Privacy Policy

NxtHatch Technologies ("NxtHatch," "we," "us," or "our") is a software development and technology consulting business operated from Pakistan and serving clients internationally.

Website: www.nxthatch.com

Privacy contact: privacy@nxthatch.com

General inquiries: use our contact form or the business contact identified in your active Statement of Work, marketplace contract, invoice, or other written agreement.

For professional services, the contracting party, payment instructions, governing terms, and any client-specific data requirements are the ones stated in the applicable Statement of Work, marketplace contract, invoice, or other written agreement. This Privacy Policy describes how NxtHatch handles personal information in connection with the website, business development, and delivery of services.

• Do we sell your personal information? No. We do not sell personal information.
• Do we use information for advertising or measurement? We use website analytics and may use advertising measurement tools. Where applicable law requires consent before non-essential cookies or advertising tags are enabled, those tools must be controlled by the site's consent settings.
• Do we intentionally collect sensitive personal information through the website? No. Our public website forms are not intended for sensitive personal information such as health records, government identifiers, financial account credentials, biometrics, or precise geolocation. Please do not submit that information through a general website form.
• Do we use your data to train AI models? We do not use website visitor data or Client Data to train our own general-purpose AI models. If a client engagement uses a third-party AI service, data handling is governed by the applicable engagement terms and the provider configuration selected for that project.
• Can you control cookies and advertising preferences? Yes. You can use the consent controls made available on the site where applicable, browser controls, and supported universal opt-out mechanisms such as Global Privacy Control (GPC).
• Where may information be processed? Primarily in Pakistan and in countries where our service providers operate, which may include the United States. Client-specific data residency or access restrictions should be agreed in writing before work begins.
• Who can exercise privacy rights? We accept privacy requests from individuals regardless of location, subject to applicable law and reasonable identity verification.
• How do I make a request? Email privacy@nxthatch.com with the subject line "Privacy Request."

We handle personal information in two distinct capacities, and your rights differ depending on which applies.

As a business (controller). For information we collect about website visitors, prospective clients, business contacts, and our own Clients, we decide how and why it is used. This Part governs that information, and you can exercise your rights against us directly.

As a service provider (processor). While delivering Professional Services, we may access systems, databases, or files belonging to a Client that contain personal information about that Client's customers, employees, or users — this is Client Data. We access it only to perform the Services, only on the Client's documented instructions, and never for our own purposes.

We do not sell Client Data, do not retain it beyond the engagement, and do not use it to train models or build our own datasets. If you are an individual whose data appears in a Client's systems, the Client is responsible for responding to your privacy rights request — please contact them directly, and we will assist them promptly. Section 39 describes our contractual commitments to Clients on this point.

The list below uses the categories defined by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), because they are the most widely recognized framework in the United States.

• Identifiers — What we collect: Name, business email address, business phone number, company name, IP address. Source: You, via our contact form; public business sources. Why: Respond to inquiries, deliver Services, prevent abuse.
• Commercial information — What we collect: Services you're interested in, indicated budget range, records of Services provided, billing history. Source: You. Why: Prepare proposals, manage engagements, invoice.
• Internet or network activity — What we collect: Pages viewed, time on page, clicks and scroll depth, referring URL, browser and device type. Source: Automatically, via analytics. Why: Understand and improve site performance.
• Geolocation data — What we collect: Approximate city or region inferred from IP address. Not precise geolocation. Source: Automatically, via analytics. Why: Traffic analysis.
• Professional or employment information — What we collect: Company name, job title, industry, publicly listed business profile. Source: You; public business sources. Why: Assess fit, tailor proposals, business outreach.
• Audio or visual — What we collect: Recordings of video calls, only where all participants are told in advance and consent. Source: You, during an engagement. Why: Meeting notes, with consent.
• Inferences — What we collect: Whether a business appears to be a good fit for our Services. Source: Derived from the above. Why: Prioritize outreach and proposals.

Sensitive information: We do not intentionally request or seek to collect sensitive personal information through our public website forms. Please do not submit health records, government identifiers, financial account credentials, biometrics, precise geolocation, or similar sensitive information through general website forms. Client Data handled during Professional Services may include sensitive or regulated information only where required by the engagement and subject to the applicable agreement.

