1. Introduction and identification

NexTool Soluções, registered under CNPJ no. 38.239.534/0001-48 ("NexTool", "NexTool Solutions", "we" or "our"), responsible for the domain nextoolsolutions.com and the services associated with it, respects the privacy of data subjects and is committed to protecting the personal data it processes, in accordance with Law no. 13.709/2018 (Brazilian General Data Protection Law - LGPD).

This Privacy Policy describes how we process personal data across the five fronts of our ecosystem:

• Institutional website (nextoolsolutions.com): informational pages, blog and contact forms;
• Customer Portal (app.nextoolsolutions.com): registration, authentication, account management, contracting, payment and licensing of modules;
• NexTool plugin for GLPI and its modules: software installed on the customer's infrastructure, including artificial intelligence, messaging and integrations with external services.
• NexTool cloud services linked to the customer's GLPI: services contracted by the customer and processed on NexTool's infrastructure rather than inside the customer's GLPI, such as using GLPI through Telegram and the artificial intelligence features of the AI Assist module processed in the cloud.
• NexTool MCP for GLPI (mcp.nextoolsolutions.com): hosted connector that links the artificial intelligence assistant chosen by the user to a GLPI the user is authorized to access (section 15).

By using any of these fronts, you declare that you are aware of this Policy. We recommend reading it in full. If you have any questions, use the Data Protection Officer's channel indicated in section 14.

2. Roles in processing: Controller and Processor

The LGPD distinguishes the Controller (who is responsible for decisions regarding processing - Art. 5, VI) from the Processor (who processes data on behalf of the Controller - Art. 5, VII). In our ecosystem, NexTool acts in both roles, depending on the front:

Front	NexTool's role	Data Controller
Institutional website	Controller	NexTool
Customer Portal (account, payment, licensing)	Controller	NexTool
Plugin and modules running inside the customer's GLPI	Processor	The customer (organization that operates the GLPI instance)
NexTool cloud services linked to the customer's GLPI (for example, using GLPI through Telegram and WhatsApp, the NexBot chat assistant and the artificial intelligence features of the AI Assist module processed in the cloud)	Processor	The customer (organization that contracts the service and operates the GLPI instance)
NexTool MCP: account, access keys, authorizations and technical usage records	Controller	NexTool
NexTool MCP: GLPI data passing through the connector during each call	Processor	The organization that owns the connected GLPI

What this means in practice: when you browse our website or create an account on the Portal, NexTool decides the purposes and means of processing and is your direct point of contact. The data that lives inside the customer's GLPI instance (users, tickets, attachments), however, belongs to the customer, who is the Controller; in these cases NexTool acts as a Processor, processing the data on behalf and by order of the customer, in accordance with the contract and instructions. If you are an employee of a customer organization and wish to exercise rights over data processed within its GLPI, your request must first be directed to your organization (the Controller); NexTool will provide support in its capacity as Processor. Some services contracted by the customer are processed on NexTool's own infrastructure, not inside the customer's GLPI. This is the case when GLPI is used through Telegram: the messages pass through NexTool's server, which queries the customer's GLPI and returns the reply. In these cases too, the customer is the Controller and NexTool acts as a Processor, on behalf and by order of the customer. NexTool does not keep the content of the messages after processing them. The same applies to the artificial intelligence features of the AI Assist module when the customer chooses to process them in NexTool's cloud: the customer's GLPI sends NexTool the data needed for each feature, NexTool builds the request to the artificial intelligence model, receives the reply and returns it to GLPI. The customer is the Controller and NexTool acts as a Processor. NexTool does not keep the content sent and does not use that content for its own purposes or to train artificial intelligence models.

3. Data we process, by front

3.1 Institutional website (NexTool as Controller)

• Contact form and NexTool MCP data: name, e-mail, phone, subject and message content (free text, which may contain other data you choose to provide), and the page language. This data is recorded as a sales contact in our Customer Portal and, if the e-mail already has an account, is linked to it.
• Technical browsing data: IP address, User-Agent (browser and operating system), pages accessed, date and time, status and response time.
• Blog audience metrics: to count views per publication, the IP address is turned into an irreversible code, different for each publication, and is not stored. The daily view history is kept for 30 days.
• Blog comments: when you comment via the integrated comment system (GitHub Discussions/giscus), your login, avatar and the comment content are processed directly by the GitHub platform.
• Measurement and advertising data: measurement identifiers and cookies (Google Analytics, Microsoft Clarity), which are active by default based on legitimate interest (Art. 7, IX) and stop being loaded as soon as the category is declined in the banner; and advertising ones (Meta Pixel), loaded only after your consent (see section 6).

