Privacy Policy

1. Who we are

Nextis Georgia LLC (შპს ნექსტის საქართველო), identification code 405863070, Kobuleti 19, 0179 Tbilisi, Georgia (“Nextis”, “we”). We are the controller of the personal data described in this policy.

We have not appointed a data protection officer. For any privacy question or request, write to otto@nextis.ge.

2. Your company's data and our role

When a company connects its RS.ge account, Companion copies that company's documents from RS.ge. These documents can contain personal data of other people — for example a counterparty's name or a driver's name on a waybill. The company decides what to connect and which of its people can see it, and we process this data on the company's behalf.

If you appear in a company's documents and want to exercise your rights, please contact that company first. We will help it respond.

3. What we collect

• Account: your name, email address, phone number (optional), language, and when you verified your email and last signed in. Your password is stored only as a one-way hash (bcrypt). If you turn on two-step sign-in (MFA), the authenticator secret is stored encrypted and backup codes only as hashes.
• Team: your role, title and permissions in each company, and who invited you. When you invite a colleague, we store their name and email address and send them an invitation email.
• RS.ge connection: the RS.ge service-user name and password your company enters. They are encrypted with a key unique to your company (AES-256-GCM) and are never shown back in full.
• Documents from RS.ge: invoices and their lines, waybills (including addresses, car numbers and driver names), and counterparties' names and tax IDs. We also store the VAT figures we calculate from them, and any counterparty contact details you add yourself.
• Public registry data: to show counterparty names and contact details, we look up tax IDs in RS.ge's public taxpayer search and keep the public result.
• Bank statements: when you import a statement file, we read it and keep its transactions — date, amount, description, counterparty name, IBAN and tax ID, and your account number. We do not keep the file itself.
• Finance (your company's books, only if the company turns them on): its chart of accounts, the accounting entries made from its invoices and bank transactions, who confirmed or corrected each entry and when, notes, opening balances, closed months, transactions entered by hand, and the receipts and documents your people upload (photos, PDFs or spreadsheets, up to 20 MB each — unlike bank statement files, these files are kept). If your company asks for a quote for work by a Nextis accountant, we keep the quote and the figures it was priced from.
• AI Accountant (the AI assistant in Companion): your questions, its answers, your feedback on them, and — when it analyses your company's data — the figures it looked up to answer.
• Personal income (individual accounts, only if you use it): your personal ID number and phone number are sent to RS.ge, which texts you a code. After you enter the code we fetch and store your income records from RS.ge (period, employer name and tax ID, income and tax amounts). From this step we keep your personal ID number and a masked phone number, never the code.
• Security logs: for each signed-in session, the IP address and the type of device and browser; an activity log of important actions in your company (such as sign-ins, invitations, settings changes and documents sent to RS.ge), with the IP address; and technical server logs.
• Mobile app: the app's platform and version, sent with each request. Face ID or fingerprint unlock is checked by your phone's operating system — we never receive biometric data.
• Contact form on nextis.ge: your name, email address, what you are interested in, and your message.
• Support: whatever you send us when you write to us.
• Help and verify requests: when you report a problem, suggest an idea, ask to talk to an accountant or ask us to verify an AI Accountant answer with RS.ge — your message and contact details and, for a verify request, the question, the AI's answer, your company's name and tax ID if you choose to share them, and what RS.ge told us.

We do not collect your location, contacts, photos or advertising identifiers, and we do not ask for sensitive (special-category) data.

4. Why we use it

How the anonymised learning works: for each posted bank transaction we keep only its shape — whether money came in or went out, an amount band (for example ₾100–1,000), the bank of your company's own account, the bank's operation code, the kind of payment its description points to (rent, telecom, fuel and the like, from a fixed list), the kind of counterparty (customer, supplier, the Treasury, a private person and the like), the language of the description and the month — and the standard account it was posted to. Alongside it we keep a numerical representation (an “embedding”) of the description and counterparty name after IBANs, e-mail addresses, all digits and the names of private persons have been removed, so that similar payments can be recognised. Names of private persons, tax IDs, personal numbers, IBANs and amounts are not kept. Each company appears only under a coded label that cannot be traced back to it without a key we hold. A pattern learned this way is only used after a Nextis administrator approves it, and it only ever suggests a posting — a person in your company still confirms it.

We do not sell personal data, show ads, use tracking or advertising cookies, or make decisions about you by automated means that have legal or similarly significant effects.

