Privacy
Privacy policy
How NxtLab collects, uses and protects personal information.
- NxtLab Innovations
- Last updated: November 2026
Privacy Policy
NxtLab Innovations & EchoX
Last updated: November 2026
1. Introduction
NxtLab Innovations ("NxtLab", "we", "us" or "our") respects your privacy and is committed to protecting personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This Privacy Policy applies to NxtLab, its websites, consulting and training services, and its AI-powered products and services, including EchoX.
EchoX is owned and operated by NxtLab Innovations. This policy applies to both nxtlab.com.au and echox.com.au, including associated applications, services and customer interactions.
We aim to be transparent about what information we collect, how it is used, where it is processed and the choices available to individuals.
2. Information We Collect
Depending on how you interact with us, we may collect the following categories of information:
Contact and business information
Names, email addresses, telephone numbers, organisation names, job titles and other information provided through enquiries, registrations or business communications.
Account and subscription information
Account registration details, authentication information, workspace configurations, subscription information and service preferences required to provide and administer our services.
Payment and identity verification information
Billing and transaction information associated with subscriptions and purchases. Payments and, where required, identity verification are processed through Stripe.
Website and service usage information
Technical and usage information such as device type, browser information, IP address, pages visited, service interactions and diagnostic information used to operate, secure and improve our services.
Customer-provided content
Information uploaded, entered or otherwise provided to EchoX, including knowledge base documents, configuration information, conversations and other content processed through customer workspaces.
This information may include personal information depending on the content provided by customers and their users.
3. How We Use Information
We collect and process information for purposes including:
- Responding to enquiries and providing requested information.
- Delivering consulting, training and professional services.
- Creating, managing and supporting customer accounts and subscriptions.
- Operating, maintaining and improving EchoX and other NxtLab services.
- Processing payments and conducting identity verification where required.
- Providing AI-powered responses and functionality requested by customers.
- Monitoring service performance, security and reliability.
- Meeting legal, regulatory and contractual obligations.
We use personal information only for legitimate business and service-related purposes, or otherwise as permitted or required by law.
We do not sell, rent or trade personal information to third parties.
4. EchoX Customer Data and AI Processing
EchoX processes information provided by customers to deliver AI-powered functionality, including knowledge retrieval, conversational assistance and related services.
Customer data and workspace separation
Customer knowledge bases, configuration information and conversation data are maintained within their respective customer tenant boundaries.
EchoX is designed to maintain separation between customer workspaces and prevent unauthorised access to information belonging to other customers.
Use of customer content
Customer-provided content is processed for the purpose of delivering the services and functionality requested by the customer.
We do not use customer-uploaded content to train shared AI models.
Customer content may be processed by third-party AI service providers where necessary to generate responses or deliver requested functionality, subject to applicable contractual and data protection arrangements.
Customer responsibilities
Customers are responsible for ensuring they have appropriate authority to provide personal information to EchoX and for informing their own users about relevant data collection and processing activities.
Where NxtLab processes personal information on behalf of a customer, the respective responsibilities of NxtLab and the customer may also be governed by applicable service agreements.
AI-generated outputs
AI-generated responses may be based on information supplied by customers, their users and authorised knowledge sources.
Customers should apply appropriate human oversight when using AI-generated outputs for decisions that may materially affect individuals.
5. Data Security
We take reasonable technical, organisational and administrative measures to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure.
These measures may include access controls, authentication, workspace separation, secure infrastructure and appropriate oversight of third-party service providers.
Access to personal information is restricted to authorised personnel and service providers where required for legitimate operational purposes.
Although we take reasonable steps to safeguard information, no internet-based service or electronic storage system can guarantee absolute security.
6. Third-Party Service Providers
We use trusted third-party providers to support the operation and delivery of our services.
These may include:
- Firebase (Google): Authentication and account management.
- Stripe: Payment processing and identity verification.
- OpenAI: AI model services and related processing.
- Google Cloud Platform: Cloud hosting and infrastructure.
These providers may process personal information as necessary to deliver their respective services.
