Privacy Policy

1. Introduction and Scope

This Privacy Policy applies to all information collected by NextWave Apps through our website, inquiry forms, discovery calls, project onboarding processes, and ongoing client communications. It applies to visitors to our website, prospective clients who submit inquiry forms or engage in discovery consultations, active project clients, and any other individuals whose personal information we process in connection with our business operations.

NextWave Apps operates as a professional digital product development studio. We are not in the business of selling personal information, using personal information for advertising purposes, or building data profiles for commercial exploitation. The data we collect is used exclusively to provide, improve, and communicate about our services.

This Privacy Policy does not apply to the data practices of any digital products, applications, or platforms that we build for our clients. Each such product is governed by its own privacy policy, for which the respective client is the data controller. NextWave Apps may assist clients in developing privacy policies for their products as part of the engagement, but responsibility for compliance with applicable privacy laws in those products rests with the client.

2. Information We Collect

2.1 Information You Provide Directly

Contact and Inquiry Information: When you complete our inquiry form, reach out via email, or schedule a discovery call, we collect your name, email address, company name, phone number (if provided), and the content of your message. We use this information to respond to your inquiry and assess whether our services are a good fit for your needs.

Project Information: When you engage with us as a client, we collect information necessary to execute the project, including but not limited to project requirements and specifications, brand assets and content, technical documentation, business context and market information, and any other information you choose to share during the project lifecycle.

Payment Information: We process payments through reputable third-party payment processors. NextWave Apps does not directly collect or store full credit card numbers, bank account details, or other sensitive payment credentials. We do retain records of invoice amounts, payment dates, and payment status for accounting and contractual purposes.

Communications: We retain records of email correspondence, project feedback, meeting notes, and other communications exchanged during the inquiry and project phases. These records are maintained to ensure continuity of service and to resolve any disputes that may arise.

2.2 Information Collected Automatically

When you visit our website, we may automatically collect technical information about your visit, including your IP address or general geographic region, browser type and version, operating system, referring URL, pages visited, time spent on pages, and date and time of visit. This information is collected through server logs and analytics tools and is used in aggregate form to understand website traffic patterns and improve our online presence.

2.3 Information from Third Parties

We may receive information about you from third-party sources, such as professional networking platforms, referral partners, or publicly available business information, when this is relevant to evaluating or conducting a potential project engagement. We handle all such information in accordance with this Privacy Policy.

3. How We Use Your Information

NextWave Apps uses personal information for the following purposes, consistent with the legal bases described in Section 4:

3.1 Responding to Inquiries

We use contact information you provide through our inquiry form or direct communication to respond to your questions, provide information about our services, assess project fit, and schedule discovery consultations. This is the primary use of information provided by prospective clients.

3.2 Project Delivery

For active project clients, we use the information provided to understand your requirements, develop and deliver the agreed deliverables, communicate project progress, request necessary approvals and feedback, manage project documentation, and coordinate with the project team. This is the primary use of information for current clients and is essential to the performance of our contractual obligations.

3.3 Billing and Invoicing

We use your contact and payment information to prepare and send invoices, process payments through our payment processors, maintain financial records, and comply with applicable tax and accounting obligations.

3.4 Service Improvement

We analyze aggregate, anonymized data from website interactions and project outcomes to identify trends, improve our processes, enhance our website, and develop our service offerings. No individual is identified in this analytical activity.

3.5 Legal Compliance and Rights Protection

We may use and retain personal information as required by applicable laws and regulations, to enforce our Terms of Service and project agreements, to respond to legal requests or regulatory inquiries, and to protect the rights, property, or safety of NextWave Apps, our clients, and the public.

3.6 Portfolio and Marketing

With appropriate permission as described in our Terms of Service, we may reference project outcomes and general client information in our portfolio and marketing materials. We do not use client personal contact information for unsolicited marketing purposes.

4. Legal Basis for Processing

For individuals subject to the General Data Protection Regulation (GDPR) or similar privacy frameworks, we process personal information on the following legal bases:

Contract Performance: Processing necessary to respond to your inquiry, enter into a project agreement, and deliver our services pursuant to that agreement.

Legitimate Interests: Processing for purposes of website analytics, business development, and portfolio documentation, where our legitimate interests in operating and improving our business are not overridden by your privacy interests.

Legal Obligation: Processing required by applicable laws, including tax, financial reporting, and legal compliance obligations.

Consent: Where we process information based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal. We do not rely on consent as a legal basis for processing information provided during the course of a project engagement.

