Privacy Policy
This policy explains what information NextStepAI collects through this website and its optional AI assistant, the legal basis on which it is processed, how it is secured, how long it is retained, and the rights available to you under applicable law.
Effective date: April 22, 2026
Last reviewed: September 22, 2026
1. Data Controller
The data controller responsible for personal information processed through this website is NextStepAI, operating under the Steraton brand group. For any privacy-related inquiry, request, or concern, use the contact page and mark the subject clearly as a privacy request so it can be routed to the appropriate person without delay.
Where NextStepAI acts as a data processor on behalf of a client under an active engagement, the governing data-processing terms will be set out in the relevant statement of work, data processing agreement, or master services agreement — not this policy. This policy applies exclusively to website-level interactions.
2. Scope
This policy applies to all personal information collected or processed through:
- —The NextStepAI website at nextstepai.steraton.com and any associated subdomains.
- —The contact and inquiry forms hosted on the website.
- —The optional on-site AI assistant, when accessed through this website.
- —Business outreach and collaboration communications initiated by NextStepAI, including individually selected professional communications sent by email or other business communication channels, where such processing is lawful under the applicable privacy and electronic-communications rules.
- —Technical logs generated by your interaction with the website infrastructure.
It does not apply to information exchanged during active client engagements, which is governed by separate contractual instruments, or to third-party websites linked from this site, which maintain their own privacy policies.
3. Information We Collect
NextStepAI applies a principle of data minimization: we collect only information that is reasonably necessary for the stated purpose. The categories below describe what may be collected and why.
3.1 Contact Form Submissions
When you submit an inquiry through the contact form, we collect the information you voluntarily provide. This typically includes your name, company or organization name, preferred contact method, contact detail (email address, phone number, or messaging handle), and a description of the operational challenge or project you want to discuss. Submitting this form does not create a client relationship or any contractual obligation on either side.
3.2 AI Assistant Interactions
If you choose to use the optional on-site AI assistant, the prompts you submit and the responses generated may be temporarily processed by the underlying infrastructure to deliver the feature. This includes the text of your messages, session identifiers, timestamps, and technical metadata required for the feature to function. Conversation data may be reviewed internally for quality assurance, security monitoring, abuse detection, and feature improvement. Do not submit credentials, passwords, regulated financial or health information, or personally sensitive data through the AI assistant.
3.3 Technical and Server Logs
Website infrastructure automatically records standard operational data when you access any page. This may include your IP address (in full or truncated form), browser type and version, operating system, referring URL, pages accessed, timestamps, HTTP status codes, and error logs. This data is collected for security monitoring, abuse detection, infrastructure performance, and service reliability — not for behavioral advertising or third-party profiling.
3.4 Device and Browser Information
When you access the site, your browser may transmit technical characteristics including screen resolution, language preferences, and device type. This information is used to ensure proper rendering and service availability, not for cross-site tracking or identity resolution.
3.5 Cookies and Local Storage
This website is designed to operate without marketing cookies or behavioral tracking. Essential technical storage — such as session identifiers needed to maintain basic functionality, security tokens used to validate form submissions, or preference indicators — may be set by the browser or hosting infrastructure. No third-party advertising networks, retargeting platforms, or behavioral analytics services are intentionally loaded on this website. If you block all cookies in your browser, core site functionality may still be available, though some interactive features may be limited.
3.6 Analytics
Where analytics tools are used to understand general site traffic patterns — such as which pages are visited most frequently, how visitors navigate between sections, or what geographic regions the audience comes from — this is done in aggregate form and in a manner that does not create individual behavioral profiles. Where such tools require data processing, they are selected and configured to minimize data exposure consistent with applicable privacy law. We do not use session recording or heatmapping tools that capture individual mouse movements or keystrokes.
3.7 Business Outreach and Collaboration Communications
Where NextStepAI initiates a business-to-business communication regarding a potential professional collaboration, we may process limited professional contact information such as your name, professional email address, company or organization, job title or role, business website, and other publicly available or lawfully obtained business contact details relevant to the communication.
NextStepAI selects recipients individually based on a reasonable business relevance to the services or capabilities described on this website. These communications are selected and sent by NextStepAI personnel and are not generated or sent by the optional on-site AI assistant. The purpose is to introduce NextStepAI and explore whether there may be a relevant professional collaboration or operational need. Such communications are non-binding and do not require the recipient to enter into an engagement or accept any proposal.
The source of professional contact information may include information provided directly by the individual, the individual's organization, publicly available professional or corporate sources, business directories, event or conference materials, professional networking contexts, or other lawful sources. Where required by applicable law, the relevant source and the other information required by law will be provided at or before the first communication or within the applicable transparency period.
We do not use these communications to make automated decisions that produce legal or similarly significant effects on individuals. We do not sell, rent, or license contact details to third parties for their own marketing purposes.
Where applicable law gives you the right to object to processing for direct marketing purposes, NextStepAI will provide a simple and free way to exercise that right. If you object to further direct marketing from NextStepAI, we will suppress your contact details from future marketing communications, except where retention of a minimal suppression record is necessary to respect and document your objection.
4. Legal Bases for Processing
Where the General Data Protection Regulation (GDPR) or equivalent applicable law applies, NextStepAI processes personal data only where a valid legal basis exists. The bases we rely on include:
Processing server logs, detecting abuse, securing the website, and operating the AI assistant safely and reliably. Our legitimate interest is balanced against your rights and interests. You may object to processing on this basis; see Section 11 for how to exercise that right.
Reviewing and responding to contact form submissions where you have requested information or initiated a potential engagement.
Retaining records where required by applicable tax, accounting, or regulatory obligations, and cooperating with lawful requests from competent authorities.
Where you explicitly opt in to receive operational updates or community communications through the contact form checkbox. Consent is optional, not required to submit a request, and may be withdrawn at any time by contacting us through the contact page.
For outbound business communications, the applicable legal basis depends on the communication channel, the source of the contact information, the recipient, the nature of the communication, and the law applicable to the specific communication. Depending on those circumstances, processing may rely on consent, legitimate interests where permitted, an existing customer relationship exception where legally applicable, or another lawful basis recognized by applicable law. NextStepAI does not treat the label or description of a communication as determining its legal classification.
5. Purposes of Processing
Information collected through this website is used exclusively for the following purposes:
- —To review inbound inquiries, evaluate whether a potential engagement is a genuine fit, and respond with a practical next step.
- —To initiate and manage lawful business-to-business communications where NextStepAI identifies a reasonable and relevant basis to explore a potential professional collaboration, including introducing NextStepAI capabilities and inviting a non-binding conversation.
- —To record and respect communication preferences, objections, opt-outs, and suppression requests so that individuals who no longer wish to receive further business outreach are not contacted for that purpose, except where limited retention is necessary to enforce the requested suppression.
- —To operate and maintain the website and AI assistant safely, including detecting and responding to abuse, unauthorized access attempts, and security incidents.
- —To monitor, troubleshoot, and improve the performance and reliability of website infrastructure.
- —To send occasional operational updates or relevant content to individuals who have opted in through the contact form.
- —To comply with applicable legal obligations, including tax, regulatory, and law enforcement requirements where lawfully imposed.
- —To exercise or defend legal rights in the event of a dispute.
We do not use personal information collected through this website for automated decision-making that produces legal effects or similarly significant impacts on individuals, for third-party commercial advertising, or for the training of external AI models without explicit consent.
6. AI Assistant Data Handling
The optional on-site AI assistant is powered by underlying AI infrastructure. When you interact with the assistant, the following data handling practices apply:
Prompt processing: The text of each message you submit is processed by the AI model to generate a response. This processing occurs in real time and may involve transmission to infrastructure operated by a third-party AI provider acting under NextStepAI instruction and bound by appropriate data-processing and confidentiality terms.
Session data: Session identifiers and timestamps are generated to maintain conversation continuity within a single browsing session. These are not linked to persistent user profiles.
Abuse detection: Conversation content may be reviewed by automated systems — and in limited cases by authorized personnel — to detect misuse, including attempts to extract confidential system configuration, bypass security controls, or submit harmful content.
Quality and safety review: A limited sample of conversations may be reviewed internally for quality assurance and to improve the safety and accuracy of the assistant. Any such review is conducted under strict access controls.
What you should not share: The AI assistant is an informational channel, not a secure document transmission system. Do not submit passwords, authentication credentials, regulated personal data (health records, financial data, national identification numbers), trade secrets, or any information you would not be comfortable sharing in a general business context.
7. Data Retention
NextStepAI retains personal data only for as long as is necessary for the purpose for which it was collected, subject to any legal obligation requiring longer retention.
Retained for as long as necessary to process the inquiry, evaluate fit, and follow up. If no engagement results, records are archived and purged on a rolling basis consistent with our internal data management schedule, typically within 24 months of the last interaction.
Session data is not retained indefinitely. Conversation logs used for security and quality purposes are stored for a limited period and then deleted or anonymized. Specific retention periods depend on the infrastructure configuration in use at the time.
Technical logs are retained for security and operational purposes for a rolling period, typically 30 to 90 days, unless a specific security or legal event requires extended retention.
Individuals who opt in to receive operational updates are retained on that list until they withdraw consent or request removal.
Professional contact information used for business outreach is retained only for as long as reasonably necessary for the relevant business communication and relationship-management purpose, subject to applicable legal obligations.
Where an individual objects to further direct marketing or requests that NextStepAI stop contacting them for outreach purposes, NextStepAI may retain a minimal suppression record (for example, the email address or another identifier necessary to prevent future contact) for as long as reasonably necessary to enforce that request and demonstrate compliance. Suppression records are not used for promotional purposes beyond enforcing the suppression request.
8. Security Measures
NextStepAI applies layered technical and organizational measures to protect personal data against unauthorized access, disclosure, loss, or destruction. These include:
Security Limitation Notice: No internet-connected system can guarantee absolute security. While NextStepAI applies industry-appropriate controls, we cannot warrant that unauthorized access, interception, or data loss will never occur. We strongly advise against submitting highly sensitive, regulated, or classified information through this website's general forms or the AI assistant channel.
