Polityka prywatności

Last updated: September 9, 2026

At Next BP, we place great importance on protecting your privacy. This Privacy Policy explains how we collect, use and share information when you use our Excel add-in, Blast Audit (the "Software").

1. Information We Collect

We may collect the following types of information:

• Subscription Information
  When you subscribe to the Software, we collect your name, email address and certain information needed to process your payment, which is handled by our third‑party payment provider Stripe. We do not store your full credit card information; it is processed directly by Stripe in accordance with their own terms and privacy policy.

• Usage Data
  We collect information about how you use the Software (features used, frequency, session duration, technical settings, etc.) as well as processing metadata (for example: number of documents/pages processed, processing time) in order to:

  • ensure billing and track your subscription,
  • improve the Software and monitor its performance,
  • prevent abuse and ensure the security of our services.
    Where possible, this data is aggregated or anonymized.

  On our public website, we use only essential storage by default to run the site, remember your language and consent choices, and protect the service. We do not load non-essential analytics, attribution, or customer messaging trackers before you allow them. If marketing consent is explicitly granted, we may load analytics tools such as PostHog to understand aggregate website usage and campaign performance.

• Documents and Extracted Data
  To provide certain key features of the Software, particularly OCR (Optical Character Recognition) and certain automated analysis features:

  • you may need to select areas of documents locally on your computer ("snipping");
  • images or data extracted via snipping, or full documents that you submit for analysis, are securely transmitted to our servers to be processed;
  • our processing infrastructure is operated on Microsoft Azure (including production hosting in the European Economic Area);
  • OCR and AI-related operations may be executed using Microsoft Azure AI services (including Azure AI Foundry, Azure OpenAI and Azure AI Document Intelligence), acting on our behalf.

  Ephemeral Processing
  The content of your documents is processed on our servers only for as long as necessary to perform the requested task (OCR, matching, analysis, etc.). Processing happens in short-lived contexts that expire automatically. As currently configured, that is one hour for OCR, and at most 48 hours after the task finishes for agent tasks that need to resume. We do not permanently store the content of your documents. An automated purge runs continuously and deletes the content of expired contexts; if an individual deletion fails it is retried on a later pass, so a small delay past expiry is possible. Beyond those contexts we keep no copy, except where temporarily required for technical reasons (caching, operational logging), which are handled securely and regularly purged.

• Feedback
  If you choose to provide feedback, suggestions or problem reports, we collect the information you send to us (message content, email address, etc.).

2. How We Use Information

We use the information we collect for the following purposes:

• to provide, maintain and improve the Software’s features, including processing of submitted documents;
• to manage your account, process your subscription payments via Stripe, and track your subscription;
• to perform requested document processing (OCR, matching, analysis) on our secure Microsoft Azure infrastructure and Azure AI services (including Azure AI Foundry) where applicable;
• to provide technical support and respond to your requests;
• to analyze usage data and processing metadata in order to improve performance, reliability and features of the Software;
• to send you important information about the Software (updates, maintenance, changes);
• to ensure the security of our services and detect and prevent fraud or abuse;
• to comply with our legal and regulatory obligations.

Our legal bases are: performance of a contract for account, subscription and requested document-processing features; legitimate interests for security, service reliability, support and minimal error monitoring; consent for non-essential marketing analytics, attribution and optional public-site messaging where required; and legal obligation for accounting, tax and compliance records.

3. Information Sharing

We do not sell your personal information. We may share certain information with third parties only in the following cases:

• Service Providers
  We rely on third‑party companies to help us provide our services, in particular:

  • Payment Processing
    We use Stripe to securely process your subscription payments. When you make a payment, your information is transmitted directly to Stripe, and its use is governed by Stripe’s own Terms of Use and Privacy Policy. We encourage you to review them.

  • Hosting, OCR and AI Infrastructure
    We use Microsoft Azure and related Azure AI services (including Azure AI Foundry, Azure OpenAI and Azure AI Document Intelligence) to host and operate core backend processing, including OCR and AI-enabled features.

  • Authentication and Identity Management
    We use WorkOS for authentication and organization/identity workflows.

  • Product Analytics
    We use PostHog to process usage events and improve product performance and reliability.

  • Application Monitoring
    We use Sentry to monitor errors and diagnose incidents.

  • Customer Messaging and Support
    We use Intercom to provide in-product messaging and support interactions.

