Privacy policy

Version 2026-09-07. This policy explains which data Next processes, why, for how long, and what your rights are under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018). For a client subject to the European Union General Data Protection Regulation (GDPR), document processing also follows the Data Processing Addendum of the Terms of use.

1. Who processes the data

Controller: Fernando Canelas, operator of Next (rkm-next.com.br), who also acts as data protection officer. The officer's contact is shown in the footer of this page and the support channels are in the company area inside the portal.

2. Which data we process

• Account: name, e-mail, company, plan, language, version and date of acceptance of the terms.
• Access: IP address, date and time, identifier of the key used and name of the tool called. The content of your questions is not stored.
• Documents: the files the people of your account upload, and the indexes generated from them.
• Connected sources: when an administrator authorizes an external source, Next uses read-only scope, stores encrypted tokens, lets the administrator disconnect at any time, and removes imported files when requested.
• Login: signing in to the portal uses a code sent to your e-mail. We store no password.
• Billing: card payment data is processed by Stripe, a Next sub-processor; Next does not store card numbers. Plan, account status and commercial history remain linked to the account for service delivery.

3. Why, and on which legal basis

• Providing the contracted service: account, keys, indexing and search (performance of a contract, art. 7, V).
• Service security: abuse protection, anti-bot check at sign-up and usage limits (legitimate interest, art. 7, IX).
• Keeping access logs for the legal period (legal obligation, art. 7, II, and Internet Civil Framework, art. 15).
• Sending account notices: security incidents and changes to these terms (performance of a contract). We send no advertising.

4. Who we share with

Only with processors needed to run the service: Cloudflare (network, protection and cookieless audience measurement), the provider that sends login codes and other account e-mails, and the artificial-intelligence tool you connect to Next, such as Claude, ChatGPT or Codex. Each processor handles data under contract and for a specific purpose. We never sell or transfer data to third parties. Next's servers and those processors may be located in Brazil or abroad; every international transfer follows the safeguards of art. 33 of the LGPD.

5. How long we keep it

• Account data and documents: as long as the account exists.
• On account closure by the company administrator, documents, indexes, keys and the list of people are permanently deleted 7 days after closure, following the process in section 7 of the Terms of use.
• Access logs: 6 months, the period set by art. 15 of the Internet Civil Framework. The IP address is removed from the log at the end of that period; the rest, such as date, time and key used, is kept.
• Commercial history: for the period required by applicable law.
• Backups: daily backup, retained for 30 days and overwritten in the normal cycle.

6. Your rights

At any time and free of charge you may request confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing, and withdrawal of consent in cases where consent is the legal basis (art. 18 of the LGPD). In the portal, you export your data in bulk and request deletion in the My data area. Requests can also be made through the data protection officer's contact and are answered within 15 days. You may also file a complaint with the Brazilian data protection authority (ANPD).

7. How we protect it

• All traffic is encrypted (TLS). The server is never exposed directly to the internet.
• Each account has an isolated space; a key only reaches the documents of its own account.
• Access keys are stored only as a hash; the plain value is shown once.
• In case of a security incident with relevant risk, we notify the ANPD and the affected people as required by current regulation.

8. Cookies and audience measurement

The site uses only necessary cookies: language preference, signed-in indicator and login authentication. Audience measurement is done without cookies (Cloudflare Web Analytics). There are no advertising or tracking cookies.

9. Changes

Changes get a new dated version and are announced by e-mail to the account administrator.