Privacy Policy

Last updated 15 August 2026

Nextbard is a business-research tool. It holds two very different kinds of personal data, and this policy keeps them apart: the data we hold about you, our customer, and the data you collect about businesses using the tool. We are responsible for the first. You are responsible for the second, and the section on collected contact data explains exactly what that means.

Who we are

Nextbard is operated by Zaid Koutam, a sole trader established in Morocco, at Rue Ibn Batouta 45, Maarif, Casablanca 20330, Morocco. For anything in this policy, write to support@nextbard.com.

For data we hold about our own customers, we are the data controller. Payments are handled by Creem, which acts as merchant of record and is a separate controller for the payment data it collects.

What we collect about you

Account data

Your email address and a hashed password. We never store your password in a form we can read. A session cookie keeps you signed in.

Usage data

The search queries you run, the settings you use, credit and lead counts, and timestamps for each run. We need these to enforce plan limits, show you your own history, deduplicate across runs and bill correctly.

Billing data

We do not see or store your card. Checkout runs on Creem's own hosted page. What comes back to us over a signed webhook is your plan, subscription status and a customer reference — enough to unlock the right tier, nothing more.

Technical data

Server logs record IP address, request path and time for security and debugging. We do not run advertising trackers, analytics profiling or third-party marketing pixels on this site.

Contact data you collect with the tool

This is the part that matters most, so it is stated plainly.

• Nextbard visits pages that are already publicly published on the open web and extracts business contact addresses that the site owner chose to publish there.
• We do not sell, licence, resell or pre-build contact lists. There is no database of people here to buy. Every address in your account came from a search you wrote and a page that published it publicly.
• For that collected data, you are the data controller and we are your processor. We store it only to show it back to you, deduplicate it against your later runs and let you export it.
• That makes the lawful basis for collecting and using it, the notice given to the people concerned, and the handling of their objections and erasure requests your responsibility, not ours.
• If a person contacts us directly about an address held in a customer's account, we will pass the request to that customer and, where we are able to, remove the record. We will also add the address to a global suppression list on request.

What you may and may not do with collected addresses is set out in the Acceptable Use Policy. It is binding.

Who we share data with

We use a small number of processors, each for one job:

• Creem — merchant of record. Payments, subscriptions, invoices, tax.
• Serper — the search API your queries are sent to. Queries only; nothing about your account goes with them.
• Our hosting provider — runs the servers and stores the database.
• Our email provider — sends account and support email.

We do not sell personal data, and we do not share it with advertisers or data brokers. We disclose data to authorities only where a valid legal obligation requires it.

How long we keep it

• Run history and collected leads — for the retention window of your plan: 7 days on Free, 3 months on Solo, 12 months on Growth and Scale. After that they are deleted.
• Account data — while your account is open, then 30 days after you close it.
• Billing records — as long as tax and accounting law requires, typically up to 7 years, held by Creem as merchant of record.
• Server logs — 30 days.

Where data is stored, and international transfers

Nextbard runs on a virtual server rented from a European hosting provider, and your account data, runs and collected leads are stored there. Backups are held in the same region.

We are established in Morocco, which is outside the EEA and the UK. Administering the service therefore involves access to that data from Morocco. For customers in the EEA or the UK, that is an international transfer, and it relies on the Standard Contractual Clauses together with the safeguards described under Security below. Our processors make their own transfers under Standard Contractual Clauses or an adequacy decision.

You can ask us for details of these arrangements at support@nextbard.com.

Security

Traffic is encrypted with TLS. Passwords are stored only as salted hashes. Every account is isolated: an account can read only its own runs, leads and settings. Billing changes are only ever applied from a webhook whose signature we have verified — never from something the browser told us.

Cookies

One cookie, holding your session so you stay signed in. It is strictly necessary for the service to work, so no consent banner is required. There are no advertising, analytics or tracking cookies on this site.

Your rights

Whichever of these applies to you, the rights we give are the same. You may request access to your data, correction of it, erasure of it, a portable copy of it, restriction of processing, or object to processing. You may also withdraw consent where processing rests on consent.

• EEA and UK customers — these are your rights under the GDPR and the UK GDPR. You may complain to your national data protection authority, or to the Information Commissioner's Office in the UK.
• Moroccan customers — Law 09-08 on the protection of individuals with regard to the processing of personal data gives you equivalent rights. You may complain to the CNDP, the national data protection commission.
• Everywhere else — we apply the same rights regardless of where you live.

Email support@nextbard.com and we will respond within 30 days. You can also delete your own account and everything in it from the console at any time, without asking us.

Children

Nextbard is a business tool and is not directed at anyone under 16. We do not knowingly hold data about children.

Changes

If we change this policy we will update the date at the top, and we will email account holders before any change that materially affects them takes effect.