strict data privacy standards established by:

• EU GDPR: European Union General Data Protection Regulation (Regulation (EU) 2016/679)
• UK GDPR: United Kingdom General Data Protection Regulation and Data Protection Act 2018
• US CCPA / CPRA: California Consumer Privacy Act and California Privacy Rights Act
• India DPDPA: Digital Personal Data Protection Act, 2023

1. Information We Collect

1.1 Information Provided by You Directly

When you register, checkout as a guest, purchase a digital pass, or contact support, we collect:

• Identity & Account Data: Full name, username, and account password (stored securely as a salted bcrypt hash).
• Contact Data: Email address (used for instant order delivery, license receipt, and account recovery).
• Transaction & Order Data: Items purchased, order identifier, license tier (Standard, MRR, or PLR), purchase amount, currency (USD or INR), and billing country.
• Customer Communications: Support inquiries submitted via our contact desk, ticket portal, or WhatsApp hotline.
• Payment Information: Processed entirely by our PCI-DSS Level 1 certified payment partners (Razorpay and PayPal). We never capture, view, or store credit card numbers, CVVs, or bank login details on our servers.

1.2 Automatically Collected Data & Telemetry

When you browse or interact with our marketplace:

• Technical Identifiers: IP address, device type, operating system, and browser version.
• Localized Pricing & Geolocation: Approximate country/region determined server-side from connection headers (to present relevant localized pricing in USD or INR without invasive tracking).
• Usage & Download Auditing: Product download requests, timestamps, and AI generation usage to prevent unauthorized sharing of cloud storage assets and ensure compliance with fair-use limits.

2. Legal Bases for Processing (GDPR & UK GDPR)

For visitors and customers located in the European Economic Area (EEA) and the United Kingdom, our lawful bases under Article 6 of the GDPR are:

• Contractual Necessity: To fulfill our contract with you — processing your digital payment, provisioning your member account, granting commercial reseller licenses, and delivering instant download links.
• Legitimate Interests: To protect our platform against payment fraud, unauthorized asset redistribution, or abuse; to ensure server uptime; and to provide customer support.
• Legal & Tax Obligations: To comply with financial accounting laws, anti-money laundering (AML) regulations, and cross-border digital VAT/GST compliance.
• Consent: Where you have explicitly opted in to receive promotional updates or product release notifications (which you may withdraw at any time with one click).

3. Cookies & Browser Storage

We believe in privacy-first web design. We use strictly necessary and functional cookies:

• Authentication & Session Cookies: Encrypted NextAuth JWT tokens to keep you logged in to your vault dashboard.
• Shopping Cart & Currency Storage: LocalStorage keys (nova_cart, user_currency) to preserve your cart items and preferred currency without tracking across external websites.
• Zero Cross-Site Ad Tracking: We do NOT sell your browsing history to third-party ad exchanges or use invasive cross-site tracking beacons.

4. Global Payment Processing & Data Security

All electronic transactions are processed through world-class, PCI-DSS Level 1 certified gateways: Razorpay (for domestic and international card/UPI processing) and PayPal (for global USD checkout). Communications between your browser, our servers, and payment gateways are encrypted using TLS 1.3 cryptographic protocols with 256-bit encryption.

5. Cross-Border Digital Services & Tax Transparency

NxtVault supplies Electronically Supplied Services (ESS) and digital content. For accounting and tax compliance across the United States, United Kingdom, European Union, and India:

• India: Orders include applicable GST under registered entity Vizain Educational Services.
• European Union & UK: Cross-border B2B transactions qualify for the Reverse Charge mechanism upon provision of a valid VAT/UID number. B2C retail transactions are priced with all destination digital duties accounted for.
• United States: Digital products are delivered out-of-state via electronic download with applicable marketplace economic nexus compliance.
• Official digital tax invoices containing your order ID, breakdown, and company credentials can be accessed directly from your purchase receipt email or requested via billing@nxtvault.cloud.

6. European Union (EU) & UK Data Subject Rights

If you are a resident of the EEA or the United Kingdom, you possess the following statutory rights under GDPR Articles 15–22:

• Right to Access (Art. 15): Request a complete copy of all personal data we maintain about you.
• Right to Rectification (Art. 16): Correct inaccurate, incomplete, or outdated information.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request the permanent deletion of your account and personal records (subject to mandatory statutory tax retention requirements).
• Right to Restrict Processing (Art. 18): Restrict the processing of your data under specific contested circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format (JSON/CSV).
• Right to Object (Art. 21): Object to any processing founded upon legitimate interests or direct marketing.
• Right to Lodge a Complaint: You have the legal right to submit a complaint directly to your national data protection supervisory authority (e.g., the Information Commissioner's Office (ICO) in the UK, or the relevant European Data Protection Board member state authority).

7. California Consumer Privacy Rights (CCPA / CPRA)

For residents of California, United States, under the California Consumer Privacy Act as amended by the CPRA:

• Right to Know & Access: You may request disclosure of the categories and specific pieces of personal information collected over the preceding 12 months.
• Right to Delete: You have the right to request deletion of personal information collected directly from you.
• Right to Correct: You have the right to correct inaccurate personal data.
• Right to Non-Discrimination: We will never discriminate against you, deny service, charge different prices, or provide a lower quality of goods because you exercised your statutory privacy rights.
• Do Not Sell or Share Personal Information: We state unequivocally: NxtVault has not sold or shared personal information of consumers in the preceding 12 months, and does not sell or share personal information for monetary or other commercial benefit.
• Shine the Light Law: California Civil Code Section 1798.83 permits California residents to request confirmation that we do not disclose personal information to third parties for direct marketing.

8. India Data Principal Rights (DPDPA 2023)

Under the Digital Personal Data Protection Act (DPDPA) 2023, Indian citizens have the right to:

• Access an intelligible summary of personal data being processed.
• Request correction, completion, and updating of personal data.
• Request erasure of personal data that is no longer necessary for the original transaction.
• Nominate an individual to exercise rights in the event of incapacity.
• Lodge a grievance with our designated Grievance Officer or escalate to the Data Protection Board of India.

9. International Data Transfers

As an international digital platform, your data may be processed on secure cloud infrastructure hosted in regions with recognized adequacy or protected by standard contractual clauses (SCCs). We ensure all service providers (including AWS, Neon Postgres, Brevo, and Resend) implement enterprise-grade technical and organizational safeguards conforming to ISO 27001 and SOC 2 Type II compliance standards.

10. Protection of Minors (COPPA)

Our platform is intended strictly for commercial creators and professionals aged 18 and older. We do not knowingly solicit or collect data from children under the age of 18 (or under 13 under US COPPA guidelines). If we become aware that personal information of a minor was inadvertently collected, it will be excised immediately from our systems.

11. Data Retention & Erasure Requests

Account records remain active during your lifetime membership. Completed order receipts and financial ledger entries are retained for a minimum of 7 years in compliance with international commercial taxation and statutory audit regulations. You may request account deletion at any time by contacting our privacy desk.

12. Exercising Your Rights & Privacy Contact

To exercise any statutory privacy rights (GDPR, CCPA, or DPDPA), or for questions regarding this Global Privacy Policy, contact our Data Governance Officer: