Get started

Privacy Policy

Last updated: July 17, 2026

1. Who We Are

NextFlash ("we", "us", "our") is a deployment platform for Next.js applications operated by BIT Enterprises UG (haftungsbeschränkt). This Privacy Policy explains how we collect, use, and protect your personal data.

Responsible party (Verantwortlicher) within the meaning of the GDPR:
BIT Enterprises UG (haftungsbeschränkt)
Franz-Schubert-Str. 20, 34277 Fuldabrück, Germany
Email: [email protected]

2. Data We Collect

  • Account data: Email address and name when you register. Passwords are hashed with bcrypt and stored on our servers — we never store them in plain text.
  • Team data: Team names, membership roles, invitation emails, and which projects each member can access when you collaborate with others on the Service.
  • Server logs: IP addresses, request timestamps, HTTP methods and paths, user agents, and related technical metadata generated when you use the Service or when your deployed applications receive traffic.
  • Usage data: Pages visited, features used, deployments, builds, timestamps, and device/browser information — collected via Google Analytics.
  • Payment data: Processed by our Merchant of Record, Polar Software Inc. We do not store credit card numbers or payment details on our servers.
  • GitHub integration data: Repository names, organization access, webhook events, and deployment metadata when you connect your GitHub account.
  • Project data: Source code, environment variables, build logs, deployment history, and other configuration you provide through the Service.

3. How We Use Your Data

  • To provide and improve the Service.
  • To build, deploy, and serve your applications.
  • To process transactions via Polar.
  • To analyze usage patterns and optimize performance (Google Analytics).
  • To communicate with you about your account or changes to the Service.
  • To comply with legal obligations.

4. Legal Basis (GDPR)

  • Contract performance (Art. 6(1)(b) GDPR) — to deliver the Service you signed up for.
  • Legitimate interest (Art. 6(1)(f) GDPR) — to analyze usage and improve the Service.
  • Consent (Art. 6(1)(a) GDPR) — where required, e.g. for analytics cookies.
  • Legal obligation (Art. 6(1)(c) GDPR) — to comply with applicable laws.

5. Third-Party Services

Google Analytics

We use Google Analytics to understand how users interact with the Service. Google Analytics uses cookies to collect anonymized usage data (pages visited, session duration, device type). This data is processed by Google LLC (USA). For more information, see Google's Privacy Policy. You can opt out via the Google Analytics Opt-Out Add-on.

Reddit Ads

We use the Reddit Ads pixel to measure ad performance and attribute sign-ups and purchases from Reddit campaigns. When you are signed in, we may pass your email address and account ID to Reddit for advanced matching. Reddit may set cookies or use similar technologies. Data is processed by Reddit, Inc. (USA). See Reddit's privacy policy for details.

Polar (Payment Processing)

Polar Software Inc. acts as the Merchant of Record for all payments. When you make a purchase, your payment information is collected and processed directly by Polar. We do not have access to your full payment details. See Polar's privacy policy for details on how they handle your data.

GitHub

When you connect a GitHub account, we access repository and organization data as authorized by you through the GitHub App installation. Source code is cloned and built on our infrastructure to deploy your applications. GitHub's own privacy policy applies to data held by GitHub.

Other Service Providers

We use third-party providers for hosting, compute, and infrastructure to deliver the Service. Your project data may be processed by these providers on our behalf. We only share the minimum data necessary.

We do not sell your data to third parties.

6. Cookies

We use essential cookies required for the Service to function (e.g., authentication), analytics cookies via Google Analytics, and advertising/measurement cookies via the Reddit Ads pixel.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. After account deletion, we remove your personal data within 30 days, except where retention is required by law.

8. Your Rights (GDPR)

You have the right to:

  • Access your personal data.
  • Rectify inaccurate data.
  • Delete your data ("right to be forgotten").
  • Restrict processing of your data.
  • Port your data to another service.
  • Object to processing based on legitimate interest.
  • Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at [email protected].

9. Data Security

We use industry-standard technical and organizational measures to protect your data, including encrypted connections (TLS), secure authentication, and access controls.

10. International Transfers

Some of our service providers (e.g., Google) may process data outside the EU/EEA. Where this occurs, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Service.

12. Contact & Supervisory Authority

For privacy-related questions, contact us at [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.