1. Overview

At Next-Net-Lite, we prioritize the privacy and security of your personal data. This Privacy Policy details how we collect, protect, and handle authentication data and user session cookies.

2. Information We Collect & Sub-Processors

We operate under a data-minimization philosophy. The only information we collect and store includes:

Email Address: Used solely to send passwordless verification OTP codes. This is shared with our email delivery sub-processor (ZeptoMail by Zoho) strictly for dispatching the codes. Zoho is fully GDPR compliant and does not use your email address for any other purposes.
Authentication Logs: Timestamps of verification events and session activity to prevent abuse.
Cookies: An `auth_session` cookie is issued to store encrypted session states, protecting your login state.

3. How We Use Information

Your information is used strictly to provide services, including:

Verifying your identity via one-time passwords (OTP).
Maintaining your logged-in session securely using `HttpOnly`, `Secure`, and `SameSite` cookie flags.
Monitoring system security and detecting authentication abuse.

We do not sell, rent, or trade your data to third parties for marketing or tracking purposes.

4. Cookie Policy

We use essential session cookies for authentication. These cookies are stored on your device:

auth_session: An encrypted cookie containing session tokens. It is protected against cross-site scripting (XSS) via `HttpOnly` flags.

5. Data Hosting & Location

All user data, authentication logs, and backup files are hosted securely on Hetzner Online GmbH in EU-based data centers (Germany/Finland). This guarantees that your personal data is protected under the General Data Protection Regulation (GDPR) and German data protection laws, and never leaves the European Union.

6. Data Retention & Automatic Log Clearing

We do not hold onto logs or system traces indefinitely. To prioritize user privacy, we enforce automated log clearing and retention policies directly at the server level:

Access Logs: Web server access logs are rotated daily and permanently deleted after 14 days.
System Logs: System level logs are strictly capped to a maximum retention window of 1 month.
Docker Logs: Application container logs are size-capped and trimmed automatically to prevent disk accumulation.
Backups: Secure encrypted database snapshots are kept using a thinned rotation policy (retaining only the last 7 daily, 4 weekly, and 6 monthly snapshots).

7. Infrastructure Security

We take active, multi-layered steps to ensure the application server is hardened and secure:

Intrusion Detection: Automated monitoring (Fail2Ban) immediately blocks and bans IP addresses attempting exploit scans or authentication abuse.
Firewall Protection: A strict host firewall (UFW) blocks all unrecognized incoming network traffic.
Encrypted Transport: All data, sessions, and verification emails are fully encrypted in transit using industry-standard TLS.

8. GDPR & Your Data Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of Access: You can request a summary and copy of the personal data we hold about you.
Right to Erasure (Right to be Forgotten): You can request the permanent deletion of your email records and session history.
Right to Rectification: You can correct any inaccurate information.
Right to Portability: You can request an export of your data in a structured, machine-readable format.

To exercise any of these rights, please contact our Data Controller at our support email address. Requests will be fulfilled free of charge within 30 days.

9. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at [email protected].