29.1 Where the Information Comes From

• Directly from you. Our contact forms collect your name, email, company, phone number, type of inquiry, service of interest, budget range, expected timeline, and message, along with your consent to be contacted. You may also email, call, or message us.
• Automatically. See Section 33.
• From public sources. For business-to-business outreach, we compile business contact details — first name, last name, company name, company website, publicly listed social profile, and business email — from company websites, public business directories, publicly accessible social profiles, and search engine results. See Section 36.
• From our Clients. During an engagement, a Client may give us access to systems containing Client Data.

We use personal information for these business purposes:

• Responding to your inquiry and providing information you requested
• Preparing proposals and Statements of Work, and communicating about a potential engagement
• Performing, managing, and supporting Professional Services
• Invoicing and collecting payment
• Sending business-to-business communications about our Services to relevant business contacts
• Measuring and improving website performance and content
• Detecting and preventing fraud, spam, security incidents, and abuse
• Complying with legal, tax, and accounting obligations, and establishing or defending legal claims

We do not use personal information for automated decision-making that produces legal or similarly significant effects, engage in profiling for such purposes, or use it to train artificial intelligence or machine learning models.

We disclose personal information only as reasonably necessary to operate the website, communicate with prospects and clients, deliver services, process payments, maintain business records, protect our systems, and comply with law. We do not rent or trade contact lists.

• Website hosting and infrastructure providers — may receive server logs, network information, and form submissions needed to operate the website.
• Email and productivity providers — may receive correspondence and business contact details needed for communication and collaboration.
• Analytics and advertising providers — may receive website usage data, IP-derived information, device/browser details, and cookie or similar identifiers, subject to the privacy controls described in Section 33.
• Live chat provider — when live chat is enabled, we use Tawk.to to provide chat functionality. The provider may process information needed to provide the chat interaction and the messages you choose to send. Where prior consent or user action is required, the chat technology is configured not to load until that choice or action occurs.
• Payment, invoicing, and accounting providers — may receive billing contacts and transaction-related information needed to invoice and collect payment.
• Personnel and approved subcontractors — receive only the information reasonably necessary for their work and are subject to confidentiality obligations appropriate to their role.
• Professional advisers — may receive information where reasonably necessary for legal, accounting, security, insurance, or audit support.
• Government authorities or other parties — may receive information where disclosure is required by law or reasonably necessary to protect rights, safety, or security.
• A buyer, successor, or transaction adviser — may receive information in connection with a merger, financing, acquisition, reorganization, or sale of business assets.

Service providers process information under their own contractual terms and applicable privacy obligations. Where the law or a client agreement requires additional data-processing terms, we address those requirements in the relevant agreement.

We do not sell personal information. We do not currently use the website for cross-context behavioral advertising or otherwise "share" personal information as that term is defined by the CCPA/CPRA. We do not knowingly sell or share personal information of anyone under 16.

Current advertising use: We do not currently use the website for remarketing or cross-context behavioral advertising. If we enable advertising measurement or advertising technologies in the future, we will apply the consent and opt-out controls required by applicable law and update our disclosures as appropriate.

We use analytics and tag-management tools to understand website performance and, when advertising campaigns are active, may use advertising measurement tools. The specific technologies enabled on the site can change as our marketing stack changes.

• Google Tag Manager — used to manage analytics and measurement tags.
• Google Analytics 4 — used to measure traffic, engagement, and website performance. Analytics cookies may include identifiers such as _ga and related GA4 cookies.
• Google advertising measurement — may be enabled when paid campaigns are active for conversion measurement, attribution, audience measurement, or remarketing where permitted.
• Tawk.to live chat — used to provide live chat when enabled. We configure the chat to load only after a visitor chooses to start a chat, rather than as part of the default page load.

Non-essential analytics or advertising technologies must be configured in a way that reflects applicable consent and opt-out requirements. Where prior consent is required, the site's consent controls should prevent those non-essential technologies from being enabled until the required choice is made.

You can also block or delete cookies in your browser. Doing so should not prevent access to the core website.

We honor supported universal opt-out mechanisms, including Global Privacy Control (GPC), for requests that applicable law requires us to recognize. We do not rely on the older Do Not Track header as a universal standard.

For privacy questions or requests, email privacy@nxthatch.com.

We extend the following rights to everyone, regardless of your state or country of residence. You do not need to be a resident of a state with a privacy law to make a request.

