NextDemo

Privacy Policy

Last updated 2026-06-16

The short version: NextDemo is designed to handle as little personal data as possible. As of the date at the top of this page, the product itself sends no telemetry and your recordings stay on your machine. If we ever change that, we will update this Privacy Policy and describe what's collected before the feature ships. The only personal data we directly handle is the minimum needed to deliver your license, support you, and meet our legal obligations under Czech accounting and tax law.

1. Who we are

The data controller for the personal data described below is Next Iteration s.r.o., a company registered in the Czech Republic, IČO 19946279, with its registered office at Nové sady 988/2, Staré Brno, 602 00 Brno. Contact for any privacy-related question: [email protected].

2. No Data Protection Officer (DPO)

We have not appointed a Data Protection Officer because we do not meet the criteria of Article 37 GDPR: we have fewer than 250 employees, we do not carry out large-scale systematic monitoring of individuals, and we do not process any special-category personal data. Privacy questions are answered directly by the address above.

3. What personal data we handle

Our processing of personal data falls into three distinct categories, depending on who decides the purpose of the processing.

3.1. Collected by Lemonsqueezy as independent controller (Merchant of Record)

When you purchase NextDemo, the entire checkout flow is operated by Lemon Squeezy LLC, our Merchant of Record. Lemonsqueezy is an independent data controller for this step: they decide how the payment data is collected, fraud-checked, taxed, and retained. The data they collect from you at checkout includes your name, email address, billing address, and payment method. We never see your card details. Their Privacy Policy applies to this step.

3.2. Processed by Lemonsqueezy on our behalf (data processor)

For the technical enforcement of your License Key, we use the Lemonsqueezy License API. In this role, Lemonsqueezy acts as our data processor under a Data Processing Addendum. The data processed for this purpose includes your License Key, a machine fingerprint hash for each Activation, the timestamp of each Activation, and the IP address from which the Activation occurred.

3.3. Affiliate referral attribution

When you arrive at nextdemo.app via an affiliate link, attribution to the partner is handled in two ways:

  • URL pass-through. The affiliate parameter in the URL is forwarded to the outbound checkout link so the partner is credited if you purchase in the same session. No data is stored on your device or on our side as a result of this pass-through. Because the parameter is request data and not "storage on terminal equipment" within the meaning of Article 5(3) of the ePrivacy Directive, no consent is required.
  • Persistent attribution (Lemon Squeezy script). A script provided by Lemon Squeezy stores the affiliate's identifier in your browser so that, if you later complete a purchase in a different tab, day, or session, the partner is still credited. For this Lemon Squeezy acts as our data processor under the same Data Processing Addendum that covers the License API. Inside the EU/EEA/UK/CH the lawful basis is your consent (Art. 6(1)(a) GDPR), collected via the cookie banner. Outside those regions the lawful basis is our legitimate interest (Art. 6(1)(f) GDPR) in running a paid affiliate program with reliable attribution; you can still object at any time via the "Manage cookies" link in the site footer, in which case the script will not load on subsequent page loads.

3.4. Handled directly by us (controller)

After your purchase completes, Lemonsqueezy passes us a record containing your email address, your name, and the License Key details so we can deliver your license, provide support, and enforce our fair-use policy. From the moment we receive that record, we are the data controller, and the rest of this Privacy Policy describes what we do with it. We also directly handle:

  • Inbound emails sent to any of our addresses (info@, support@, legal@, privacy@, security@), including the email body and any attachments.
  • Anonymized website analytics from Simple Analytics, a cookieless analytics service based in the Netherlands. Simple Analytics does not collect personal data and does not use cookies, fingerprinting, or persistent identifiers.
  • Transient security data from Cloudflare Pages, the platform that hosts and serves this website. Cloudflare may process visitor IP addresses transiently for security purposes (DDoS and bot mitigation) under its own retention defaults. We do not enable Cloudflare Logs or Logpush, so no persistent access logs are retained on our side.

4. What we do NOT currently collect

As of the date at the top of this page, the NextDemo desktop application does not send telemetry, usage statistics, crash reports, or product analytics back to us, and the recordings you create stay on your machine and are not transmitted to us. If we introduce any feature that would change this (for example, optional crash reporting or a cloud backup option), we will update this Privacy Policy to describe what is collected, why, and under what lawful basis, before the feature ships in a release. We do not maintain user accounts on this website.