3.2 Customer Portal (NexTool as Controller)

• Account and contact data: name, e-mail, phone (and whether it is WhatsApp), company, job title, company website and LinkedIn profile (the last two optional), profile photo (when uploaded) and account country, filled in automatically from the phone's country code (or, failing that, from the time zone), which you can correct in "My Profile".
• Billing data (optional, Brazilian accounts only): under "Billing data" you can register who receives the invoice (nota fiscal) for your purchases: corporate or personal name, CNPJ or CPF, state registration (or exemption) and municipal registration, billing e-mail and phone, and address. This data is kept separate from your personal profile, and no purchase depends on it.
• Billing copy for each order: if your billing profile is complete at the time of purchase, we keep a copy of that data linked to the order. That copy is what we use to issue the invoice, and it does not change if you later edit or delete the profile. At the same time, the corporate or personal name, CNPJ or CPF, address and billing e-mail are sent to your customer record at Stripe.
• Authentication credentials and secrets: password (stored in encrypted form), "remember me" tokens and two-factor authentication secrets (2FA/MFA). This data is kept encrypted and is not accessible in plain text by our team.
• Social login identity (when you use SSO): when you sign in with Google, GitHub, Microsoft or LinkedIn, we receive from the provider your name, e-mail and an account identifier.
• Payment data: card processing is performed by Stripe. We do not store the full card number; we keep only a minimal mirror (the customer identifier on Stripe, card brand and the last four digits) and the subscription data.
• Licensing data: license key and status, plan, enabled modules, the link between your account and the GLPI environment to which the license applies, and transaction records.
• Session, device and audit data: IP address, User-Agent, access records and an audit trail of relevant actions (e.g., login, environment linking, license change).
• Sales funnel: when you contact us through the website or show interest, we record the contact (name, e-mail, phone and the team's notes on the conversation) and may remind you of agreed follow-ups by e-mail or WhatsApp.
• Service schedules: for services with a schedule, we keep the name and e-mail of the participants designated by the customer, the schedule notes and the meeting invitations sent from NexTool's calendar (Microsoft 365).
• Preferences and communication: display preferences and the setting for receiving announcements and news by email, which is active when the account is created and can be turned off at any time in "My Profile" or through the unsubscribe link in each message. To choose the content relevant to each customer, the sending also uses account usage data (GLPI version, modules used and licensed, plan, whether the account is a paying one, environments and last access).
• Testimonials about modules and services: when you rate a module you use or a service the NexTool team invited you to review, we keep the rating and the text. Ratings from 1 to 3 become a support request and are not published, nor is anything sent "to the team only". If you click "Publish my testimonial", we record your authorization (version of the publication terms, date and IP address), and the testimonial is reviewed by the team, which does not change the text. Once approved, it is published on the NexTool website with your name, job title, company and the links to your company website and LinkedIn, as they appear in your profile: if you change your profile, the published testimonial follows. You can withdraw the authorization at any time in the Portal, and the testimonial is removed from the website.
• Credits for managed artificial intelligence: the managed mode of the artificial intelligence features of the AI Assist module (section 3.4) is paid for with prepaid credits, purchased on the Portal and paid through Stripe, like all other Portal purchases. The credit balance is kept per customer GLPI environment, identified by the link key, and records purchases, consumption, refunds and adjustments. This record does not contain personal data of the people in the tickets; consumption is measured in tokens and cost per request, without the content. The balance and the entries are kept for as long as the environment exists. Credits expire: 12 months from each purchase and 30 days for the free quota; usage always draws from the credit that expires first, and whatever is unused by then leaves the balance, with the matching entry in the statement. The customer is notified by e-mail 30 days before expiry.

3.3 NexTool plugin and modules (NexTool as Processor)

The NexTool plugin and its modules are run inside the customer's GLPI instance, over data that belongs to the customer (users, tickets, attachments). In these processing activities NexTool acts as a Processor. The categories of data involved depend on the modules activated by the customer and include:

• Identification of GLPI users (name, e-mail, login) of technicians, agents and requesters;
• ITIL ticket content (descriptions, follow-ups, tasks, solutions and attachments), which may contain personal data of third parties provided by the requester;
• Corporate identity via Microsoft Teams/Azure AD (name, corporate e-mail, account and tenant identifier) and message content, when the customer activates the Teams support assistant;
• Phone/WhatsApp, Telegram identifier and message content, when the messaging modules are activated;
• Geolocation (coordinates), captured only upon the user's explicit authorization in the browser, when the geolocation module is activated;
• Signatory data (name, e-mail, CPF, document and phone for validation) when the digital signature module is activated;
• Requester/approver data in B2B purchasing integrations;
• Data of tickets synchronized between GLPI instances, when synchronization is activated.

