Privacy Policy

1. Who we are and what this policy covers

NextiaTax is one of the products of the Nextia platform, operated by 1496096 Canada Inc., doing business as Nextia AI (“Nextia”, “we”, “us”). This policy covers your Nextia account and the Nextia platform (account, business, team, billing and the “NextiaBusiness” mobile app) and, in section 9, what NextiaTax collects in addition. Each Nextia product site publishes the portions of this policy that apply to that product.

2. Our role: accountable organization or service provider

• For the account data of a business owner and their staff, Nextia is the organization accountable for that information.
• For a business's own customer data — for example a receipt or a vendor on a document a business uploads — Nextia is a service provider processing that information on the business's behalf. The business remains accountable for it, so questions about it should go to that business first.

Nextia AI’s Privacy Officer is accountable for this policy. Questions, requests and complaints may be sent to privacy@nextia-ai.com. For account and direct-customer information, Nextia is the accountable organization; for a business’s customer information, Nextia acts as a service provider on that business’s behalf.

3. Where your data is stored

• Nextia's databases (Azure Database for PostgreSQL Flexible Server) and file storage (Azure Blob Storage) are in Microsoft Azure's Canada Central region.
• Sign-in runs on Microsoft Entra External ID, in a directory created in Canada Central.
• Service providers that process some information outside Canada are listed in section 10.

Document reading (Azure AI Document Intelligence) runs in Microsoft Azure’s Canada Central region. The AI assistant and AI categorization use Azure OpenAI through a resource in Canada Central, where the service’s stored data stays; Microsoft’s Global deployment type may process prompts and responses in other Azure regions.

4. What we collect about you when you sign in

• A stable internal identifier, your primary email address and whether it is verified, your display name, your preferred language and, optionally, a phone number.
• Which sign-in method asserted your account — email and password, Google, Microsoft or Apple — and the email address that provider stated when it was linked.
• Which businesses you belong to, your role in each, and pending invitations sent to your email address.

Your account is keyed on the identity provider's identifier for you, not on your email address. That is why changing your email does not create a new account.

5. What the Nextia platform does with business information

• Shared clients. A client record entered in one Nextia product is visible in the business's other Nextia products. It is shared across that business's products, never across businesses.
• Cross-product insights. The NextiaBusiness home screen combines figures from the business's Nextia products. Nothing that identifies a customer leaves the business.
• Weekly summary email. Opt-in, and off by default.
• Billing. Nextia subscriptions are billed through Stripe. Nextia stores subscription status and price identifiers, never card numbers.

6. Audit trail and support access

Nextia records consequential actions in an audit trail that stores the identifier and email address of the person who acted. The audit trail is designed to outlive the account: if you ask us to erase your account, your account is scrubbed, but the audit record of what that account did is kept for the audit retention period (section 8).

A Nextia staff member can, with a recorded reason, act inside a business's account to provide support. Every such session is recorded. A business owner may request the record of support sessions by emailing privacy@nextia-ai.com.

7. How we protect information

• Every request into a business's data goes through a permission check tied to that business, and automated tenant-isolation tests fail the build if data can be read across businesses.
• Nextia never holds your password. Authentication is delegated to Microsoft Entra External ID and the identity providers above.
• Third-party connection tokens (such as calendar and meeting connections) and payment-provider credentials are encrypted at rest in the product database, and the service refuses to start in a production environment without a real encryption key.
• Our logging rules forbid logging passwords, tokens, sign-in assertions, payment credentials, or client data beyond identifiers.

8. How long we keep information (NextiaTax)

A daily retention job in NextiaTax does the following, and this is the only automatic deletion Nextia currently runs:

• Audit-log entries older than 365 days (the default setting) are deleted.
• Documents you delete are first soft-deleted. After 30 days the file is purged from storage and the record is removed, together with its transactions.
• Transactions and assistant conversations you delete are permanently deleted after the same period.

