NextNeural
Privacy Policy
NextNeural is provided by Superstellar Media Labs Pvt. Ltd., Delhi, India.
Effective November 4, 2026 · Last updated November 4, 2026
Data Fiduciary: Superstellar Media Labs Pvt. Ltd., 55, Lane 2, Westend Marg, Saidullajab, Saket, Delhi 110030, India (CIN: U92490DL2021PTC391617) (“Superstellar”, “we”, “us”, “our”)
Grievance Officer: Grievance Officer, Superstellar Media Labs Pvt. Ltd., [email protected], +91 80 3133 5933
1. Who this policy covers
This policy explains how Superstellar processes personal data collected through the India site of the NextNeural marketing website, nextneural.ai/in (the “Website”), including when you browse, fill in a form, book a call, request a demo, try a voice AI demo, subscribe to updates, or contact us. We handle personal data in accordance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, and the Information Technology Act, 2000.
What this policy does not cover
- The NextNeural platform. Data that customers and their end users process on the NextNeural products (for example call recordings, transcripts, CRM records and documents) is governed by the privacy terms and data processing terms that apply to the platform under the customer’s agreement. These terms are presented to customers when they onboard to the platform. For that data our customer is the Data Fiduciary and we act as its Data Processor.
- Visitors outside India. Visitors using the global site (nextneural.ai) are served by Supercraft Inc. under its own privacy policy.
- Third-party sites linked from the Website. We do not control them.
2. Definitions
Terms such as “personal data”, “Data Principal”, “Data Fiduciary”, “Data Processor”, “Consent Manager” and “Board” have the meanings given in the DPDP Act. In this policy, “you” means the Data Principal, the individual whose personal data we process.
3. Personal data we collect
3.1 Data you provide
| What | When |
|---|---|
| Name, work email, company, company size, phone number | Contact, book-a-call, try-voice-AI and enquiry forms |
| Anything you write in a message field | Contact and enquiry forms |
| Email address | Newsletter and event-alert sign-ups |
| Scheduling details | Booking a call |
| Communications with us | Email, calls, chat |
3.2 Data collected automatically
- IP address, browser type and version, operating system, device type, language, pages viewed, links clicked, referring page and timestamps.
- UTM campaign parameters (source, medium, campaign, content, term), saved with a form submission.
- Cookies and similar tools: see Section 9.
- Approximate location (country or region), derived from your IP address.
3.3 Voice AI demo
When you use a voice AI demo on the Website, we collect and record your voice and the conversation, create a transcript, and collect the phone number or other details you provide and technical session details. We use them to run the demo, to follow up if you asked, and to maintain, secure and troubleshoot the demo experience.
- We do not use recordings to train AI models, and we do not create voiceprints or otherwise use your voice to identify you.
- Recordings and transcripts are kept for 6 months and then erased, unless you ask us to erase them sooner (Section 10) or law requires us to keep them.
- Before the demo starts we ask you to tick a box agreeing to the recording. If you do not agree, the demo is not available to you.
- Please do not share sensitive information (financial account numbers, health information, government IDs such as Aadhaar or PAN) during a demo.
- Recordings are processed by our voice infrastructure providers (Section 5) on our instructions.
3.4 Data from other sources
Business contact providers (which we may use to verify or complete company and role details), event partners when you register through them, and public professional sources when relevant to a business enquiry.
3.5 Data we do not seek
We do not seek Aadhaar numbers, PAN, financial account details, health data or other sensitive information through the Website. If you volunteer it in a free-text field, we use it only to handle your request.
4. Notice, purposes and legal basis
We process your personal data only for the purposes below. Our basis is your consent, given by a clear affirmative action (such as submitting a form after reading the notice shown next to it, ticking the recording agreement, or accepting cookies), or one of the “certain legitimate uses” recognised under the DPDP Act, such as where you voluntarily give us your data for a specified purpose and have not said you object, or where law requires it.
At the point of collection we show a short notice with a link to this policy. This policy lists the data we collect, the purposes, and how to withdraw consent and make a complaint.
| Purpose | Data | Basis |
|---|---|---|
| Respond to enquiries; schedule calls; provide a requested demo or trial | Contact details, message, scheduling details | Consent / voluntary provision |
| Send newsletters and event alerts | Consent (you subscribe to receive them) | |
| Sales follow-up and relationship records | Contact and company details, enquiry history | Consent / voluntary provision |
| Secure the Website and prevent spam and abuse | IP, device and request data | Legitimate use / security |
| Analytics and measuring our Google Ads campaigns | Usage data, cookie identifiers, ad interaction data | Consent (cookie preferences) |
| Compliance with law and legal claims | As required | Legal obligation |
AI and model training. We do not use personal data you submit through Website forms, or voice demo recordings and transcripts, to train AI or machine-learning models.
4.1 Withdrawing consent
You may withdraw consent at any time, and withdrawal will be as easy as giving consent: use the unsubscribe link in any email, the “Cookie Preferences” link in the footer, or write to [email protected]. We will stop processing and erase the data within 30 days, unless law requires us to retain it. Withdrawal does not affect processing already done.
4.2 Consent Managers
You may give, manage, review or withdraw consent through a Consent Manager registered with the Board, once this mechanism is operational. Contact [email protected] if you wish to do so.
