Privacy Policy
Your privacy and data protection are fundamental to our architecture. This policy details how NextStepApi collects, encrypts, and handles verification traffic.
Information We Collect
We collect information strictly necessary to provide authentic verification endpoints, maintain audit logs, and process billing:
- Account Details: Contact name, business email, mobile phone number, company name, and encrypted login credentials.
- Telemetry & Audit Logs: IP address, timestamp, HTTP request headers, and status codes for latency and security monitoring.
- Billing Records: Transaction IDs, wallet recharge history, and tax invoice metadata.
How We Use Your Information
The data collected is utilized solely for:
- Executing identity, corporate, and vehicle verifications requested via authorized API calls
- Preventing fraudulent queries, unauthorized key usage, and system abuse
- Providing real-time dashboard analytics, error tracing, and monthly account invoices
- Complying with Indian regulatory requirements under statutory authorities
API Payload Handling & Non-Storage
Sensitive citizen payload parameters (such as raw biometric tokens or Aadhaar OTPs) are routed ephemerally to authorized upstream authentication gateways and are never permanently archived on public disk storage.
Storage & Encryption Standards
All gateway traffic is encrypted in transit using industry-standard TLS 1.3 cryptographic protocols with 256-bit keys. Static tokens and API credentials stored in our database utilize salted BCrypt algorithms to prevent credential leakage.
Data Retention Norms
Transaction metadata (request reference IDs, timestamps, response status) is retained for audit trails in compliance with statutory financial regulations for up to 180 days. Accounts may request full data purging upon account closure subject to statutory audit minimums.
Third-Party Sharing
We only share verification payloads with authorized upstream providers (such as UIDAI ecosystem intermediaries, GSTN, NSDL, or licensed NBFC banking rails) to execute the verification requested by your authorized application.
Cookies & Console Sessions
We employ secure HTTP-only cookies strictly for session authentication when you log into our management console. We do not run third-party advertising tracking cookies.
Grievance Officer & Inquiries
In accordance with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, you may contact our designated Grievance Officer:
Grievance Officer • NextStepApi
NextStepApi Technologies Pvt Ltd • Support & Compliance Cell