Separately, some optional features let you connect a third-party service that you choose and configure with your own credentials — for example, a text-to-speech provider used to generate a voiceover. These features are off until you turn them on. When you do, the content you give the feature (such as the narration text you write) is sent directly from your machine to that provider, under your own account and subject to that provider's own terms and privacy policy. It does not pass through us: NextDemo operates no server that receives or stores that content, and we never see it. Your recordings themselves still never leave your machine.

5. Lawful basis for processing

We rely on the following lawful bases under Article 6 GDPR:

  • Performance of a contract (Art. 6(1)(b)) — to deliver and support the Service for which you purchased a Subscription.
  • Compliance with a legal obligation (Art. 6(1)(c)) — primarily to retain accounting and invoicing records as required by Czech Act No. 563/1991 Coll. on Accounting (10-year retention) and Czech Act No. 235/2004 Coll. on VAT.
  • Legitimate interest (Art. 6(1)(f)) — for fraud prevention, security, the enforcement of our fair-use policy, and (outside the EU/EEA/UK/CH) for affiliate referral attribution as described in section 3.3. We have balanced these interests against your privacy and consider them proportionate, given the minimal data involved and the narrowly defined purposes. You can object to any legitimate-interest processing by contacting us, and to affiliate attribution specifically via "Manage cookies" in the footer.
  • Consent (Art. 6(1)(a)) — inside the EU/EEA/UK/CH, for the affiliate referral cookie described in section 3.3, and only that. You give consent by accepting the cookie banner and can withdraw it at any time via "Manage cookies" in the footer. If we ever introduce optional marketing email or any further non-essential tracking, we will ask for separate explicit consent first.

6. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, and never longer than required by law. The table below shows our typical upper bounds.

  • Customer record (email, name, license details received from Lemonsqueezy): for the duration of your active Subscription and up to three (3) years after termination, to cover the Czech statutory limitation period for contract claims.
  • Invoices and accounting records: up to ten (10) years from the end of the accounting period, as required by Czech Act No. 563/1991 Coll. on Accounting.
  • Inbound support emails: up to three (3) years from the date of receipt, after which they are deleted from our inbox unless they remain necessary for an ongoing matter.
  • Server access logs: not retained on our side.

7. Sub-processors and recipients

We use a small number of third-party providers to operate the Service. The current list is published at /legal/sub-processors and is updated when it changes. We do not sell your personal data, and we do not share it with anyone outside this list except where required by law.

8. International data transfers

Two of our sub-processors are located in the United States: Lemonsqueezy and Cloudflare. Transfers of personal data to the United States take place under the European Commission's Standard Contractual Clauses (SCCs) of 4 June 2021 (Implementing Decision (EU) 2021/914), supplemented by the additional safeguards described in each provider's data processing addendum. We do not transfer personal data to any other third-country jurisdiction.

9. Your rights under GDPR

Under Articles 15 to 22 of the GDPR, you have the right to:

  • Access the personal data we hold about you;
  • Rectify personal data that is inaccurate or incomplete;
  • Erase your personal data ("right to be forgotten"), subject to our legal obligations to retain accounting records;
  • Restrict our processing of your personal data in certain circumstances;
  • Object to our processing based on legitimate interest;
  • Receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability);
  • Withdraw consent at any time, where processing is based on consent (which it currently is not).

To exercise any of these rights, email [email protected]. We will respond within thirty (30) days. We may ask you to confirm your identity before acting on a request, to make sure we are not disclosing data to the wrong person.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for the Czech Republic is the Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic. You may also complain to the supervisory authority of your country of residence.

11. Children

NextDemo is not directed at children under sixteen (16) and we do not knowingly collect personal data from anyone under that age. If you believe we have inadvertently received data from a child, please contact us and we will delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes — such as adding a new sub-processor, extending a retention period, or changing the lawful basis for any processing — will be announced by reasonable means, which may include email to current customers, an on-site notice on nextdemo.app, or both. Non-material changes (typos, clarifications) take effect immediately upon publication. The last-updated date at the top of this page allows you to track changes over time.

Questions, requests, or concerns? Contact [email protected].