Privacy Policy

This policy states what data Nexto collects, where it keeps it, and what control you have over it.

Nexto is a product of Servat Afarinan Kohan Co. Address: Tehran, Enghelab Square, Azadi Street, between North Jamalzadeh and Valiasr, No. 61, Unit 34 · National ID 14012627540 · Contact regarding privacy: [email protected]

Two types of data that are different

This distinction is important: the data inside your software is your customers' data, not ours. Whenever you want, you can download its complete and usable backup and take it with you.

What we collect from a site visitor

When you get a demo: name, exchange name, WhatsApp number, selected language, IP address, entry page, and campaign parameters. The WhatsApp number is verified by a message; without it, the demo is not created.

When you create a panel account or purchase: name, exchange name, contact number, language, and for an order: plan, period, amount, payment network, and transaction ID.

When you request API access: name, exchange name, contact method, use description, and IP.

Payment: only Tether on public networks. We do not store any bank card information; what remains is the transaction ID and the network name.

Cookies

• nexto-session and XSRF-TOKEN — they are the site's own technical cookies: keeping the session and preventing request forgery. Without these two, login and forms do not work.
• Google Analytics 4 — visit statistics, so that we know which page is useful.

You can block or delete cookies from your browser settings; in that case, sections that need a session (such as login to the panel) will not work.

External services through which data passes

Inquiry services (AML, Shaba, identity, energy, OCR) are run only inside the exchange software and at the user's own request, not on the public site. In that case, only the same thing whose inquiry you requested is sent — for example, a Shaba number or a wallet address.

Where data is stored

On Hetzner servers in the European Union: the main server in Helsinki (Finland) and the heavy-files server in Nuremberg (Germany). Each customer has its own separate database.

Our access to your data

We do not touch the data inside your software. For support, there is read-only and time-limited (72 hours) access, which is activated with your notice and expires by itself. Every write operation in our panel is logged with the username and IP address.

Retention and deletion

• Recorded technical errors, for following up on a report you provide: 180 days, then they are automatically deleted.
• Demos have an expiration date and are deleted after that.
• Financial records (order and payment): as long as the law requires their retention.
• Other site and panel records: a maximum of 24 months after the end of cooperation, then they are deleted or anonymized.
• Deletion request: write to [email protected]; you will receive a response within a maximum of 7 working days. You can back up the data inside your own software yourself at any moment.

Your rights

You can ask to see your data, correct it, or have us delete it; you can receive a copy of it; and you can object to the manner of processing. For all of these, there is one address: [email protected]

Because our servers are in the European Union, we base ourselves on the principles of the General Data Protection Regulation (GDPR); if you are a user of the European Union, the rights above are established for you on that same basis.

If you are an enterprise customer and need a Data Processing Agreement (DPA) for hosting your own customers' data, request it so that it will be sent to you.

Changes to this policy

If this text changes, the date at the top of the page will be updated and any significant change will be notified through the same method by which we are in contact with you.

Reference language

This document is published in several languages. In case of any discrepancy in interpretation, the Persian version is the reference.

The terms of service are set out on the Terms of Use page.