Licensing and distribution. To validate the license and deliver modules and updates, the plugin communicates with our licensing infrastructure (ContainerAPI). In this relationship NexTool is the Controller. The plugin sends only technical data about the installation:

• the domain of the GLPI instance and an environment identifier generated by the plugin;
• the license key, only while the environment does not yet have that identifier;
• the plugin, GLPI and PHP versions, and the default language and time zone configured on the instance (never each user's preference);
• the list of NexTool modules on the instance, with version and status, and the origin of each check (automatic task, manual synchronization, module download);
• when the customer uses the cloud services (section 3.4), a technical summary of the connection: date of the last accepted call, number of rejected calls by reason, key identifier and clock difference.

Our server records the source IP address of each call. No data about GLPI users or tickets travels in this flow; when the environment is linked to a Portal account, the server returns that account's e-mail address to the plugin, to be shown to the administrator. This data is used for license control, distribution of modules and updates, support, fraud prevention and usage statistics by version and language. Some plugin buttons (open a support ticket, license a module, express interest) open the Portal in the administrator's browser and carry in the address the module name and, for the support ticket, a technical diagnosis of the module.

Support opened from the plugin. The plugin's Support button opens a request on the Portal, on behalf of the account linked to the environment. In this relationship NexTool is the Controller. The request carries the subject, description, type and item chosen, the name and e-mail address of the GLPI user who opened it and the environment identifier. If the administrator ticks the corresponding option (unticked by default, with a preview of the content), the request also carries a technical report of the environment: GLPI, PHP and database versions, installed modules and plugins, automatic tasks and the NexTool-related error messages from the last 7 days, with e-mail addresses, IP addresses, passwords, tokens and GLPI user names and logins masked before sending. The report is used only to diagnose the request and is seen only by NexTool's support team. If, despite the masking, an error message contains personal data of third parties, NexTool processes it as a Processor, on behalf of the customer and only to handle the request.

3.4 NexTool cloud services (NexTool as Processor)

Some services contracted by the customer are processed on NexTool's infrastructure, not inside the customer's GLPI. In these processing activities too, NexTool acts as a Processor, on behalf and by order of the customer Controller.

Using GLPI through Telegram. When the customer contracts the use of GLPI through Telegram, we process on our server, only for as long as necessary, the identifier, first name and language of the Telegram account, the content of the messages and the GLPI data needed for the reply. The account identifier is kept for up to 24 hours for usage control. Files sent go directly to the customer's GLPI, without passing through our server.

Using GLPI through WhatsApp. When the customer contracts WhatsApp managed by NexTool, the customer's number is connected to our servers, directly or through the connection provider UZAPI. We process the phone number, the profile name, the message content (text, images, documents and audio) and the GLPI data needed to notify and serve each user. The user is identified by the phone number registered in GLPI, and each action respects that user's permissions. We do not use artificial intelligence in this service. Service messages are removed from our servers 7 days after the last message in the conversation, and the link between the phone number and the user, after 90 days without use. The WhatsApp gateway keeps the number's message history while the service is active.

NexBot chat assistant. NexBot is a chat assistant inside the customer's GLPI, processed on NexTool's server in Brazil (São Paulo). To reply, we process the GLPI user's name, e-mail, entity and profile, the conversation messages and the GLPI data the assistant looks up for the user (tickets, articles, users and reports), always with the user's own permissions. In the features with artificial intelligence (questions, reports and expert mode), the question, the history and that data are sent to Anthropic and, for article search, the question is sent to Voyage AI, both in the United States, as NexTool's sub-processors. Conversations are kept for as long as the customer's license exists. The assistant also keeps a summary of each user's previous conversations, deleted after 90 days without use, and the satisfaction survey rating and comment. Users may request the deletion of their conversations and summary through their organization, which is the Controller.

