Privacy Policy

1.Scope

This Privacy Policy explains how NEXTMRKT, Inc. collects, uses, discloses, and retains personal information when you use NEXTMRKT's websites, applications, marketplace, support channels, and related services. It replaces privacy language prepared for any earlier marketing-only site. The Services are designed for business representatives, not personal or household use.

2.Information We Collect

Information you provide

• Account and profile information, such as name, business email, telephone number, title, role, company, address, and account preferences.
• Company and verification information, including business identity, industry, capabilities, certifications, and information used to evaluate or administer marketplace participation.
• Access-request information submitted before an account exists: your name, business email, role, company name, website, location, whether you are a buyer or a supplier, and a description of what you source or supply. We retain access requests, including those we decline, as a record of who applied and what was decided.
• Screening information collected at company setup, and again when a company asks to add buying or selling: state of incorporation, contact telephone number and role, operating address, the product lines you make or distribute and whether you are a manufacturer, distributor, or broker for each, certifications and their numbers, years operating, a LinkedIn URL, fulfilment capabilities, annual volume, and your description of your sourcing difficulties. Certification details are optional.
• Tax information. If we ask a supplier for a Form W-9, it contains a legal entity name and a taxpayer identification number. We do not store the full taxpayer identification number in our database. We store the legal name and the last four digits; the submitted form itself is held in separate, access-restricted storage reachable only by a NEXTMRKT administrator through a short-lived link.
• RFQs, quotes, messages, attachments, specifications, product or service details, and other marketplace content.
• Support requests, survey responses, feedback, and communications with NEXTMRKT.
• Subscription selections and billing details. Payment card and bank information may be collected directly by Stripe; NEXTMRKT generally receives transaction status, billing contact, payment method descriptors, and related records rather than full card numbers.

Information collected automatically

• Device, browser, operating system, IP address, user-agent, timestamps, and diagnostic information.
• Authentication, login, session, access-control, audit, and security events, including information received from Clerk.
• Usage information such as RFQ and quote activity, messages, invitations, and error logs.
• On our public website, aggregate visit counts, and, when you request access, how you found us (the referring site or campaign), if your browser provided it.
• Cookies and similar technologies as described in the Cookie Policy.

Information from other sources

We may receive information from your company administrator, invited users, counterparties, service providers, public business records, referrals, and integration partners. A buyer or supplier may provide business contact information about another person when inviting or communicating with that person.

3.How We Use Information

• Provide, administer, personalize, and support accounts and marketplace workflows.
• Authenticate users, manage roles and permissions, process invitations, and protect accounts.
• Count a company’s buyer and supplier seats, included and purchased, against the members using them, and bill the company for the seats it has bought until it releases them.
• Display, on your supplier profile, the fields you have chosen to publish. Which fields are published is a supplier setting; nothing from screening is shown on a profile unless the supplier turns it on.
• Display a buyer’s company profile — company name, description, city and state, website, industries, and logo — to suppliers who can see one of that buyer’s RFQs. Screening information and individual users’ details are not part of it.
• Facilitate RFQs, quotes, messages, attachments, notifications, and buyer-supplier interactions.
• Process subscriptions, payments, renewals, cancellations, taxes, credits, and billing support.
• Verify businesses, prevent fraud and abuse, investigate incidents, monitor security, and preserve audit records.
• Analyze and improve reliability, usability, features, support, and business operations.
• Send service communications and, where permitted, product or marketing communications. Commercial email will include an appropriate opt-out mechanism.
• Comply with law, respond to lawful requests, enforce agreements, resolve disputes, and protect rights and safety.

4.How We Disclose Information

We may disclose personal information as follows:

• To buyers, suppliers, and authorized users as needed for profiles, RFQs, quotes, messages, attachments, and marketplace interactions.
• To companies that are not NEXTMRKT users, where a buyer has consented to it for a specific RFQ. A buyer may consent, per RFQ, to NEXTMRKT sharing a masked version of that RFQ with non-members by email, LinkedIn or other direct outreach, and publishing it at a link anyone holding the link can open. The masked version excludes the buyer’s company name, website, logo and city, every individual’s name, email address and telephone number, the buyer’s target price, attachments, and the quotes received. It includes the buyer’s own text exactly as written, so text in which a buyer identifies themselves is disclosed. The consent is off unless the buyer turns it on and can be withdrawn by unpublishing, which stops further disclosure but cannot recall what has already been sent or seen. Marketplace Terms Section 9 governs this.
• We keep a record of each outreach message sent under that consent — recipient address, channel, RFQ, date, and sender — and a list of addresses that have asked not to be contacted. The suppression list is retained precisely so that a request to stop is honoured permanently, and it is not erased on request.
• Within your organization, including to company administrators who manage users, access, billing, and activity.
• To providers that support authentication, payments, hosting, storage, communications, support, analytics, security, and professional services. Our current providers are Clerk (authentication), Stripe (payments), Neon (database), Render (hosting), Cloudflare (file storage, bot protection and website analytics), Resend (email delivery), Sentry (error monitoring), and Bunny Fonts (web fonts).
• To legal authorities or other parties when reasonably necessary to comply with law, legal process, enforce agreements, investigate fraud or security issues, or protect rights, property, and safety.
• In connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate protections.
• At your direction or with your consent.