9. Third-Party Service Providers
NextStepAI may engage carefully selected third-party service providers who process limited personal data on our behalf as data processors. These providers supply infrastructure, hosting, security, email delivery, or AI functionality. They are bound by data-processing agreements requiring them to handle personal data only on documented instructions from NextStepAI, to maintain appropriate security measures, and to delete or return data upon termination of the service relationship.
We do not sell, license, or share personal information with third parties for their own marketing, advertising, or commercial purposes. We do not disclose personal data to law enforcement or regulatory authorities except where legally required to do so, and we will notify affected individuals where permitted by law.
Specific providers in use at any given time are not listed publicly, as the technical infrastructure may change without necessitating an update to this policy. The categories of providers currently engaged may include: web hosting and content delivery infrastructure, transactional email delivery services, AI inference infrastructure for the assistant feature, and security and abuse monitoring tools. Any provider handling personal data is selected with data-minimization and security as criteria.
10. International Data Transfers
Some of the third-party providers used to deliver website functionality may be located outside the European Economic Area (EEA) or your jurisdiction of residence. Where personal data is transferred outside the EEA, NextStepAI ensures that appropriate safeguards are in place, which may include:
- —Transfers to countries that have received an adequacy decision from the European Commission.
- —Use of Standard Contractual Clauses (SCCs) approved by the European Commission.
- —Binding Corporate Rules or other recognized transfer mechanisms where applicable.
You may request further information about the specific safeguards applied to any given transfer by submitting a privacy request through the contact page.
11. Your Rights
Depending on your location and the legal framework that applies to your situation, you may hold one or more of the following rights with respect to your personal data:
Request a copy of the personal data we hold about you and information about how it is being processed.
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data where it is no longer necessary for the purpose collected, where consent has been withdrawn, or where processing is unlawful. This right may be subject to overriding legal obligations to retain records.
Request that processing be restricted while a complaint is being investigated or in certain other circumstances defined by law.
Request a machine-readable copy of personal data you have provided to us where processing is based on consent or contract performance.
You may object to processing based on legitimate interests where the applicable legal conditions are met. You may also object at any time to the processing of your personal data for direct marketing purposes. Where you object to direct marketing, NextStepAI will stop processing your personal data for that purpose, subject only to any limited retention necessary to record and enforce your objection. You may exercise this right through the unsubscribe mechanism included in a communication, by contacting through the contact page.
Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
You may lodge a complaint with the data protection or privacy supervisory authority competent for your jurisdiction. Where applicable, you may contact the supervisory authority in the country where you reside, work, or where you believe your data protection rights have been affected.
To exercise any of the above rights, submit a request through the contact page and clearly indicate in your message that it is a privacy rights request. We will acknowledge receipt within a reasonable time and respond substantively within the period required by applicable law, typically 30 days, with the possibility of a single extension of a further 60 days for complex requests.
To protect your data and ensure requests are legitimate, we may ask you to verify your identity before acting on your request. We will not charge a fee for reasonable requests but reserve the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive.
12. Your Responsibilities When Using This Website
By submitting information through this website, you confirm that:
- —The information you provide is accurate to the best of your knowledge at the time of submission.
- —You are not submitting information on behalf of another individual without their knowledge and, where required by law, their explicit consent.
- —You will not submit regulated health data, payment card numbers, national identification numbers, or other categories of sensitive personal data through the contact form or AI assistant.
- —You will not attempt to use the website or AI assistant to extract confidential information about NextStepAI systems, infrastructure, or internal processes.
13. Data Breach Notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, NextStepAI will notify affected individuals without undue delay, as required under applicable law, including Article 34 of the GDPR where relevant. Where a breach must be reported to a supervisory authority, we will do so within 72 hours of becoming aware of it, to the extent practicable.
Notification will be provided through the most appropriate channel available, which may include direct email to the address you submitted through the contact form.
14. Children's Privacy
This website is directed exclusively at business professionals and is not intended for, and does not knowingly collect information from, individuals under the age of 16 (or the applicable age of digital consent in the relevant jurisdiction). If we become aware that personal data has been collected from a minor without appropriate parental consent, we will delete that data promptly. If you believe this has occurred, please contact us immediately through the contact page.
15. Changes to This Policy
NextStepAI may update this Privacy Policy from time to time to reflect changes in applicable law, operational practices, or the services offered. When changes are made, the effective date at the top of this page will be updated. For material changes that significantly affect how personal data is processed, we will take reasonable steps to draw attention to the update — which may include a notice on the website or direct communication where we hold your contact details and the change is relevant to you.
Continued use of the website after a revised policy is published constitutes acknowledgment of the revised terms. We recommend reviewing this page periodically.
16. Contact for Privacy Matters
For any question, concern, or request related to this Privacy Policy or the processing of your personal data, please use the contact page and include the following in your message:
- —Subject line clearly indicating: "Privacy Request"
- —A description of your request or concern
- —The email address or contact method you used when interacting with the website
This allows us to route the request correctly and respond within the applicable legal deadline.