Privacy Notice

NextStep, trading as Prido AI, is a consulting and advisory firm based in India and the data controller for the personal data described here — we decide why and how it is processed. You can contact us about privacy at support@pridoai.com or through our contact page.

• Account data (name, email address, login identifiers, Google sign-in profile) — to create and secure your account and give you access to what you bought. Legal basis: performance of our contract.
• Assessment answers and business context (industry, team size, tools, processes, revenue bands you enter) — to score your AI readiness and generate your report. Legal basis: performance of our contract.
• Contact and enquiry data (name, email, company, mobile number, WhatsApp number, message) — to reply to you, deliver reports and book calls. Legal basis: contract, or consent where you opt in to WhatsApp follow-up.
• Order data (products purchased, order and transaction references, entitlements) — to fulfil purchases and keep records. Legal basis: contract and legal obligation. Card and billing details are collected and processed by Razorpay, our payment processor, not by us.
• Technical and usage data (IP address, device and browser information, pages viewed, error logs, approximate country used to select your checkout currency) — for security, fraud prevention, troubleshooting and improving the product. Legal basis: legitimate interests.
• Marketing communications — only where you have opted in or where we have a related business relationship permitted by law. You can unsubscribe at any time.

• Payment processor: Razorpay, for processing payments, subscription billing and invoicing. We are the seller of record; Razorpay handles card data on our behalf.
• Service providers / subprocessors: hosting and database providers, email delivery, AI model providers used to generate report narrative, and support tooling. They act on our instructions under contract.
• Professional advisers: legal, accounting and audit advisers where needed.
• Authorities: where we are legally required to disclose, or to protect our rights.

We do not sell personal data.

We operate in India and the United States and use providers that may process data outside your country. Where data leaves the UK or EEA we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

Account, assessment and report data is kept while your account is active and for up to 24 months after your last interaction, so you can revisit past reports. Enquiry data is kept for up to 24 months. Order records are kept for as long as tax and accounting law requires (typically 7 years). After that we delete or anonymise the data. You can ask us to delete your data sooner.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. To exercise a right, contact us — we respond within one month. If you are in the UK or EEA you can also complain to your local data protection supervisory authority; in India you may contact us as our grievance point of contact.

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls in our database, authenticated access to reports, least-privilege service credentials and audit logging of privileged actions.

We use essential cookies and local storage to keep you signed in, remember your progress through a questionnaire and secure checkout. Our payment provider sets cookies needed to complete a purchase. We do not use advertising cookies. Where we use analytics it is limited to aggregate product usage. You can clear or block cookies in your browser settings, though essential cookies are required for sign-in and checkout to work.

We may update this notice; the “last updated” date above always reflects the current version. Material changes will be highlighted on this page.