• Know / Access — Confirm whether we process your personal information, and get a copy of it
• Correct — Have inaccurate personal information fixed
• Delete — Have your personal information deleted, subject to legal retention obligations
• Portability — Receive your information in a portable, readily usable format
• Opt out — Opt out of targeted advertising and of any sale or sharing of personal information
• Limit sensitive data use — We do not intentionally request sensitive personal information through public website forms. If sensitive or regulated Client Data is handled during an engagement, it is governed by the applicable agreement and relevant legal requirements.
• Non-discrimination — We will not deny service, charge a different price, or provide a lesser quality of service because you exercised a right
• Appeal — Ask us to reconsider if we decline your request — see Section 34.2

34.1 How to Submit a Request

Email privacy@nxthatch.com with the subject line "Privacy Request." Tell us what you would like us to do and give us enough detail to locate your information — typically the email address you used or that we contacted you at.

Response times. We aim to respond within 45 days unless applicable law requires a different deadline. Where the UK GDPR, EU GDPR, or another applicable law provides a different statutory response period, that period controls. Requests are generally free. We may limit, refuse, or charge for repetitive, manifestly unfounded, or excessive requests only where applicable law permits.

Verification. We may need to verify your identity before acting, usually by confirming you control the email address associated with the information. We ask only for what is necessary to verify, and we do not use verification information for any other purpose.

Authorized agents. You may use an authorized agent where state law permits. We will ask for written proof of authorization and may still ask you to verify your own identity directly.

34.2 Right to Appeal

If we decline your request, our response will explain why. You may appeal by replying to that response or emailing privacy@nxthatch.com with the subject line "Privacy Appeal." We will review the appeal and give you a written decision, with our reasoning, within 60 days or any shorter period required by applicable law.

If we deny your appeal, you may submit a complaint to your state attorney general. Texas residents may file with the Texas Attorney General's Consumer Protection Division. California residents may contact the California Privacy Protection Agency.

Privacy rights in the United States vary by state and often depend on whether a business falls within a particular law's scope or threshold. Where an applicable state privacy law grants you rights in relation to personal information we control, we will honor those rights as required by that law.

35.1 California

California residents may have rights concerning access, correction, deletion, portability, and certain uses or disclosures of personal information where the California Consumer Privacy Act, as amended, applies. Sections 29 through 37 explain the categories of information we handle, the purposes, recipients, and retention approach. We do not sell personal information in the ordinary meaning of that term.

35.2 Texas and Other U.S. States

Residents of Texas and other states with comprehensive privacy laws may have rights such as access, correction, deletion, portability, opt-out of targeted advertising or sale, and an appeal process where the applicable law provides those rights. Because statutory scope and thresholds differ by state, the rights that legally apply depend on the circumstances.

Regardless of whether a particular state law applies to NxtHatch, we accept privacy requests from individuals and will make a good-faith effort to provide access, correction, deletion, and opt-out choices where reasonably possible and consistent with legal, security, contractual, and record-retention obligations.

35.3 Nevada

Nevada residents may submit a request concerning the sale of covered information. NxtHatch does not sell personal information, but requests can still be sent to privacy@nxthatch.com.

We conduct business-to-business outreach and compile business contact details from publicly available sources, as described in Section 29.1.

We collect this information only in a professional or business capacity. We do not purchase consumer data lists, do not scrape private or password-protected content, and do not collect sensitive personal information through this activity.

Our commitments to you:

• Our commercial marketing practices are designed to comply with the CAN-SPAM Act, including a working unsubscribe mechanism and a valid physical postal address where required.
• We honor opt-out requests within 10 business days, the deadline CAN-SPAM sets.
• Opted-out addresses go on a permanent suppression list, checked before every send, so you are not contacted again.
• Our sender name, "From" address, and subject lines accurately identify us and the content of the message.
• If you want to know how we obtained your business contact details, email us and we will tell you the source.

Opting out of marketing does not stop transactional or engagement-related messages if you are an active Client.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide services, maintain business and tax records, resolve disputes, enforce agreements, honor opt-out requests, and meet legal or contractual obligations.

• Website inquiries that do not become engagements are generally retained for up to 24 months after the last meaningful contact, unless there is a reason to keep them longer or you request deletion and no exception applies.
• Client contracts, invoices, and core business correspondence may be retained for the period reasonably required for accounting, tax, legal, insurance, and dispute-resolution purposes.
• Client Data accessed during Professional Services is returned, deleted, or retained according to the applicable agreement, the Client's documented instructions, legal obligations, and technical backup cycles.
• Business contact data used for outreach is retained while relevant to legitimate business development, subject to opt-out and suppression requirements.
• Opt-out and suppression records may be retained for as long as necessary to ensure we continue honoring the opt-out.
• Analytics data is retained according to the settings of the analytics platform and our configured retention periods.
• Records of privacy requests may be kept for a reasonable period to document compliance and prevent repeated unauthorized access to personal information.