5.Cookies and Similar Technologies

We and our providers use cookies, local storage, session technologies, pixels, and similar tools that are necessary to authenticate users, maintain sessions, remember preferences, secure the Services, diagnose errors, and understand use. See the Cookie Policy for details and available controls.

6.Retention

We retain information for as long as reasonably necessary to provide the Services; administer accounts and subscriptions; preserve marketplace, transaction, and audit integrity; comply with legal, tax, accounting, and contractual obligations; prevent fraud; maintain security; resolve disputes; and enforce agreements.

We do not delete user or company records. We deactivate, and then we redact. An RFQ or a quote is a record of a dealing between two businesses, and the other party to it has a legitimate interest in it that does not end when you leave. Deleting the person who created an RFQ would destroy the record of who a supplier was dealing with. So instead:

• Deactivation stops a person accessing the company account. Everything they created remains and remains attributed to them. It is reversible.
• Redaction overwrites the personal information on the record in place — the name is replaced with a placeholder, the email address is replaced with an address at a domain reserved by standard so that it can never resolve or receive mail, and the job title and profile image are cleared. The internal record identifier survives, so “who created this RFQ” still resolves to a real record rather than to nothing. Redaction is not reversible.

The window is 90 days. When a company account is closed, the account and its members are deactivated immediately and the records are retained. 90 days later, redaction runs. Within those 90 days a closure made in error, or a billing dispute raised weeks afterwards, can still be resolved against records that exist. After them, the personal information on the NEXTMRKT user profile is redacted. Some copies are held elsewhere and are not reached by redaction; Section 8 lists them.

Releasing your real email address at redaction is deliberate and to your benefit: it means that if you later join a different company on NEXTMRKT, your address is free to be used again.

Draft RFQs and draft quotes are private to the company that wrote them and are never published. Submitted quotes, closed RFQs, messages, billing records, audit logs, security records, backups, and dispute-related information are retained as described above and in the categories below. We do not offer a period within which all account data is deleted, because for the reasons above we do not delete it — we redact it.

7.Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, authentication, encryption in transit, controlled storage, logging, monitoring, and service-provider review where appropriate. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. Our Security page describes these practices in more detail.

8.Your Choices and Privacy Requests

You may update certain account information in the Services, manage communications preferences, or contact customercare@nextmrkt.com. Depending on applicable law, you may have rights to request access, correction, deletion, portability, or information about processing, and to appeal a denied request. We may verify identity and authority.

What we do when you ask us to erase your information. We redact it, as described in Section 6. Your name, email address, job title, and profile image are overwritten. The records you created — RFQs, quotes, messages — remain, because they are also the other party’s records, but they no longer carry your personal information.

The following are not reached by an erasure request. We list them rather than saying only that exceptions may apply:

• Form W-9 submissions, where we have requested one. Retained with our tax and business records.
• Payment records held by Stripe. Invoices and payment records are held by our payment processor under its own retention terms. Deleting our copy would not delete theirs, and would only remove our ability to answer a billing dispute in your favour.
• Billing consent records. The record of the automatic-renewal terms you were shown and accepted before you enrolled. It exists to prove you were told before you were charged; deleting it on request would defeat the reason it is kept.
• Audit logs. The record of what was done to an account, including the erasure itself. An erasure that erased its own record could not be shown to have happened.
• Access requests and outreach records. The access request you submitted and the screening decision on it, and any record of outreach sent to you under a buyer's consent. These are the record of who applied, what was decided, and who was contacted.
• Your sign-in account with our authentication provider. Your name, email address and profile image as held by Clerk. We can close it on request, but redaction on its own does not.
• Copies held for a limited time. Database backups and error logs, which expire on their own short schedules; email delivery logs held by our email provider; and uploaded profile image files.

Separately, if you have asked us not to send you outreach email, we keep your address on a suppression list. That record is what makes the request permanent, and we do not remove it.

Individual erasure requests are carried out by a NEXTMRKT administrator, deliberately, because they cannot be undone. Accounts of closed companies are redacted automatically 90 days after closure, as described in Section 6.

Company administrators may control business-account data and access. If your information was provided through your employer or another business, we may direct your request to that organization where it is the appropriate controller of the information.

9.U.S. Processing and Early Release

Early Release is intended for U.S.-based businesses and U.S. transactions. Information may be processed in the United States and other locations where our providers operate. If NEXTMRKT expands internationally, we will address applicable cross-border requirements before offering those services.

10.Children's Privacy

The Services are not directed to children or anyone under 18, and we do not knowingly collect personal information from children through the Services. Contact us if you believe a child has provided information.

11.Changes to This Policy

We may update this Policy as our Services and legal obligations evolve. We will post the updated version and revise the effective date. We will provide additional notice or obtain consent when required by law.

12.Contact

For privacy questions or requests, contact NEXTMRKT, Inc. at customercare@nextmrkt.com. You may also write to:

Please identify your company, account email, request, and state of residence. We may request information needed to verify your identity and authority.