Tax records may be needed years later, for example for a reassessment. Keep your own export before deleting anything you may need. Billing and tax records that Nextia must retain for legal, accounting or dispute purposes may be kept for up to six years. Support records are kept up to 24 months, audit and security logs normally no more than 24 months, and encrypted backups roll off within 90 days. A legal hold or statutory obligation may require longer retention. Other Nextia products apply the schedules stated in their product privacy pages.

9. What NextiaTax collects and why

Receipts and financial documents

Files you upload are stored in Azure Blob Storage. Transactions, vendors and categories extracted from them are stored in the database. These are among the most sensitive records we hold, and we treat them that way.

Automated reading of documents, and the assistant

Uploaded documents are sent to Azure AI Document Intelligence and, where enabled, to Azure OpenAI, so that their contents can be extracted. When you use the assistant, your conversation is sent to the same models. In other words: when you upload a bill, a model reads it. These are Microsoft services used under Nextia's own Azure subscription. Under the Microsoft’s Azure Direct Models privacy documentation states that prompts, outputs, embeddings and training data are not available to OpenAI or other customers and are not used to improve provider models.

Bank connections

If a business connects a bank feed, Plaid provides the connection and holds the banking credentials. Nextia receives transactions, never your banking credentials. Plaid’s end-user privacy policy is available at plaid.com/legal/end-user-privacy-policy.

Receipts forwarded by email

A business can forward receipts to a Nextia address. The message is received through Cloudflare Email Routing and passed to Nextia. Everything in a forwarded message is processed, including anything else in the thread.

WhatsApp

WhatsApp messaging is not enabled at launch. Before enabling it, we will disclose the information sent to Meta and add the consent and opt-out controls required for that channel.

10. Service providers (sub-processors)

Provider	What it receives	Where
Microsoft Azure	Hosting, databases, file storage, message queues, logs	Canada Central
Microsoft Entra External ID	Sign-in identity, email address	Canada Central
Azure Communication Services	Recipient address and message content for email	Canada Central
Azure AI Document Intelligence	Uploaded documents	Canada Central
Azure OpenAI	Document content and assistant conversations	Canada Central (resource and stored data); prompts may be processed in other Azure regions
Cloudflare	DNS, and email routing for forwarded receipts	Global
Stripe	Payment and subscription data; card data never reaches Nextia	United States / global
Plaid	Bank connection; holds banking credentials (where a business connects a bank)	United States / global
Meta (WhatsApp Business)	Phone number and message content (where a business enables it)	United States / global

Stripe, Plaid and Meta involve transfers of personal information to the United States. Other Nextia products use additional providers, listed in their own sections. Third-party services a business chooses to connect are governed by those providers' own terms.

11. Your rights

You can ask for access to your personal information, have it corrected, and ask for it to be erased, as described below. Subject to applicable law, you may also withdraw consent where processing depends on consent and receive computerized information in a structured, commonly used technological format where the portability right applies. We will explain any lawful refusal or limitation.

• Access and portability. In NextiaTax you can download your own data as a JSON file. A separate export package is available for your accountant. The Nextia platform account itself has no self-service export yet; ask us instead.
• Correction. Edit your information directly in the product.
• Erasure. In NextiaTax you can request deletion of your own account. The request itself deletes nothing: a Nextia administrator then scrubs your personal information. We verify and complete valid requests within 30 days unless law, security, another person’s rights or a documented legal hold requires preservation. As explained in section 6, the audit record of what the account did is retained.

These mechanisms differ between Nextia products; the rights section of each product explains what applies there. Contact our Privacy Officer first. If we do not resolve your concern, you may complain to the Office of the Privacy Commissioner of Canada or, if applicable, the Commission d’accès à l’information du Québec.

12. Cookies

The Nextia apps set no analytics cookies and run no third-party trackers. Only Microsoft Entra's own sign-in state is stored. This marketing website uses no analytics or advertising cookies. It stores only essential preferences, such as language and announcement state, in browser storage.

13. Children

Nextia accounts are for people at least 18 years old. Businesses that enter information about minors are responsible for obtaining any consent required by law and limiting the information collected.

14. Changes to this policy

This policy is effective October 4, 2026. We will post revisions with a new effective date and give notice in the service or by email before a material change takes effect when required by law.