Privacy Notice

1. Roles

For account, contact and billing data of our customers' users, Next Horizons decides how the data is used. For personal data contained in customers' accounting records and supplier documents, Next Horizons processes the data on behalf of, and on the instructions of, the customer under the Data Processing Terms.

[Confirm the applicable framework with counsel, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and any free-zone data protection rules that apply to the operating entity.]

2. What we collect

We collect only what the service needs:

• Account data: name, business email, phone (optional), role, login and security events.
• Company data: legal name, trade licence, TRN, address.
• Records you upload or synchronise: supplier master data, purchase invoices, payments and supporting documents.
• Supplier contact data needed to request documents, and documents suppliers upload through a secure invitation.
• Billing data: invoices and payment status. Card details are entered on the payment provider's page and never stored by us.
• Usage analytics (only with your consent for non-essential analytics and advertising measurement).

3. How we use it

To provide the verification service, communicate about your projects, invoice and collect payment, secure the platform, meet legal obligations, and — with consent — measure and improve our marketing. We never include invoice contents, supplier identities or other confidential records in advertising or analytics events.

4. Service providers

We use carefully selected providers for hosting and storage, transactional email, payments (Stripe) and malware scanning. AI-assisted features that would send document content to an external AI provider are switched off unless the data-processing arrangement, security requirements and processing locations have been agreed. [List sub-processors and hosting locations before go-live.]

Automatic document reading (only once enabled; we will update this notice and inform customers before it is switched on): invoices, bank statements and trade licences that have passed our malware scan may be sent to Mistral AI (France) to read the text and extract values such as the supplier name, TRN, invoice number, dates and amounts. Documents are sent one by one through Mistral's European Union endpoint, are processed in data centres in the EU/EFTA and, under the zero-data-retention arrangement we require, are not stored by Mistral after processing. This is a transfer of data from the United Arab Emirates to the European Union. Extracted values are suggestions that our staff check; they are never treated as a verification. [Confirm the transfer basis under Federal Decree-Law No. 45 of 2021 with counsel before enabling.]

5. Retention

Verification records are retained for the period agreed in the Service Agreement (by default five years, reflecting general UAE tax record-keeping periods) and then deleted or returned, unless a longer period is legally required.

6. Your rights and contact

You may request access, correction or deletion of your personal data, subject to legal retention duties. Company administrators can request deletion of the company's data from Settings. Contact: [privacy contact email].

7. Cookies

Essential cookies keep you signed in and protect forms. Analytics and advertising cookies are used only after you accept them in the consent banner, and you can change your choice at any time.