Privacy Policy

Who we are

Laravel ("we", "the platform") is an API and backend platform operated at api.next.com.se. For data you store inside your projects, you are the data controller and we are the processor. For your own account data, we are the controller.

What we collect

• Account data: name, email address, hashed password, and role. Used to authenticate you and to send service notices.
• Project content (whatever you or your AI assistant create): resource records, form submissions, uploaded files, endpoint configuration. We do not inspect it except as needed to operate the service.
• Operational logs: request logs and usage counters per project (timestamps, endpoint, status code, response time). These power metering, rate limits and observability alerts. Per-project request logging is off by default for new projects.
• Cookies: a session cookie for the admin panel, plus your theme and cookie-consent preferences stored in your browser. We set no advertising or cross-site tracking cookies.

End users of your projects

If you enable end-user authentication, the platform stores the credentials and profile fields you configure (email, hashed password, OAuth identifiers, one-time codes). Those records belong to your project. You control retention, export and deletion from the admin panel, and they travel with your project export.

AI processing

Where you explicitly enable an AI feature (translation, an AI workflow node, response processing), the relevant content is sent to the model provider you configured (for example OpenRouter). Token usage and cost are logged so you can audit them. No content is sent to any model provider unless you turn that feature on.

Sub-processors

We use infrastructure and delivery providers to run the service: hosting and storage, transactional email (the provider configured per project, for example Resend, SendGrid, Mailgun, Postmark or SES), optional SMS delivery, and optional AI model routing. Payment gateways you connect (Stripe, PayPal, Razorpay, SSLCommerz, Flutterwave, 2Checkout) receive payment data directly from your customers' browsers; card details never reach our servers.

Retention & deletion

Account data is kept while your account is active. Project content is kept until you delete it; deletions are recorded in an internal deletion log for audit purposes. You can export a full project archive (ZIP or SQL) at any time. On request we will delete your account and associated data within 30 days, except where we must retain records to meet a legal obligation.

Your rights

Depending on where you live you may have rights to access, correct, export, restrict or erase your personal data, and to object to processing. Because the platform is self-hostable and every project exports in full, access and portability are available to you directly in the panel at any time. To exercise any other right, contact us using the details below.

Security

See our Security page for the technical and organisational measures we apply, including encryption of credentials at rest, signature verification on inbound webhooks, egress allowlisting for workflow steps and granular per-project permissions.

Changes & contact

We will post material changes to this policy on this page and update the date above. Questions or requests: privacy@api.next.com.se.