Artificial intelligence features of the AI Assist module through the cloud. The AI Assist module has three ways of operating, chosen by the administrator of the customer's GLPI:

• Local mode: the customer's GLPI calls the artificial intelligence provider contracted by the customer directly. Nothing passes through NexTool; what this Policy already says about the software inside the customer's GLPI applies (section 3.3).
• Your key through the cloud: the customer's GLPI sends the request to NexTool's cloud, which forwards it to the artificial intelligence provider contracted by the customer (OpenAI, Google or Anthropic), using the customer's own key. That key travels sealed, is opened only in memory, for each request, and is never stored by NexTool. The provider is chosen and contracted by the customer and processes the data in accordance with its contract with the customer. This mode exists up to version 2 of the module; from version 3.0 onwards, with the customer's own key, GLPI calls the provider directly (local mode).
• Managed: NexTool supplies the key, chooses the model and charges for usage with prepaid credits (section 3.2). The request is sent to the model router OpenRouter, Inc. and, through it, to the model provider (Google, OpenAI, Anthropic or TypeSafe), in the United States, only on routes where the provider declares that it does not retain or train on the content.

What the customer's GLPI sends. For each feature (ticket summary, response suggestion, sentiment analysis, knowledge base answer, article authoring, initial triage and, in managed mode, ticket classification on opening and category profile), the module sends only the structured data of that feature: the ticket text (title, description, public follow-ups, tasks and solution), excerpts of knowledge base articles used as a source, the question asked in self-service, or the ticket category data. By default, before leaving GLPI, the module replaces the names of the people in the ticket with their role (requester, technician) and masks e-mails, CPF/CNPJ numbers and phone numbers. The customer's administrator can turn this redaction off; in that case, the content is sent unredacted and the decision belongs to the customer, as Controller.

What NexTool keeps. The request and the reply are not stored by NexTool's cloud. Only the following remain: the metadata of each request (environment identifier, cryptographic digest of the content, feature, model, consumption and response time), for 90 days; the generated result, encrypted, for 24 hours, so that the same repeated request is neither processed nor charged again; error records, with metadata only, for 30 days. No content, request, reply or key goes into the logs.

Automatic ticket classification. In managed mode, the customer may let the artificial intelligence set the type and category of the ticket when it is opened, so that the rules of the customer's GLPI apply urgency, group and deadline. This decision organizes internal support and has no legal effect on the person; the customer can run it in simulation (the AI suggests, the ticket does not change), each decision is recorded in the customer's GLPI and the category can be corrected by a person at any time. Review requests are handled by the customer, as Controller.

4. Purposes of processing

We process personal data for the following purposes, according to the front:

• Website: respond to contact requests (by opening a ticket in our GLPI), conduct pre-contractual and commercial procedures, ensure security and prevent fraud/abuse, measure audience (with the option to decline) and enable blog comments.
• Portal: create and maintain the account, authenticate access (including 2FA and social login), process contracting and payment, issue the invoice with the billing data you provide, issue and manage licenses, link the account to the GLPI environment, provide support, send announcements and news through the channels that are active, publish on the website the testimonials you authorize, comply with tax and legal obligations, prevent fraud and maintain an audit trail.
• Plugin/modules: run the features contracted by the customer (AI assistance, messaging, digital signature, synchronization, geolocation, etc.) on behalf and by order of the customer Controller, and operate license control.

5. Legal bases

Processing is based on the LGPD legal bases applicable to each purpose:

• Performance of a contract and pre-contractual procedures (Art. 7, V): account, authentication, contracting, payment, licensing and environment linking; billing profile data, used in the order and on the invoice; handling of commercial contacts; running of the modules on behalf of the customer.
• Compliance with a legal or regulatory obligation (Art. 7, II): tax data (the billing copy of each order and the transaction records), kept for 5 (five) years as required by tax legislation, and retention of application access records, pursuant to the Brazilian Internet Civil Framework (Law no. 12.965/2014).
• Legitimate interest (Art. 7, IX): information security, fraud prevention, auditing, usage telemetry and metrics, including website audience measurement, always subject to a proportionality assessment and respect for your expectations and rights. You may object to measurement at any time through the cookie banner. On the same basis we send announcements and news about our products and services to Portal account holders, by email: the channel is active when the account is created and can be turned off at any time, free of charge, in "My Profile" or through the unsubscribe link in each message; and we follow up commercially with those who have contacted us.
• Consent (Art. 7, I, and Art. 8): publication of testimonials on the website, advertising cookies, geolocation capture and specific processing activities that require it. Consent may be revoked at any time.

When NexTool acts as a Processor (plugin/modules), the legal basis is defined by the customer Controller; NexTool processes the data in accordance with the instructions and the contract.

6. Cookies and tracking technologies

We use cookies and similar technologies classified by category. Advertising cookies are loaded only after you explicitly accept the corresponding category in the consent banner. Measurement cookies are active by default, based on legitimate interest (Art. 7, IX), and stop being loaded as soon as the category is declined in the banner, which allows you to accept or decline by category and change your choice at any time.