5. Information Sharing and Disclosure

NextWave Apps does not sell, rent, or trade your personal information to third parties for commercial purposes. We may share information in the following limited circumstances:

5.1 Service Providers

We work with carefully selected third-party service providers who assist us in operating our business and delivering our services. These include cloud infrastructure providers such as Amazon Web Services or Google Cloud, project management and collaboration tools such as Notion and Slack, payment processors, email and communication services, and analytics platforms. All service providers are bound by contractual data processing agreements and are permitted to use your information only as directed by NextWave Apps and only to the extent necessary to provide the relevant service.

5.2 Project Subcontractors

In certain projects, NextWave Apps may engage specialized contractors or subcontractors such as security auditors, content writers, or specialized engineers. These individuals are bound by confidentiality obligations and are permitted to access only the information strictly necessary for their contribution to the project.

5.3 Legal Requirements

We may disclose personal information if required to do so by law, regulation, or valid legal process, or if we believe in good faith that such disclosure is necessary to protect the rights or safety of NextWave Apps, our clients, or others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our business assets, personal information held by NextWave Apps may be transferred to the acquiring entity as part of the transaction. We will endeavor to provide notice of any such transfer and will ensure that the receiving party commits to protecting personal information in a manner consistent with this Privacy Policy.

6. Data Retention

NextWave Apps retains personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. Our general retention practices are as follows:

Inquiry information from prospective clients who do not proceed to a project engagement is retained for up to 24 months from the date of last contact, after which it is deleted or anonymized. We retain this information to support future engagement if you return to us with a project.

Project documentation, communications, and deliverables related to completed client projects are retained for a minimum of 5 years following project completion. This period reflects our need to support any warranty claims, legal disputes, or compliance inquiries that may arise after project completion.

Financial records, including invoices, payment records, and contractual documents, are retained for a minimum of 7 years in compliance with applicable tax and accounting regulations.

Website analytics data is retained in aggregate, anonymized form for up to 36 months and is used solely for the purpose of understanding traffic trends and improving our online presence.

Upon expiration of the applicable retention period, personal information is securely deleted or rendered irrecoverably anonymous. You may request earlier deletion of your information as described in Section 8, subject to any overriding legal obligations to retain it.

7. Data Security

NextWave Apps takes the security of your personal information seriously and implements a range of technical and organizational measures designed to protect it against unauthorized access, use, disclosure, alteration, or destruction. Our security practices include the use of encrypted communications (TLS/HTTPS) for all data transmitted to and from our website, access controls and role-based permissions for internal systems, secure, password-protected document and communication platforms, regular review of our security practices and technology, and training of our team members on data security obligations and best practices.

Despite our efforts, no system of data transmission or storage can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately at the contact information provided in Section 15. In the event of a data breach that affects your personal information in a manner that creates a significant risk to your rights or freedoms, we will notify you and the relevant authorities as required by applicable law.

8. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal information:

Right of Access: You may request a copy of the personal information we hold about you and information about how it is used.

Right to Rectification: If any personal information we hold about you is inaccurate or incomplete, you have the right to request correction.

Right to Erasure: In certain circumstances, you may request that we delete your personal information. This right is not absolute and may be limited by our legal obligations or legitimate interests in retaining certain records.

Right to Restriction: You may request that we restrict the processing of your personal information in certain circumstances, such as while we are verifying a correction request.

Right to Data Portability: Where processing is based on your consent or on a contract and is carried out by automated means, you may request that we provide your personal information in a structured, commonly used, machine-readable format.

Right to Object: You may object to processing of your personal information where we are relying on legitimate interests as the legal basis. We will honor such objections unless we demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us using the information in Section 15. We will respond to all verified requests within the timeframe required by applicable law, generally within 30 days. We may need to verify your identity before processing a rights request to ensure that we do not disclose or alter information belonging to another person.

9. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to operate effectively and to collect analytics information. Cookies are small text files stored on your device that help us recognize returning visitors, understand how our site is navigated, and identify areas for improvement.

We use strictly necessary cookies, which are essential for the basic operation of our website and cannot be disabled without significantly impairing your ability to use the site. These cookies do not collect personal information and are activated only in response to your actions, such as navigating between pages or submitting a form.

We may also use analytics cookies, which allow us to count visits, understand traffic sources, and measure the effectiveness of our content. Information collected through analytics cookies is aggregated and anonymous. We use tools such as Google Analytics to gather this data, and we have configured such tools to anonymize IP addresses to the extent possible.

