Privacy Policy

Next Level Builders ("NLB", "we", "us") operates nextlevelbuilder.io and is responsible for the personal data described here. Questions or requests: hello@nextlevelbuilder.io.

This policy covers the website, memberships, courses, the Build with Us directory, Studio, the API, the MCP server and our emails. Payments are handled by Polar as merchant of record, which is responsible for the payment data it collects under its own privacy policy.

Account data:

• Name, email address and profile picture from Google or GitHub when you sign in with them, plus the provider's account identifier
• Your email address and a short-lived one-time code when you sign in by email
• Session records (sign-in time, IP address and browser user agent) that keep you signed in and protect your account

Profile and community data:

• Profile details you add, such as bio, links and social handles
• Answers to the membership information and commitment forms
• Your Discord user ID when you link Discord, so we can assign your membership role

Purchase data:

• From Polar: customer ID, name, email, country, plan or course purchased, amount, currency and subscription status
• We never receive your full card number or bank details

Content you submit:

• Product listings, Studio pages, images and videos you upload, votes and other contributions

API and connected apps:

• API keys, stored only as a SHA-256 hash
• OAuth and MCP client registrations, consent records and access tokens for apps you connect

Usage data:

• Pages viewed (path only), the referring site's origin and clicks on product website links, linked to a random visitor ID that lives in your browser tab (see section 5)
• Through Google Analytics: pages visited, approximate location derived from your IP address, device and browser type and how you arrived, linked to the _ga cookie identifier (see section 5)

Security data:

• IP address and request metadata processed by Cloudflare to deliver the site, rate-limit abuse and run Turnstile bot checks

• To provide the services you ask for: accounts, memberships, courses, directory listings, Studio and the API (performance of a contract)
• To review membership applications and enforce the community policies (contract and legitimate interests)
• To send sign-in codes, purchase-related notices and important service emails (contract)
• To keep the services secure, prevent fraud, spam and ranking manipulation (legitimate interests)
• To screen product submissions: an AI model running on Cloudflare Workers AI flags possible spam or abuse for our reviewers, and a person makes every publishing decision (legitimate interests)
• To measure aggregate traffic and show product owners their traffic statistics (legitimate interests)
• To keep records required by law, for example for tax (legal obligation)

We only send marketing emails if you opt in, and you can unsubscribe at any time.

We share personal data only with providers that help us run the services, under agreements that limit their use of it:

• Cloudflare: hosting and content delivery (Workers), database (D1), file storage (R2), key-value storage, queues, AI moderation (Workers AI), bot protection (Turnstile) and course video delivery (Stream)
• Polar: merchant of record for payments, subscriptions, invoices and taxes
• Resend: delivery of sign-in codes and transactional email
• Google and GitHub: sign-in, only when you choose them
• Google Analytics 4 (Google LLC): aggregate website analytics
• PostHog (PostHog Inc., US cloud): product analytics on nextlevelbuilder.io, including page views, clicks, performance, errors and session replays with every typed input masked; signed-in members are linked to their account ID, email and name
• ClickHouse: product traffic statistics for the Build with Us directory, stored with hashed visitor IDs
• Discord: assigning your membership role when you link Discord

Public by design: your public builder profile, published product listings, vote counts and leaderboard positions are visible to everyone.

We do not sell or rent your personal data. We may disclose data if the law requires it or to protect the rights and safety of our members.

Google Analytics:

• We use Google Analytics 4 (Google LLC) to measure aggregate site usage. It sets the first-party cookies _ga and _ga_<container-id>, kept for up to 2 years (see the Cookie Policy).
• We do not load Google Analytics when your browser sends Do Not Track or Global Privacy Control. You can also opt out with Google's Analytics opt-out browser add-on.
• We do not use advertising cookies.

PostHog:

• We use PostHog (PostHog Inc., US cloud) to understand how the site is used: page views, clicks, scroll and time on page, performance (Web Vitals), JavaScript errors and session replays.
• Replays mask everything you type, and query strings are removed on sign-in, account, OAuth and checkout pages. Studio previews are never sent.
• When you are signed in, events are linked to your account ID, email and name; signing out starts a new anonymous ID.
• PostHog runs only on nextlevelbuilder.io and does not load when your browser sends Do Not Track or Global Privacy Control.

Our own traffic counts:

• Product and directory traffic counts set no cookies. Your browser keeps a random ID in session storage, deleted when you close the tab.
• The ID is hashed with a secret before product traffic is stored, and only page paths, referring origins and product link clicks are recorded.
• Sign-in, account, profile, OAuth and checkout success pages, and Studio previews, are never counted.
• If your browser sends Do Not Track or Global Privacy Control, these counts are skipped too.

Our providers may process data in countries other than yours, including the United States and the European Union. Where required, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses.

• Account, profile and content data: while your account is open. When you ask us to delete your account, we delete or anonymise it within 30 days, apart from backups that expire on their normal cycle.
• Purchase records: as long as tax and accounting law requires.
• Sign-in codes: minutes. Expired sessions: removed after they end.
• Traffic statistics: kept in aggregated or pseudonymous form so product owners can see their history.
• Security logs: kept only as long as needed to investigate abuse.

Depending on where you live, you can ask to:

• access a copy of your personal data;
• correct inaccurate data;
• delete your data;
• receive your data in a portable format;
• object to or restrict processing based on legitimate interests;
• withdraw consent where we rely on it.

Email hello@nextlevelbuilder.io from the address on your account. We reply within 30 days and may need to verify your identity. You can also complain to your local data protection authority.

We use HTTPS everywhere, hash API keys, scope OAuth tokens to the permissions you approve, serve private media through signed, expiring links and limit staff access to what each task needs. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.

The services are not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

We will update this policy when our practices change and show the new date at the top. For material changes we will also tell you by email or on the site.

Next Level Builders · nextlevelbuilder.io · hello@nextlevelbuilder.io