5. Who we share it with

RS.ge (the Revenue Service of Georgia) — to sync your company's documents and to send the documents you create, using your company's credentials. For the personal income feature, your personal ID number and phone number. When you ask us to verify an answer, a Nextis specialist puts your question to RS.ge by phone or chat, with your company's details only if you chose to share them.

Service providers that process data on our instructions:

Under their business terms, Anthropic and OpenAI do not use data sent through their APIs to train their models; they may keep it for a limited time (typically up to 30 days) to monitor for abuse. We do not give your data to anyone to train AI models. The anonymised learning described in section 4 improves Companion's own posting rules and stays with us.

Nextis staff: a small number of authorised staff can access data to provide support and keep the service running. A staff view of a company's workspace for support is read-only, requires re-authentication and a stated reason, and is logged. When your company asks for a quote for work by a Nextis accountant, the request, the quote and the figures behind it reach our team, who contact you. Staff also look at posting suggestions your people report as wrong, to correct them.

Authorities, when the law requires it. If Nextis is reorganised or sold, your data may pass to the successor, which must keep to this policy.

We also fetch official exchange rates from the National Bank of Georgia; no personal data is sent.

6. International transfers

Our servers and backups are in the European Union. Some providers listed above are in the USA. For those transfers we rely on appropriate safeguards — standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework — as required by Georgia's Law on Personal Data Protection and, where it applies, the EU General Data Protection Regulation (GDPR). You can ask us for details at otto@nextis.ge.

7. How long we keep it

Your records at RS.ge are not ours: deleting data from Companion does not change or delete anything at RS.ge, and we cannot do that.

8. How we protect it

• All connections use HTTPS.
• RS.ge credentials and two-step sign-in secrets are encrypted (AES-256-GCM) with keys kept outside the database; passwords are stored only as hashes.
• Each company's data is kept apart from every other company's at the database level.
• Backups — including uploaded receipts and documents — are encrypted before they leave the server.
• Uploaded receipts and documents are served only to signed-in members of the company, never from a public address.
• Staff access is limited, requires two-step sign-in, and is logged.

No system is perfectly secure. If a breach affects your data, we will tell you and the supervisory authority as the law requires.

9. Cookies and storage on your device

We use only cookies that are needed for Companion to work, so we do not ask for cookie consent:

Your browser also keeps unfinished invoice and waybill drafts in its local storage until you finish or clear them. The mobile app keeps its sign-in in the phone's secure storage and a copy of recently viewed data for offline use (see section 7). We use no analytics, advertising or third-party cookies, and our fonts are served from our own servers.

10. Your rights

Under Georgia's Law on Personal Data Protection and, where it applies, the GDPR, you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it;
• give you your data in a machine-readable format;
• stop using it where we rely on legitimate interests.

Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before. Write to otto@nextis.ge from the email address on your account (we may ask you to confirm your identity). We aim to reply within 10 working days.

You can also complain to the Personal Data Protection Service of Georgia (personaldata.ge) or, if you are in the EU/EEA, to your local data protection authority.

11. Deleting your account or data

• To delete your account, open Settings → Delete account — on the web or in the mobile app — and confirm with your password (and your authentication code, if two-step sign-in is on). It is deleted at once, you are signed out everywhere, and we confirm by email.
• Companies that only you belong to are deleted with your account (section 7 explains what happens to their data). If you are the only owner of a company where other people still work, make someone else its owner, or remove the company, first. From a company where others carry on, only your access is removed.
• We keep no personal data from a deleted account except a one-way fingerprint of its email address. It can't be turned back into the address; it only lets us confirm the deletion if you ask us about it later, and it is erased once none of the companies you belonged to remain in Companion. Records that belong to a company you worked in — its documents, activity log and AI Accountant history — stay with that company.
• A company's owner can cancel or delete the company in Companion under Settings; section 7 explains what happens next. You can also ask us at hello@nextis.ge to delete a company's data, including the copies kept for a returning company, at any time.
• You can stop Companion's access to RS.ge at any time by disabling its service user in the RS.ge portal.

12. Children

Companion is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect children's data; if we learn that we have, we delete it.

13. Changes to this policy

We will post any change on this page with a new date. If a change is significant, we will tell you by email or in the app before it takes effect.

14. Contact

Nextis Georgia LLC, Kobuleti 19, 0179 Tbilisi, Georgia · otto@nextis.ge