Privacy Policy

The data controller is Nextcore C.A. ("Nextcore", "we"), a company based in Colombia that provides AI consulting and automation, CRM and ERP implementation, landing pages and websites, and chatbots.

For any privacy matter, email us at contact@nextcorevzla.com.

This policy covers:

• The nextcorevzla.com website and its contact form.
• The channels you use to reach us (email and WhatsApp).
• The internal application "Panel Diego", which connects Google accounts owned by Nextcore's principal (see "Google user data").
• Integrations with Instagram and Facebook accounts owned by Nextcore (see "Meta data").

Our products KREA School, KREA Family, KREA Academy, TaxSo, and Nextcore Academy have their own privacy policies, published on their websites. If you use one of them, its policy applies.

We only collect the data we need to reply to you and deliver our services:

• Contact form: name, email address, company (optional), the service you are interested in, and your message.
• Email and WhatsApp: the data you send us when you write (name, number or address, and the message content).
• Technical data: the IP address the form is sent from, kept only in server memory to limit abusive submissions and never stored in a database; and standard web server logs (IP, date, requested page, and browser), used for security and troubleshooting.
• Project data: if you hire us, we process the data you give us for the project, following your instructions and the terms of the proposal or contract.

We do not ask for sensitive data or payment details on this website.

• To answer your questions and prepare quotes.
• To deliver the services you hire and keep in touch during the project.
• To protect the website against spam and abuse.
• To meet legal, accounting, and tax obligations.

We do not sell your data, we do not use it for targeted advertising, and we do not send you marketing messages without your consent.

This website does not use analytics tools, tracking pixels, or advertising cookies, and it does not load third-party scripts. Fonts are served from our own domain.

The only cookie is "NEXT_LOCALE", a technical cookie that remembers the language (Spanish or English) you chose. It does not identify you and is not shared with anyone. You can delete it in your browser and the site will keep working.

We only share data with providers we need to operate, and only what each function requires:

• Resend: delivers contact form messages to our inbox by email.
• Google (Gmail, Google Calendar, and Google Workspace): hosts our email and calendar.
• Meta (WhatsApp, Instagram, and Facebook): when you reach us through those channels or interact with our accounts.
• Server provider (virtual private server): hosts the website.
• Anthropic (Claude): the AI service we use to summarize and draft inside our internal tools, as explained in "Google user data".

We may also disclose data when a competent authority requires it by law. Some of these providers process data outside Colombia, for example in the United States; we choose providers with recognized security measures.

"Panel Diego" is an internal Nextcore application. It is not open to the public: only Nextcore's principal uses it, with his own Google accounts. With express permission granted on Google's consent screen, it accesses:

• Gmail: to read and organize email in the principal's accounts (for example, labeling and sorting), prepare drafts, and send the emails the principal reviews and approves.
• Google Calendar: to view, create, and update events in the principal's calendar.

Our commitments about that data:

• It is used only to provide and improve the user-facing features of the panel described above.
• It is not sold or used for advertising, or to build profiles for advertising purposes.
• It is not transferred to third parties, except as necessary to provide the feature (for example, the AI service that summarizes or drafts an email at the principal's request), to comply with the law, or with the principal's express consent.
• It is not used to develop, improve, or train generalized artificial intelligence or machine learning models.
• No human reads it, other than the principal himself, or when necessary for security purposes (such as investigating abuse) or to comply with the law.
• It is stored on a server managed by Nextcore, with restricted access and encrypted connections, and only for as long as the feature requires.

Nextcore's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke access at any time at myaccount.google.com/permissions. Once revoked, the panel stops accessing the account and we delete the stored access tokens. To ask us to also delete data already stored, follow the steps in "Data deletion".

We connect Instagram accounts and Facebook Pages owned by Nextcore to:

• Publish our own content.
• Read and reply to comments and messages we receive on those accounts.
• Read insights for our own posts (reach, engagement, and similar).

In doing so, we may process the public username and the content of comments or messages from people who interact with our accounts. We use that data only to reply and to measure our own content; we do not sell it, use it for advertising, or share it with third parties, other than the providers listed above or when required by law.

You can ask us to delete your personal data, including data obtained through Google, Instagram, or Facebook:

1. Email contact@nextcorevzla.com with the subject "Data deletion".
2. Include your name and the detail that lets us find you: email, phone number, or Instagram or Facebook username.
3. We confirm receipt and delete the data within 15 business days at most. We let you know through the same channel once it is done.

We will only keep what a law requires us to retain (for example, invoices), and we will tell you so in our reply.

You can also remove an app's access to your Facebook or Instagram account in your account settings, under apps and websites, and to your Google account at myaccount.google.com/permissions.

• Inquiries that do not become a project: up to 24 months from the last contact, unless you ask us to delete them sooner.
• Client data: for the length of the relationship and then for as long as accounting and tax rules require.
• Server logs: for as long as needed for security and troubleshooting, then deleted.
• Google and Meta data in internal tools: while the connection is active; it is deleted when access is revoked or deletion is requested.

We use encrypted connections (HTTPS), security headers on the website, limits against abusive submissions, restricted access to our servers, and credentials that are never published in the code. No system is completely secure; if we detect an incident that affects your data, we will notify you and the authorities when required.

Under Colombian data protection law (Law 1581 of 2012 and its regulations), you can:

• Access, update, and correct your data.
• Request proof of the consent you gave us.
• Find out how we have used your data.
• Withdraw your consent and request deletion of your data, unless there is a legal duty to keep it.
• File complaints with Colombia's Superintendence of Industry and Commerce (SIC).

To exercise them, email contact@nextcorevzla.com. We answer requests within 10 business days and complaints within 15 business days at most. If you live in another country, we will also help you exercise the rights your local law grants you.

This website and our services are aimed at businesses and professionals. We do not knowingly collect data from minors. KREA's education products process student data under their own policies.

We may update this policy. We will publish the new version on this page with its effective date and, if the change is significant, let you know through our usual channels.

Nextcore C.A. · Colombia · contact@nextcorevzla.com