We do not use advertising cookies, retargeting pixels, or third-party tracking technologies designed to build a personal profile for commercial advertising purposes on our website. We do not engage in cross-site behavioral tracking.

You may control cookies through your browser settings. Most browsers allow you to view, manage, and delete cookies stored on your device. Please note that disabling certain cookies may affect the functionality of our website. For more information about managing cookies, you can visit your browser's help documentation or a resource such as www.allaboutcookies.org.

10. Third-Party Services and Links

Our website may contain links to third-party websites, resources, or services that are not operated or controlled by NextWave Apps. These links are provided for your convenience and informational purposes only. We have no control over the content, privacy practices, or data handling of any third-party website, and our inclusion of a link does not imply endorsement or any affiliation with the linked site.

We strongly encourage you to review the privacy policies of any third-party websites you visit through links on our site before providing any personal information. This Privacy Policy applies solely to information collected by NextWave Apps and does not govern the practices of any third-party operator.

During project delivery, we may utilize third-party tools and platforms — such as Figma for design collaboration, GitHub for code management, Notion for documentation, and Slack for communication — as shared workspaces with our clients. Information shared within those platforms is subject to the respective platform's terms and privacy policy in addition to our own confidentiality obligations. We select these tools with care and review their security practices before adoption.

11. International Data Transfers

NextWave Apps is headquartered in Lexington, Kentucky, United States, and all personal information we collect is stored on servers located in the United States. If you are accessing our services from outside the United States, please be aware that your personal information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those of your country or region.

For individuals located in the European Economic Area (EEA), the United Kingdom, or other regions with data transfer restrictions, we rely on appropriate legal mechanisms to ensure that any transfer of personal information outside your jurisdiction complies with applicable law. These mechanisms may include the use of Standard Contractual Clauses approved by the European Commission or equivalent safeguards.

By using our website or engaging our services, you acknowledge and consent to the transfer of your personal information to the United States under the conditions described in this section. If you have questions about the safeguards we apply to international data transfers, please contact us using the information in Section 15.

12. Children's Privacy

NextWave Apps's website and services are directed exclusively at individuals who are 18 years of age or older, or the age of majority in their applicable jurisdiction. We do not knowingly collect, solicit, or retain personal information from children under the age of 13, or under the applicable age threshold in other jurisdictions, including 16 years in certain European jurisdictions.

If we become aware that we have inadvertently collected personal information from a child below the applicable age threshold without verifiable parental or guardian consent, we will take prompt steps to delete such information from our records. If you believe that we may have collected information from a child in error, we ask that you contact us immediately using the information in Section 15 so that we can investigate and remediate the situation without delay.

If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us. We do not serve individuals under the age of 18 in any capacity and have no commercial reason to collect or retain their data.

13. California Privacy Rights

If you are a resident of the State of California, you may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). This section describes those rights and how to exercise them.

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.

Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law, including where retention is necessary to complete a transaction, comply with a legal obligation, or detect security incidents.

Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing: NextWave Apps does not sell personal information and does not share personal information for cross-context behavioral advertising purposes. Accordingly, there is no opt-out mechanism required for these activities.

Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising any of your CCPA rights. We will not deny you services, charge you different prices, or provide a different level of service because you exercised a privacy right.

To submit a CCPA rights request, please contact us using the information in Section 15. We will verify your identity before processing any request. You may designate an authorized agent to submit requests on your behalf, provided we are furnished with written authorization and are able to verify both your identity and the agent's authority.

14. Changes to This Policy

NextWave Apps may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make changes, we will update the "Last updated" date at the top of this document. For material changes that significantly affect how we collect or use personal information, we will endeavor to provide more prominent notice, such as by sending an email notification to active clients at the address on file or by posting a notice on our website prior to the change taking effect.

We encourage you to review this Privacy Policy periodically to remain informed about how we handle your information. Your continued use of our website or our services after any changes to this Privacy Policy have taken effect constitutes your acceptance of the revised policy. If you do not agree with a revised policy, you should discontinue your use of our website and, if applicable, contact us to discuss the implications for any active project engagement.

Previous versions of this Privacy Policy are available upon request by contacting us at the information provided in Section 15. We maintain a record of prior versions to ensure full transparency about any changes to our data practices over time.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices — including requests to exercise your privacy rights — please contact us through any of the channels below. We are committed to responding to all written privacy inquiries within three business days and to resolving all substantive requests within the timeframe required by applicable law.