Dealer control includes knowing how information is handled. Here are our launch requirements, what still needs verification, and where to ask questions.
Pre-launch requirements · verification pending
This page describes the standards we are building toward. It does not certify that the product is ready for real customer data. Verification will be published for specific services and workflows.
01 / Data we handle
Start with what you share.
Website beta registration
The signup form collects your name, email, company, dealership type, optional additional information (including estimates) and agreement to beta and launch updates. It records the signup time and consent version to manage your interest in NXTdeal.
Signup notifications containing these details are sent through Resend to NXTdeal’s info@nxtdeal.app inbox, where the founder can review and respond. Use business contact details only. This form does not create a dealership account and does not request customer records, payment details or documents.
For access, correction, deletion or to withdraw contact consent, email info@nxtdeal.app. Investor inquiries collect name, email, firm or organization, background and interest, and separate contact consent. These inquiries are saved with a timestamp and sent through Resend to info@nxtdeal.app for founder review. They do not subscribe you to beta updates. A fixed retention schedule for website inquiries has not yet been published.
Dealership and service records
Dealership-controlled business records are distinct from the account information and operational records NXTdeal needs to run its service.
Before approving customer-data workflows, we will publish their data categories, purposes, authorized access and retention rules. That inventory will cover workspaces, MySales, uploaded documents, integrations, support and logs.
Financial records can remain sensitive even when a Social Security number is incomplete. MySales access, export and staff-departure rules also require an explicit policy.
02 / Protection status
Requirements with a visible status.
These controls are planned launch requirements. Production verification evidence has not been established for this publication, so no control is labeled verified. A verification date will appear when a scoped review is complete.
Product launch requirements — production review pending
Control
Required scope
Status / review
Dealership separation
Workspace records, APIs and AI access must respect dealership boundaries.
PlannedNot yet verified
Role permissions
Staff and service accounts must have only the access their work requires.
PlannedNot yet verified
MFA and recovery
Mandatory multifactor authentication and controlled account recovery.
PlannedNot yet verified
Encryption in transit
Protected connections across supported web, API and integration paths.
PlannedNot yet verified
Stored data and backups
Encryption for stored customer records, documents and backup copies.
PlannedNot yet verified
Logging and monitoring
Traceable access and important changes, with a process to review alerts.
PlannedNot yet verified
Recoverable backups
Encrypted off-server copies and documented restoration checks.
PlannedNot yet verified
Incident response
A documented process to investigate, contain and communicate incidents.
PlannedNot yet verified
Retention, export and deletion
Defined schedules and tested processes for dealer records and service data.
PlannedNot yet verified
Third-party access
Documented permissions and a tested way to revoke connected access.
PlannedNot yet verified
03 / Beta readiness
Approval belongs to the workflow.
Joining the list is available now. It does not open beta access or approve any workflow for real customer information.
Available: beta interest signup
Business contact details and launch-update consent only.
Customer-data readiness: not yet approved here
Workspaces, MySales, finance, document uploads, payments and automated communications need individual readiness decisions before use with real customer data. Use sample data until your workflow is explicitly approved.
Before access opens, we will publish which workflows are approved, sample-only or unavailable. Restrictions must be enforced across the interface, APIs and AI agents; this page is not a technical access control.
04 / Connected services & AI
Your choice of tools. Clear access rules.
NXTdeal supports the approach of bringing your own compatible AI and connected tools. Using your credentials does not remove NXTdeal’s responsibility for the data its platform processes.
Services selected by NXTdeal
Resend handles beta signup and investor inquiry notification emails, including the submitted business contact details and consent record. The full product provider register, including purposes, data categories and processing regions, remains a launch requirement. We are not making provider retention or AI-training assurances before reviewing the applicable configuration and terms.
Services selected by your dealership
Before enabling a connection, you should be able to see the information it can access, the actions it can take and how to revoke it. Those permissions and revocation paths must be documented and tested for each supported connection.
05 / Shared responsibilities
Each side has work to own.
NXTdeal’s responsibility
Protect the platform, enforce dealership boundaries and permissions, define processing commitments, manage selected providers and maintain incident-response procedures.
Your dealership’s responsibility
Authorize staff, share only information you have authority to use, provide required notices and permissions, and meet your marketing, lending and business-record obligations.
Service terms, data-processing commitments and detailed retention policies are being finalized. They will need review before customer-data onboarding, together with a record of the accepted version, date, user and authority to accept.
Tell us which service is involved, what happened and how to reach you. Do not email passwords, credentials or customer documents. We will arrange an appropriate way to share sensitive details if needed.
Our incident-response launch requirements include notifying affected dealerships through their designated account contact. The procedure is being finalized; no response-time guarantee is published.