We take reasonable steps to assess and manage third-party data handling arrangements, including relevant contractual protections and security practices.
Third-party providers may also have their own privacy policies governing information they process.
7. Stripe Payments and Identity Verification
We use Stripe to process subscription payments and, where required, verify customer identity.
Payment card details and related billing information are handled by Stripe in accordance with its privacy policy.
Where identity verification is required, Stripe may collect information including names, contact details, addresses, identity document images, facial images, identification numbers, device information and fraud prevention signals.
Stripe may use this information to provide identity verification, fraud prevention and related services. Depending on the verification process, individuals may also be offered choices concerning the use of their information to improve Stripe's verification technology.
Stripe retains certain verification information in accordance with its own policies and applicable legal obligations.
For further information, including available privacy choices and deletion requests, please refer to:
8. Overseas Processing and Disclosure
Some personal information may be stored, processed or disclosed to service providers located outside Australia, including in the United States.
Our overseas-based service providers may include Google, Stripe and OpenAI.
We take reasonable steps to ensure overseas disclosures are managed consistently with our obligations under Australian privacy law, including through appropriate contractual, technical and organisational safeguards.
Overseas recipients may be subject to different privacy laws and legal obligations from those applicable in Australia.
Where required, we will provide additional information about relevant overseas processing arrangements or obtain consent in accordance with applicable law.
9. Cookies and Website Analytics
Our websites may use cookies and similar technologies to support website functionality, analyse traffic, improve performance and understand how visitors interact with our services.
Information collected may include browser type, device information, IP address, pages visited, time spent on pages and other technical or usage information.
Some of this information may constitute personal information.
You can manage or disable cookies through your browser settings, although doing so may affect certain website or service features.
10. Data Retention and Deletion
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, provide our services, meet contractual obligations or comply with applicable laws.
Retention periods may vary depending on the type of information and the services involved.
Customer account information, EchoX knowledge base content, conversation records and related service data may be subject to different retention arrangements.
When information is no longer required, we take reasonable steps to securely delete or de-identify it, unless retention is required or permitted by law.
Customers may request deletion of eligible account information or customer-provided content, subject to contractual, technical and legal requirements.
Certain information, including billing and transaction records, may need to be retained for taxation, accounting, regulatory or compliance purposes.
11. Access, Correction and Privacy Requests
Individuals may request access to personal information we hold about them or ask us to correct information that is inaccurate, incomplete, outdated or misleading.
Requests for deletion or other privacy-related assistance will be considered in accordance with applicable law and contractual obligations.
Where information is processed by EchoX on behalf of a business customer, we may need to refer a request to that customer or coordinate with them before taking action.
To make a privacy-related request, please contact:
We may need to verify your identity before processing certain requests.
12. Automated Decision-Making
Our AI services may assist customers with information retrieval, analysis, recommendations and other automated functions.
The extent to which AI-generated information is used in business decisions depends on how customers configure and use the services.
Where applicable, we will provide information about automated decision-making involving personal information in accordance with Australian privacy law.
Customers remain responsible for appropriate oversight of decisions made using AI-generated information, particularly where those decisions may significantly affect individuals.
13. Children's Privacy
Our websites and services are not directed at, or intended for use by, children under the age of 18.
We do not knowingly collect personal information directly from children through our services.
If you believe a child has provided personal information without appropriate authorisation, please contact us at support@echox.com.au so we can investigate and take appropriate action.
14. Privacy Complaints
If you have concerns about how we collect, use, store or disclose personal information, please contact us using the details below.
We will review privacy complaints and respond within a reasonable timeframe.
If you are dissatisfied with our response, you may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
Further information is available at:
15. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes to our services, technology, business practices or legal obligations.
The latest version will be published on our websites with an updated revision date.
Where changes materially affect how personal information is handled, we will take reasonable steps to provide additional notice where appropriate.
16. Contact Us
For questions, privacy requests or complaints relating to NxtLab or EchoX, please contact:
NxtLab Innovations
Email: support@echox.com.au
Websites: https://nxtlab.com.au and https://echox.com.au