Institutional website:

Cookie/technology	Category	Purpose
Theme preference (localStorage)	Necessary	Remember light/dark mode; does not leave the browser
cookie_consent	Necessary	Record your consent preferences
Cloudflare Turnstile	Functional	CAPTCHA for the contact form
Cloudflare (CDN/security)	Necessary	Distribution and protection of the website
giscus (GitHub)	Functional	Blog comments (login managed by GitHub)
Google Analytics (_ga, _ga_*)	Measurement	Audience measurement - active by default; disabled when the Measurement category is declined
Microsoft Clarity (_clck, _clsk, MUID)	Measurement	Heatmaps and session recording for usability diagnostics - active by default; not loaded if the Measurement category is declined. The MUID identifier may be shared with Microsoft (Bing) for advertising purposes
Meta Pixel (_fbp)	Advertising	Campaign measurement, custom audiences and remarketing on Facebook/Instagram - loaded only after consent

Customer Portal: uses cookies that are strictly necessary for its operation (authenticated session, CSRF protection, "remember me" and social login flow state). As they are essential to the provision of the service, they do not require consent, but are listed here for transparency.

7. Automated processing and Artificial Intelligence

Some plugin modules offer features based on artificial intelligence (for example, ticket summarization, response suggestion, sentiment analysis, semantic search and translation) and automated support assistants (chatbots on Teams and Telegram and the NexBot chat assistant, described in section 3.4).

• These features process the content of tickets to generate the requested assistance, but do not make automated decisions with legal effects or that significantly affect the data subject (Art. 20 of the LGPD); support is conducted by a human team, and you may request human review.
• Several modules adopt the BYOK ("bring your own key") model: the AI provider is contracted and configured by the customer itself, who determines to which service the content is sent.
• When these features send data to external providers, sections 8 (sub-processors) and 9 (international transfer) apply.
• In the AI Assist module, the customer may also choose to process these features in NexTool's cloud, with its own key ("your key through the cloud") or in managed mode; how it works, the data sent and the retention periods are described in section 3.4.

8. Sharing, processors and sub-processors

We do not sell your personal data. We share data only with processors and partners necessary for the provision of the services, within the limits of the purposes of this Policy. The main ones are:

Partner	Function	Front
Cloudflare	CDN, security, CAPTCHA and entry point of NexTool's cloud services	Website, cloud services
JMBA Soluções	Administration, under NexTool's instructions, of the Cloudflare account used by NexTool	Website, Portal, cloud services
Google Analytics	Audience measurement (active by default, subject to opt-out)	Website
Microsoft Clarity	Heatmaps and session recording (active by default, subject to opt-out)	Website
Meta Platforms (Pixel)	Advertising campaign measurement and audiences (after consent)	Website
GitHub (giscus)	Blog comments	Website
Google / GitHub / Microsoft / LinkedIn	Social login (SSO)	Portal
Stripe	Payment (card and boleto bank slip) and subscription processing; receives the order's billing data, when provided	Portal
Brevo	Sending e-mail campaigns	Portal
ZeptoMail (Zoho Corporation)	Sending the Portal's transactional e-mails (verification, password reset, order and support request notices)	Portal
Zoho Campaigns (Zoho Corporation)	Sending announcements and news by e-mail, to those who keep the setting active, with the account usage data described in section 3.2	Portal
Hostinger	Infrastructure hosting (server in Brazil)	Portal/infra, cloud services
OpenAI, Google, Anthropic	AI providers contracted by the customer itself, in local mode and in "your key through the cloud" mode (summary, response, translation, embeddings); they do not act on behalf of NexTool	Modules
OpenRouter, Inc.	Artificial intelligence model router in the managed mode of AI Assist through the cloud; only routes where the provider declares that it does not retain or train on the content	Cloud services (AI)
Google, OpenAI, Anthropic and TypeSafe, through OpenRouter	Processing of the artificial intelligence models in managed mode, as NexTool's sub-processors	Cloud services (AI)
NexSuite	Infrastructure backups, stored off the server	Infra
Cloudflare (R2), contracted by NexSuite	Backup storage	Infra
Microsoft 365/Teams	Channel and identity of the Teams assistant	Modules
WhatsApp/Meta	Messaging channel chosen by the customer	Modules, cloud services
UZAPI	Connection of the customer's WhatsApp number to NexTool's cloud services, as a sub-processor	Cloud services
Anthropic	Artificial intelligence models for the NexBot chat assistant, as NexTool's sub-processor	Cloud services (AI)
Voyage AI	Semantic search in the NexBot chat assistant's articles, as NexTool's sub-processor	Cloud services (AI)
Microsoft 365	Calendar and meeting invitations for service schedules	Portal
DeepL, Google Translate	Translation	Modules
Mercado Eletrônico	B2B purchase requests	Modules
Autentique	Digital signature	Modules
Geocoding providers	Conversion of coordinates into addresses	Modules

The detailed and up-to-date list of processors can be requested from the Data Protection Officer (section 14). In processing activities in which NexTool is a Processor, the partners above that process data on behalf of NexTool act as sub-processors, and sharing occurs on behalf and by order of the customer Controller. We notify the customer in advance before adding or replacing a sub-processor in these processing activities.