When information is no longer needed, we delete it, de-identify it, or allow it to expire through ordinary system and backup retention processes, as appropriate.

We maintain administrative and technical safeguards designed to reduce the risk of unauthorized access, disclosure, alteration, or loss of personal information. The safeguards used depend on the system, the information involved, and the services being delivered.

• Encryption in transit — we use encrypted network connections such as TLS for supported systems and services.
• Access controls — business systems are restricted according to role and operational need.
• Authentication — multi-factor authentication is used on business-critical systems where supported and appropriate.
• Confidentiality — personnel and subcontractors with access to confidential information are expected to be bound by appropriate confidentiality obligations.
• Access lifecycle — access should be removed or changed when a person's role or engagement no longer requires it.

No method of transmission, storage, or security control is completely secure, and we cannot guarantee absolute security.

If we become aware of a security incident involving personal information for which notification is legally required, we will provide notices to affected parties and regulators in accordance with the applicable law and any client-specific contractual obligations.

When NxtHatch processes personal information on behalf of a Client, the Client generally determines the purpose of the processing and NxtHatch acts as a service provider or processor to the extent defined by the applicable engagement.

• Documented instructions — we process Client Data for the services and purposes described in the applicable agreement.
• Confidentiality and access — access is limited to personnel or approved subcontractors who reasonably need it for the engagement and are subject to appropriate confidentiality obligations.
• Data-processing terms — where a Data Processing Addendum, Business Associate Agreement, security addendum, subprocessor list, or other privacy term is required, it should be agreed in writing for the engagement.
• Rights requests and incidents — we will reasonably assist the Client with privacy requests, security incidents, and other obligations to the extent required by the applicable agreement and law.
• Return or deletion — Client Data is returned, deleted, or retained according to the applicable agreement, legal obligations, and the Client's documented instructions.
• AI use — we do not use Client Data to train our own general-purpose AI models. Any use of a third-party AI service with Client Data must be part of the agreed solution and subject to the selected provider configuration and engagement terms.

Data residency, access-location restrictions, security questionnaires, regulated-data requirements, and similar constraints should be raised before work begins so they can be reflected in the architecture and the applicable Statement of Work or other agreement.

NxtHatch is operated from Pakistan and serves clients internationally. Personal information may therefore be accessed by authorized personnel in Pakistan and may also be processed by service providers in other countries, including the United States, depending on the services used.

For Client Data, the locations from which NxtHatch personnel may access information and any data-residency restrictions should be agreed in the applicable Statement of Work, Data Processing Addendum, Business Associate Agreement, marketplace contract, or other written agreement where relevant.

When applicable privacy law requires safeguards for an international transfer, the parties should use an appropriate legal mechanism for the specific transfer. This may include contractual safeguards or other recognized transfer mechanisms, depending on the jurisdictions involved.

Individuals may have additional rights under laws that apply to them, including the GDPR or UK GDPR where those laws apply. Requests can be sent to privacy@nxthatch.com, and we will respond according to the applicable legal and contractual requirements.

Our website and Services are directed to businesses and to individuals over 18. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect information from children under 13 as defined by the Children's Online Privacy Protection Act (COPPA).

If you believe a child has provided us with personal information, email privacy@nxthatch.com and we will delete it promptly.

If you have a disability and need this document in an alternative format, email privacy@nxthatch.com and we will provide one at no charge.

We may update this Part. We will post the revised version here and update the "Last updated" date at the top of this document. If changes are material, we will provide more prominent notice — such as an email or a website banner — before they take effect.

We will not apply material changes retroactively to information already collected without your consent where the law requires it.

Privacy requests and questions: privacy@nxthatch.com (subject line "Privacy Request")

General inquiries: www.nxthatch.com/contact

Formal notices relating to a professional services engagement should be sent using the notice method stated in the applicable Statement of Work, marketplace contract, invoice, or other written agreement.

If an active agreement does not specify a notice method, use the business contact shown on the most recent agreement or invoice and keep a copy of the written notice for your records.