  • Lifecycle Email
    We use Customer.io to send account and subscription lifecycle email (onboarding, trial, and billing) for authenticated customers.

  • AI-assisted Web Research (when enabled)
    We use Exa for web search and external content retrieval used by AI-assisted research features.

  • Depending on configuration, additional providers may assist us with specific operations. We only grant access to information strictly necessary for the relevant task and require appropriate contractual safeguards.

• Legal Compliance and Security
  We may disclose information (including processing metadata or, in exceptional and legally required cases, temporarily held content) if we believe in good faith that such disclosure is necessary to:

  • comply with any law, regulation, legal process, or enforceable governmental request;
  • protect our rights, property or safety, or those of our users or the public;
  • detect, prevent and address fraud, security or technical issues.

3bis. Cloud Storage Connections (Google Drive, Microsoft 365)

If you choose to connect a Google Drive or Microsoft 365 account, Blast Audit accesses your files in read-only mode so that you can browse, search and import documents from Excel. We never create, modify, share or delete files in your cloud storage. You can disconnect the account at any time from your Blast Audit dashboard, or revoke access from your Google or Microsoft account permissions page.

Google user data. Blast Audit’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We request the scope https://www.googleapis.com/auth/drive.readonly. We use it only to list your Drive files and shared drives, search them by name, and download the file you select so that it can be displayed and linked to cells inside your own Excel workbook. We do not use Google user data for advertising, we do not sell it, we do not use it to train artificial intelligence or machine learning models, and we do not transfer it to third parties except as necessary to provide the feature (our hosting provider Microsoft Azure) or as required by law. Access and refresh tokens are encrypted at rest, stored per user, and deleted when you disconnect the account. Imported file content is kept only for the time needed to process it and is then covered by the retention rules in section 7.

4. Data Transfers and Location of Processing

When you use the Software for functions requiring server‑side processing (such as OCR or certain automated analysis features), the relevant data (snipped images, submitted documents and related metadata) may be transferred to and processed on infrastructure operated for NEXT BP on Microsoft Azure, primarily within the European Economic Area (including France Central), as well as by the Sub‑processors listed in this Policy when necessary to provide the service.

We take steps to ensure that such transfers and processing are secure and comply with applicable regulations (in particular the GDPR). Where data is transferred outside the EEA, we rely on appropriate safeguards (such as Standard Contractual Clauses or other valid transfer mechanisms).

5. Data Security

We implement appropriate technical (e.g. TLS encryption for data transfers) and organizational measures to protect your information, whether in transit or on our servers. These measures are designed to protect against unauthorized access, disclosure, alteration or destruction.

We commit to processing the content of your documents only on an ephemeral basis for the task requested. However, no method of transmission or storage is completely secure. You are also responsible for the security of your own IT environment (workstation, network, passwords, etc.).

6. Your Rights

In accordance with applicable law (in particular the GDPR), you have certain rights regarding the personal information we hold about you (account, subscription and usage log data). These rights may include:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability.

You may also lodge a complaint with your local data protection authority.

With respect to the content of processed documents, these rights can only be exercised while a processing context is still live, which is at most 48 hours after the task finishes. Once the context expires the content is deleted and we no longer hold anything to access, rectify or erase, so in practice these rights apply mainly to the other categories of data (account, subscription, usage logs, etc.).

To exercise your rights, please contact us at the address given in Section 9.

7. Data Retention

We retain your personal information (account, subscription, usage logs) for as long as necessary to:

• provide the Software;
• fulfill our contractual and legal obligations (billing, accounting, etc.);
• resolve disputes and enforce our policies.

As stated above, the content of documents submitted for OCR/analysis is held only in short-lived processing contexts. As currently configured these expire after one hour for OCR and at most 48 hours after the task finishes for agent tasks, and an automated purge deletes their content shortly afterwards, retrying any deletion that fails. Nothing durable is kept beyond that. Operational logs containing metadata may be retained for a limited time for security and troubleshooting purposes.

Marketing analytics data, where you have consented to it, is retained only for as long as necessary for aggregate reporting and troubleshooting, and you can withdraw consent at any time from the cookie settings link.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. In the event of any material change, we will inform you through the Software, by email, or by publishing the updated version on our website, indicating the new effective date.

Your continued use of the Software after the effective date of the updated Policy constitutes your acceptance of it.

9. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact us at:

contact [at] blast-audit.com