Channels chosen by the customer. Some services use messaging platforms that the customer itself chooses and that each person uses with their own account, such as Telegram. These platforms are independent third parties: they process data under their own terms and privacy policies and do not act on behalf of NexTool.

Artificial intelligence provider chosen by the customer. In the "your key through the cloud" mode of AI Assist, the artificial intelligence provider (OpenAI, Google or Anthropic) is contracted by the customer itself, which supplies its key; NexTool only forwards the request to it. In local mode, the customer's GLPI calls that provider directly. In both cases that provider does not act on behalf of NexTool: it processes the data under its contract and terms with the customer. These same providers act as NexTool's sub-processors only in managed mode, through OpenRouter.

9. International data transfer

Some processors and partners are located in or process data outside Brazil (for example, in the United States and the European Union), including Google, Microsoft, Stripe, Brevo, Zoho, OpenAI, Anthropic, OpenRouter, TypeSafe, Voyage AI, DeepL, Meta, Cloudflare and geocoding providers. In these cases, the international transfer complies with Arts. 33 to 36 of the LGPD and with the data protection terms of each provider. For transfers made by NexTool's own sub-processors, we adopt as the instrument the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024); these clauses are being formalized with each sub-processor, and this section will be updated once that is complete.

The messaging platforms chosen by the customer, such as Telegram, may process data outside Brazil. This transfer results from the customer's choice of channel and is provided for in the contract with the customer.

In the managed mode of the artificial intelligence features through the cloud, the redacted content of the tickets is processed in the United States by OpenRouter and by the model providers, as NexTool's sub-processors, under the terms of each provider and with the ANPD standard contractual clauses as the instrument, being formalized (previous paragraph). In the "your key through the cloud" mode (up to version 2 of the module), processing by the provider contracted by the customer takes place wherever that provider is located, as a rule in the United States, and results from the customer's choice and contract with it.

The infrastructure operated by NexTool itself is located in Brazil (São Paulo): the website's GLPI instance, the licensing infrastructure (ContainerAPI), the WhatsApp messaging gateway, the NexBot chat assistant backend and the cloud services linked to the customer's GLPI. In NexBot, the content of the artificial intelligence features is processed in the United States by Anthropic and Voyage AI, as NexTool's sub-processors, with the ANPD standard contractual clauses as the instrument, currently being formalized. These services reach the internet through Cloudflare's network, which may process the traffic outside Brazil. External backups are stored in Cloudflare R2, outside Brazil, in encrypted form. The digital signature (Autentique) and B2B purchase (Mercado Eletrônico) modules are provided by Brazilian companies; to the extent that any processing occurs outside Brazil, the international transfer regime above applies equally.

10. Retention and disposal

We keep personal data only for as long as necessary for the purposes for which it was collected, observing legal deadlines. Criteria by category:

Category	Retention criterion
Website contact and sales follow-up	While there is an ongoing business relationship and for the applicable retention period
Announcements and news	While the setting is active; when you turn it off (in "My Profile" or through the unsubscribe link), you stop receiving them and are removed from the mailing list
Access logs	For the security/diagnostic period, observing the legal minimum of the Internet Civil Framework
Audience metrics	For a limited period, in aggregated/anonymized form
Account and licensing (portal)	During the term of the contractual relationship and for the subsequent legal periods
Licensing and distribution (NexTool plugin)	Record of the plugin's calls to our infrastructure: content, headers and IP address erased after 90 days and the record deleted after 400 days; the most recent license check of each environment is kept complete until 400 days. Environment registration (domain, observed IP address, versions, language and time zone) and history of observed domains and addresses: for as long as the environment is registered. Record of module downloads (domain and IP address): kept as proof of license delivery. History of checks stored in the customer's GLPI: 120 days
Billing data (profile)	While the account exists; you can edit or delete it at any time, and it is erased when the account is deleted
Billing copy of orders and transactions	5 (five) years, due to a tax obligation, even after the account is deleted
Testimonials	Published while the authorization is in force; when you withdraw it, the testimonial is removed from the website. The record of the authorization (terms version, date and IP) is kept as proof of consent
Support opened from the plugin	Technical report: up to 90 days after the request is closed. Request and conversation: like the Portal account and licensing. Copy of the request used to create it on the Portal: deleted after 90 days
Cloud services (NexTool as Processor)	As set out in the contract with the customer. Using GLPI through Telegram: message content not kept after processing; account identifier for up to 24 hours. Artificial intelligence features through the cloud: request and reply content not stored; request metadata for 90 days; generated result, encrypted, for 24 hours; error records for 30 days; credit balance and entries, without personal data, for as long as the customer's environment exists; backups for up to 6 months. Using GLPI through WhatsApp: service messages for 7 days after the last one; phone number link and conversation state for 90 days without use; error records for 30 days; WhatsApp gateway history while the service is active. NexBot assistant: conversations for as long as the license exists; conversation summary for 90 days without use; backups for up to 6 months. When the customer no longer has the link, the service is suspended within 7 days and the environment is removed 90 days later
Audit trail	For a period compatible with the security and evidentiary purposes

Once the periods have ended, the data is deleted or anonymized, except in cases of mandatory retention (Art. 16 of the LGPD).

11. Data subject rights

Pursuant to Art. 18 of the LGPD, you may, at any time:

• confirm the existence of processing and access your data;
• correct incomplete, inaccurate or outdated data;
• request the anonymization, blocking or deletion of unnecessary, excessive data or data processed in non-compliance;
• request the portability of the data;
• request the deletion of data processed on the basis of consent;
• obtain information about the sharing of your data;
• revoke consent, including the authorization to publish a testimonial, which you withdraw in the Portal itself;
• object to processing carried out on the basis of legitimate interest.

In the Portal, you can update account and billing data; account deletion is carried out by our team, at your request, through the Data Protection Officer's channel (section 14), except for data that we must retain due to a legal obligation (e.g., the billing copy of orders and other tax records).

For data processed inside the customer's GLPI (where NexTool is a Processor), direct your request to the Controller organization; NexTool will support the handling.

To exercise your rights, use the Data Protection Officer's channel (section 14).

12. Information security

We adopt technical and organizational measures to protect data, including: HTTPS/TLS connection; storage with encryption and access controls; two-factor authentication and encrypted secrets in the Portal; isolation per instance and per database for each customer; signed communication (HMAC) between components; the principle of least privilege; and audit records. Administrative access to customer data (including the assisted account viewing feature in the Portal) is controlled and audited.

13. Incident management

We maintain processes for the detection, response and containment of security incidents. Should an incident occur that may give rise to relevant risk or harm to data subjects, we will notify the National Data Protection Authority (ANPD) and the affected data subjects, pursuant to Art. 48 of the LGPD. When we act as a Processor, we will notify the customer Controller so that it can fulfill its duties.

14. Data Protection Officer (DPO)

NexTool provides a channel for contact with its Data Protection Officer for clarifications about this Policy and for the exercise of rights:

• Data Protection Officer: Richard Loureiro Leite
• E-mail: [email protected]

15. NexTool MCP (AI connector for GLPI)

NexTool MCP for GLPI is the connector hosted by NexTool at mcp.nextoolsolutions.com. It links an artificial intelligence assistant of your choice (for example, Claude, ChatGPT, Claude Code, Cursor or VS Code) to a GLPI you are authorized to access, through the MCP protocol (Model Context Protocol). To use it, you create an account on the Customer Portal and register the connection to your GLPI under My Account > NexTool MCP. This section describes the data the service processes; the rest of this Policy applies where relevant. The open source version, which users install on their own machine or server, does not go through NexTool and is not covered by this section.

15.1 Roles

For the Portal account, access keys, authorizations and technical usage records, NexTool is the Controller. The GLPI data that passes through the connector belongs to the organization that owns the GLPI; when it relays calls on the instructions of whoever registered the connection, NexTool acts as a Processor (section 2).