5. Who we share personal data with
We do not sell personal data. We share it only as needed with:
| Recipient | Purpose | Examples |
|---|---|---|
| Hosting, CDN and security providers | Run and protect the Website | Cloudflare |
| Email providers | Transactional and marketing email | Mailgun, Resend, Listmonk |
| CRM | Store and manage leads in our own NextNeural CRM (cloud.nextneural.ai); access is limited to staff with a business need | NextNeural CRM |
| Analytics, tag management and advertising | Measure Website use and advertising performance | Google Tag Manager, Google Analytics, Google Ads |
| Voice and AI infrastructure providers | Run voice demos (telephony, speech recognition and speech synthesis) | Our voice platform providers |
| Group company | Supercraft Inc., the owner of the NextNeural platform, to respond to you and operate the NextNeural service | Supercraft Inc. |
| Professional advisers | Legal, audit, accounting | As needed |
| Authorities | When required by law, court order, or to prevent fraud or harm | As needed |
| Successors | In a merger, acquisition or restructuring | As needed |
Each processor handles data only on our documented instructions and under a contract that requires reasonable security safeguards. A current list is available on request at [email protected].
6. Transfers outside India
Some of our processors and our group company may process personal data outside India, including in the United States. We transfer personal data only to countries or territories not restricted by the Central Government under the DPDP Act, and we require appropriate safeguards from recipients.
7. Retention
We keep personal data only as long as needed for the purpose it was collected, and then erase it unless law requires longer retention. Typical periods:
| Category | Retention |
|---|---|
| Enquiry and lead records (held in NextNeural CRM) | 24 months after our last interaction |
| Newsletter and event-alert subscriptions | Until you withdraw consent |
| Voice demo recordings and transcripts | 6 months |
| Website hosting and security logs (Cloudflare) | Cloudflare’s standard default retention; we do not configure extended log storage |
| Google Analytics data | Up to 14 months for event-level data, per our Google Analytics setting |
| Records of consent and requests | As long as needed to show compliance with the law |
8. Security and breach notification
We take reasonable security safeguards to protect personal data, including encryption in transit, access controls and least-privilege access, logging and monitoring, and vendor due diligence. No system is completely secure.
If a personal data breach affects you, we will inform you without delay and in any event within 7 days of confirming it (or sooner where the law requires), describing what happened, the likely consequences, the steps we have taken, the steps you can take, and who to contact. We will also report it to the Board as the law requires.
9. Cookies and similar technologies
| Type | Purpose | Examples |
|---|---|---|
| Strictly necessary | Security, remembering your region (nn_region, up to 1 year) and your cookie choices (nn_consent, 180 days), bot protection | Cloudflare, first-party |
| Analytics | Understand Website use | Google Analytics (via Google Tag Manager) |
| Marketing | Measure Google Ads conversions and, where enabled, remarketing | Google Ads |
Until you accept them in the cookie preferences panel, Google Analytics and Google Ads do not set cookies on your device. Through Google Consent Mode they may still receive limited signals without cookie identifiers (for example the page visited and your IP address), which Google uses for aggregate measurement. You can change your choice at any time using “Cookie Preferences” in the footer. You can also use Google Ads Settings, the Google Analytics opt-out add-on and your browser settings. Google may process this data outside India (Section 6).
10. Your rights as a Data Principal
Under the DPDP Act you have the right to:
- Access a summary of the personal data we process, the processing activities, and the identities of the Data Fiduciaries and Processors we have shared it with;
- Correction, completion and updating of your personal data;
- Erasure of personal data that is no longer necessary for its purpose or whose consent you withdrew, unless law requires retention;
- Grievance redressal, with a first response from us within 7 days and resolution within the period prescribed by law;
- Nominate another individual to exercise your rights if you die or become incapacitated.
You also have duties: you must not impersonate anyone, suppress material information, register a false or frivolous complaint, or furnish false particulars.
10.1 How to exercise your rights
- Email [email protected] (subject: “Data Principal Request”) or write to us at the address in Section 15. Tell us the right you are exercising and give the email address or phone number you used on the Website.
- We verify your identity, usually by sending a confirmation link to the email address on file, and ask for no more than we need.
- We respond within 7 days, acknowledging your request, completing any verification, and telling you the expected completion date or, if we cannot act, why. We complete the request within the period prescribed by law.
10.2 Grievances and the Data Protection Board
Contact our Grievance Officer first (details at the top of this policy). If you are not satisfied with our response, or receive none within the prescribed period, you may complain to the Data Protection Board of India, in the manner prescribed under the DPDP Act, after you have used our grievance process.
11. Children
The Website is a business site and is not intended for anyone under 18. We do not knowingly process the personal data of children, and we do not track or target advertising at children. If we learn that a child’s data has been collected without verifiable parental consent, we will erase it. If you believe this has happened, contact [email protected].
12. Links to other sites
The Website links to third-party sites and may embed third-party content (for example video, scheduling and social links). Their privacy practices apply once you interact with them.
13. Changes to this policy
We may update this policy. We will post the new version with a new “Last updated” date and, if changes are material or affect your consent, notify you and, where required, seek your consent again. We review this policy at least every 12 months. Previous versions are available on request.
14. Applicable law
This policy is governed by the laws of India. Nothing in it limits any right you have under the DPDP Act.
15. Contact us
Superstellar Media Labs Pvt. Ltd.
55, Lane 2, Westend Marg, Saidullajab, Saket, Delhi 110030, India
Grievance Officer, [email protected], +91 80 3133 5933