Privacy Policy

What We Collect

Anonymous analytics. We collect page views, button clicks, scroll events, and session duration using two analytics tools. PostHog runs only after you accept the cookie banner; it assigns a random identifier (no name, email, or precise location) so we can tell returning visitors from new ones. Google Analytics 4 (GA4) measures aggregate traffic and, unlike PostHog, is governed by Google Consent Mode: it runs by default and stops setting analytics cookies only if you decline the banner (see Cookies and How to Opt Out below). GA4 data is shared with Google, which acts as an independent controller of that data.

Account data. If you create an account, we store your email address, hashed password (or OAuth provider identifier), the timestamp you signed up, and optional preferences (skin type, concern tags, favorited products). Authentication is handled by Supabase.

Marketing consent. If you tick the marketing checkbox at signup, we record the timestamp of your consent on your profile. We do not build a browser fingerprint or collect any health information. We do not log or store your IP address ourselves; Google Analytics briefly processes it to derive approximate (city-level) location and does not expose it to us.

Why We Collect It

To understand how people use nextbest so we can improve the experience, to give you a personalized concern list, and (only with your consent) to send occasional marketing email about new product picks and skincare guides. We don't sell data and we don't use it for advertising.

Third Parties

We use the following sub-processors:

• PostHog — anonymous product analytics. posthog.com/privacy
• Google Analytics 4 (Google LLC) — aggregate traffic analytics, governed by Google Consent Mode. policies.google.com/privacy
• Supabase — authentication and database hosting (US region). supabase.com/privacy
• Vercel — web hosting and CDN. vercel.com/legal/privacy-policy
• Amazon Associates and Awin (Stylevana) — outbound affiliate-link networks. When you click a “buy” link we redirect you through the relevant network so a purchase can be attributed to us; the network, not nextbest, then handles your visit. See our Affiliate Disclosure for details.

Cookies

We use the following cookies:

• Analytics (PostHog) — set only after you accept the cookie banner. Used to identify returning sessions.
• Analytics (Google Analytics 4) — set by default under Google Consent Mode and used to measure aggregate traffic. If you decline the cookie banner, Consent Mode denies analytics storage so GA4 does not set these cookies.
• Authentication (Supabase) — set when you log in so we can keep you signed in. Required to operate the account features you opted into.
• Preferences — a small localStorage entry stores your cookie-banner choice so we don't prompt you on every visit.

How to Opt Out

When you first visit the site, you'll see a banner asking about cookies. Click “Decline” to opt out of analytics — this stops PostHog and, via Google Consent Mode, denies Google Analytics its analytics storage as well. You can also clear your browser's cookies and localStorage for this site to reset your preference. To unsubscribe from marketing email, click the unsubscribe link in any marketing message or email kayleigh@nextbest.one.

Email Marketing

We send marketing email only if you have given separate, explicit consent at signup (the dedicated marketing checkbox, distinct from your acceptance of the Terms). Transactional emails (password reset, account confirmation, account-change notices) are sent regardless of marketing preference because they relate to a service you have requested. We keep marketing-consent timestamps on your profile as proof of opt-in. You can revoke consent at any time via the unsubscribe link in any marketing email, which is honored immediately.

Your Rights (GDPR / UK GDPR)

If you are in the EEA, the UK, or Switzerland, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — ask us to delete your account and associated personal data (“right to be forgotten”).
• Portability — receive your data in a machine-readable format.
• Objection / restriction — object to or restrict processing.
• Withdraw consent — for any processing based on consent (e.g. marketing email, analytics cookies), at any time.
• Complain to your local data-protection authority.

To exercise any of these rights, email kayleigh@nextbest.one. We will respond within 30 days.

Your Rights (California: CCPA / CPRA)

If you are a California resident you have the right to know what personal information we collect, to request deletion of it, to correct inaccuracies, and to limit the use of sensitive personal information. nextbest does not sell or share personal information for cross-context behavioral advertising as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. You will not be discriminated against for exercising these rights. To exercise them, email kayleigh@nextbest.one.

Data Retention

We keep account data for as long as your account is active. If you delete your account, we erase your profile, favorites, and any feedback you submitted within 30 days. Anonymous analytics events are retained by PostHog for 7 years, and Google Analytics retains its aggregate event data for up to 14 months; neither can be tied back to you after account deletion. Marketing-consent timestamps are retained for the lifetime of your account so we have proof of consent if asked by a regulator.

Children

nextbest is not directed to children under 13. If you believe a child has provided us with personal information, please email kayleigh@nextbest.one and we will delete it.

Changes

We will update the Effective date at the top of this page when we change anything material here. Continued use after a change means you accept the revised Policy.