15.2 Data we process

• Portal account: the account data described in section 3.2 (such as name, email and phone number), used for sign-in and to identify who uses the service.
• GLPI connections: connection name and identifier, GLPI address, API used (v1, v2 or both), tool groups, the read-only option, the GLPI version and the result and date of the last test. The API credentials you provide (user token and App-Token, or the client ID, secret, username and password of the GLPI 11 OAuth) are encrypted as soon as they are received, with a key held only by the connector service. The Portal stores only the encrypted envelope and cannot open it, and the credentials are never displayed again.
• GLPI user identity: when the connection is tested, we store the identifier, login and profile of the GLPI user that each API authenticated, to display them on the connection and to warn when the profile has full administrator rights.
• Keys and authorizations: for access keys (nxm_) we store only a cryptographic digest (hash), the prefix and the creation and last-use dates; the full key is shown only once, when it is created. For apps authorized by sign-in (OAuth) we store the app name, the redirect address, the authorized connection, the dates and the access tokens, which have a limited lifetime.
• Technical usage records: for each call, the connector records the date and time, the duration, the account, the key or authorization used, the connection, the MCP message type, the name of the tool called and the result. These records do not contain the content of questions, the parameters sent to tools or the responses. The connection test records the address of the GLPI tested and the result.
• Portal audit trail: creation and revocation of keys, registration, testing, change and deletion of connections, and authorization or revocation of apps, with date, IP address and browser, without credentials or tokens.
• Record of commercial interest: when the first access key is generated, we record the account's interest in NexTool MCP in our commercial records, to contact you about the service.

15.3 What we do not process

• Conversations: the content of your conversations with the assistant is neither received nor stored by NexTool. The connector only receives the tool calls the assistant decides to make and relays them to your GLPI.
• GLPI data: tickets, assets, articles and other GLPI data pass through the connector only during each call and are not stored. The only exception is the result of a create operation (for example, opening a ticket), kept only in the service's memory for up to 2 minutes, so that a repeated request returns the first result instead of creating a duplicate record.
• AI training: NexTool does not use your GLPI data or your calls to train artificial intelligence models.

15.4 Purposes and legal bases

We process this data to provide the service (authenticating access, applying the plan and limits and relaying calls to GLPI), based on the performance of a contract (Art. 7, V), and for security, abuse and fraud prevention, diagnostics and support, based on legitimate interest (Art. 7, IX). The record of commercial interest is also based on legitimate interest, and you may object to it through the Data Protection Officer's channel (section 14).

15.5 Retention

• Connector technical usage records: kept in the service logs, in rotating files of limited size (up to 5 files of 10 MB). The oldest are deleted automatically as new records are written, and all of them are discarded whenever a new version of the service is installed. These records are not included in backups.
• Connections, encrypted credentials and GLPI user identity: for as long as the connection exists. When you delete it, this data is erased from the Portal and remains only in encrypted backups, for up to 6 months.
• Keys and authorizations: a revoked key stops working and remains recorded as revoked, with only the hash and the prefix. Sign-in tokens expire (the access token after about 1 hour and the refresh token after about 30 days), and automatically registered apps unused for 30 days are removed.
• Portal audit trail: follows the audit trail criterion in section 10; there is currently no automatic time-based deletion.
• Record of commercial interest: follows the criterion for commercial contacts in section 10.

15.6 Control and revocation

Under My Account > NexTool MCP you can, at any time, revoke access keys, revoke authorized apps, turn on read-only mode and delete connections, which erases the encrypted credentials. Revocation takes effect within 1 minute. You can also invalidate the credentials in GLPI itself (for example, by generating a new user token). Account deletion and the other data subject rights follow section 11; for data held inside GLPI, contact the organization that owns the GLPI.

15.7 Third parties

• The AI assistant you choose: the assistant (such as Claude, by Anthropic, or ChatGPT, by OpenAI) is contracted and configured by you, decides which tools to call and receives the results the connector returns, including data from your GLPI. It processes that data under its own provider's terms and privacy policy and does not act on behalf of NexTool. Choose an assistant and a plan that comply with your organization's rules for GLPI data.
• Cloudflare: delivery and security network at the entrance of the service, which also applies request limits per IP address (sections 8 and 9).
• Hosting: the connector and the Portal run on infrastructure operated by NexTool in Brazil (section 9).

15.8 Security

In addition to the measures in section 12, the connector only calls public addresses (it refuses internal networks), does not follow redirects to another address, keeps delete tools disabled and applies usage limits per account and per target GLPI. Every action in GLPI respects the permissions of the GLPI user whose credential was registered.

16. Changes to this Policy

We may update this Policy at any time. In the event of relevant changes, we will revise the "last updated" date at the top and, where appropriate, notify you through the available channels. Continued use after the changes take effect implies acknowledgment of the updated version.

17. Contact and jurisdiction

For questions about this Policy, contact us at [email protected]. This Policy is governed by Brazilian law. The courts of the Comarca de São João del-Rei/MG are elected to resolve disputes, with waiver of any other.