Privacy Policy.

1. Introduction

NextBelt LLC ("NextBelt," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website smmsapp.com or use our Smart Maintenance Management System ("SMMS") platform.

We process your personal data under one or more of the following legal bases, depending on the context: (a) performance of a contract when you subscribe to or use our Services; (b) our legitimate interests in operating, improving, and securing the Services (balanced against your rights); (c) your consent, where we explicitly request it (e.g., for marketing communications or optional cookies); and (d) compliance with legal obligations. Where we rely on consent, you may withdraw it at any time by contacting privacy@smmsapp.com without affecting the lawfulness of processing before withdrawal.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, company name, job title
• Billing Information: Payment card details (processed by Stripe; we do not store full card numbers)
• Support Communications: Messages, emails, and files you send to our support team
• User Content: Data you enter into SMMS, including work orders, assets, maintenance records, and related documentation
• Photos and Media: Photos you capture or attach as evidence on work orders, inspections, downtime events, and spare-part records (mobile and web)
• Voice Input (ELISA): If you use the ELISA assistant's voice features, the audio you speak and its transcription. Voice audio is processed in real time and is not retained after transcription; see Section 4.1 for how ELISA data is shared with OpenAI

2.2 Information Collected Automatically

• Log Data: IP address, browser type, operating system, referring URLs, pages visited, access times
• Device Information: Device identifiers, mobile device type, operating system version
• Usage Data: Features accessed, actions taken within SMMS, session duration
• Location Data (Mobile): When you use the mobile app's field-capture feature to geotag an asset, we collect the device's precise GPS coordinates at that moment and store them with the asset record. Location is collected only in the foreground, only when you use the geotag feature, and only after you grant the operating system's location permission — never in the background
• Cookies: Session cookies for authentication and functionality (see Section 7)

2.3 Information from Third Parties

• Authentication Providers: If you sign in via Microsoft Azure AD or other identity providers, we receive your name and email
• Business Partners: Company information from referral partners or resellers

3. How We Use Your Information

We use collected information for the following purposes:

We do not sell your personal data to third parties.

4. Data Sharing and Disclosure

We may share your information with:

4.1 Service Providers (Sub-processors)

We maintain Data Processing Agreements (DPAs) with each sub-processor. Enterprise customers may request a copy of our DPA or execute a custom DPA by contacting legal@smmsapp.com.

4.2 Legal Requirements

We may disclose information if required by law, subpoena, court order, or government request.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

4.4 With Your Consent

We may share data for other purposes with your explicit consent.

5. Data Retention

We retain your data according to the following schedule:

Upon account termination, your data is retained in secure archive for up to three (3) years, after which it is deleted or anonymized, except where longer retention is required for legal or compliance purposes. You may request earlier deletion at any time (see Your Rights below).

6. Data Security

We implement industry-standard security measures including:

• Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest
• Access Controls: Role-based access control (RBAC), multi-factor authentication
• Infrastructure: AWS cloud infrastructure with WAF and DDoS protection
• Monitoring: Continuous security monitoring and intrusion detection
• Audits: Annual third-party security assessments

NextBelt has completed a SOC 2 Type II examination, conducted by Advantage Partners, an independent auditor enrolled in the AICPA Peer Review Program, with continuous control monitoring through Vanta. The report covers the Security trust services category and is available to customers on request under NDA.

6.1 Data Breach Notification

In the event of a confirmed data breach affecting your personal data, NextBelt will:

• Notify affected customers without unreasonable delay, and in any event within 72 hours of confirmation
• Provide a description of the nature of the breach, categories and approximate number of records affected, and the likely consequences
• Describe the measures taken or proposed to address the breach and mitigate its effects
• Notify the relevant supervisory authority where required by applicable law

7. Cookies and Tracking

We use the following cookies and tracking technologies:

We do not use third-party advertising or analytics cookies. You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect SMMS functionality.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Restriction: Request limited processing of your data

To exercise these rights, contact us at privacy@smmsapp.com.

9. International Data Transfers

NextBelt is based in the United States. If you access our services from outside the USA, your data will be transferred to and processed in the United States. We rely on standard contractual clauses and other lawful transfer mechanisms for international transfers.

10. Children's Privacy

SMMS is a business-to-business service and is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children.

11. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"):

• Right to Know: You may request the categories and specific pieces of personal information we have collected, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., legal compliance, completing a transaction).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale / Sharing: NextBelt does not sell personal information and does not share personal information for cross-context behavioral advertising as defined by the CCPA.
• Right to Limit Use of Sensitive Personal Information: The sensitive personal information we collect is limited to precise geolocation (only when you use the mobile geotag feature — Section 2.2). We do not use or disclose sensitive personal information beyond what is necessary to provide the Services.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

11.1 How to Submit a Request

To submit a verifiable consumer request, email privacy@smmsapp.com with "CCPA Request" in the subject line. You may also call (915) 235-5225. We will verify your identity by matching information you provide with information we already maintain. You may make a request up to twice in a 12-month period.

11.2 Authorized Agent

You may designate an authorized agent to submit a request on your behalf by providing a signed written authorization or a power of attorney. We may still require you to verify your identity directly.

11.3 Financial Incentives

NextBelt does not offer financial incentives or price differences in exchange for the retention or sale of personal information.

11.4 California "Shine the Light"

Under California Civil Code Section 1798.83, California residents may request information about disclosures of personal information to third parties for direct marketing. NextBelt does not disclose personal information to third parties for their own direct marketing purposes.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending an email notification to account administrators
• Displaying a notice within the SMMS application

The "Last Updated" date at the top indicates when the policy was last revised.

13. Contact Us

For questions about this Privacy Policy or our data practices:

© 2025–2026 NextBelt LLC. All rights reserved.