NxtLayer IT ("NxtLayer IT," "we," "us," "our") is a Microsoft-focused IT services firm based in Phoenix, Arizona. We provide Microsoft 365 security assessments, Zero Trust and Cloud PC deployments, managed IT services, and the Autobots Suite of software products.
This policy covers nxtlayeritcloud.com, our free Microsoft 365 security assessment, our scheduling and contact forms, and our client portal. Your use of this site and our services is also governed by our Terms of Service. Individual Autobots Suite products are governed by their own product terms, linked in the footer of this page.
This policy explains what we collect, why, who we share it with, and what you can do about it. If anything here is unclear, email us and we will answer in plain language.
We only collect what a form actually asks for. We do not buy contact lists and we do not enrich your record with purchased third-party data.
| Where | What we collect |
|---|---|
| Free assessment request | First and last name, work email, company name, company size, industry, which Microsoft products you use, your primary concern, phone number (optional), and your consent to be contacted. |
| Contact forms | Name, email, company, and the content of your message. Partnership and service inquiries use the same form. |
| Threat briefing and newsletter | Company, email, phone, and industry. |
| Booking a call | Name, email, and anything you enter in the booking questions. Scheduling is handled by Calendly, and the meeting is added to our calendar. |
| Client portal | Your login email, your organization, and the service records, documents and tickets associated with your account. |
| Email and phone | Whatever you choose to tell us when you contact us directly. |
Fields marked optional on a form are genuinely optional. You can request an assessment without giving us a phone number.
This site uses Cloudflare Web Analytics, which is privacy-first and does not use cookies, does not fingerprint visitors, and does not track you across other websites. It records aggregate page views, referrer, approximate country, and browser and device type. We use it to understand which pages are useful, not to identify individuals.
Our hosting provider, Cloudflare, also keeps standard server and security logs that include IP addresses. These exist to deliver the site, block attacks and prevent abuse.
This site loads fonts from Google Fonts. When your browser requests those fonts, your IP address is visible to Google. We do not control that and we receive nothing from it.
We run no advertising retargeting and no session-replay recording on this site. There is no Meta pixel and no advertising audience building. We do use Google Analytics, loaded through Google Tag Manager, to see which pages bring people in and which calls to action work. We use it to improve the site, and we do not sell what it collects.
This is the most sensitive information we handle, so we are specific about it.
Our free 48-hour assessment reviews the security posture and configuration of your Microsoft 365 or Azure environment. Access is read-only. We request the minimum permissions needed to read configuration, and we do not request the ability to change anything.
We do not read the contents of mailboxes, files, documents, chats or meetings. We review how your tenant is configured, not what your people write or store in it.
Findings are compiled into a report for you. We treat assessment output as confidential. We do not publish it, share it with other clients, or use it in marketing without your written permission. If we ever want to reference your results in an anonymized form, we will ask first.
Access is granted by you and can be revoked by you at any time from your Microsoft 365 admin center. Revoking access immediately ends our ability to read your environment.
This site uses analytics cookies. Google Analytics sets a small number of first-party cookies, with names beginning _ga, which give your browser a random identifier so that repeat visits are not counted as new people. They are not used for advertising. We set no advertising or cross-site tracking cookies of any kind.
Blocking storage in your browser will not break reading this site, but the portal cannot keep you signed in without it.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have never done so and this policy would have to change before we could.
If you ask for an assessment, we will contact you about that assessment and related services. If you ask us to stop, we will stop.
We share information with service providers who help us run the business, and only so they can perform that function for us.
| Provider | What it handles |
|---|---|
| Cloudflare | Website hosting, security, and privacy-first analytics |
| Formspree | Delivers website form submissions to our inbox |
| Calendly | Meeting scheduling and booking details |
| Airtable | Client records and service history behind the client portal |
| Microsoft | Our own email and productivity systems, and the Microsoft 365 environments we assess and manage for clients |
| Serves the web fonts used on this site, and provides website analytics through Google Analytics and Google Tag Manager |
We may also disclose information when the law requires it, when we need to enforce our agreements, or to protect the rights, safety and property of NxtLayer IT, our clients or the public. If NxtLayer IT is ever involved in a merger, acquisition or sale of assets, client and contact information may transfer as part of that transaction, and we will give notice before it becomes subject to a different privacy policy.
We work with law firms, healthcare organizations and financial services firms. When we provide services to those clients, we may encounter information subject to HIPAA, the Gramm-Leach-Bliley Act, state breach notification laws, or professional confidentiality obligations.
That information belongs to our client, not to us. We handle it under the terms of our services agreement with that client, including a Business Associate Agreement where HIPAA applies. In those engagements we act on our client's instructions, this policy is secondary to the signed agreement, and we do not use client data for our own purposes.
If you are an individual whose information is held by one of our clients, contact that organization directly. We will refer your request to them.
When we no longer need information, we delete it or remove its connection to you.
We apply to ourselves the practices we recommend to clients: multi-factor authentication on administrative accounts, least-privilege access, encryption in transit, limiting who can reach client data, and vendors who can meet a security standard.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your information, we will notify you and the relevant authorities as the law requires and tell you what we know.
Regardless of where you live, you can ask us to:
Email info@nxtlayeritcloud.com and we will respond within 30 days. We will not charge you for a reasonable request and we will not treat you differently for making one. We may need to verify your identity before acting, particularly where a request involves a client environment.
Some states give residents additional rights, including California, Colorado, Connecticut, Virginia, Utah and Texas. Those rights commonly include access, correction, deletion, portability, and the right to opt out of sale, sharing or targeted advertising.
We extend the rights in Section 11 to everyone who asks, which covers the substance of those laws. Because we do not sell personal information or share it for targeted advertising, there is nothing for you to opt out of on this site. If you believe your state grants you a right we have not honored, contact us and we will address it.
This is a business-to-business service and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.
This site links to other sites, including our Autobots Suite products and our scheduling page. Once you leave nxtlayeritcloud.com, this policy no longer applies. We encourage you to read the privacy policy of any site you visit.
We may update this policy as our services change or as the law requires. The Effective Date at the top always reflects the current version. If we make a change that materially affects how we handle your information, we will give notice on this site and, where we hold your contact details and the change warrants it, by email.
Questions about this policy, or a request about your information:
Third-party privacy policies referenced above: Cloudflare, Formspree, Calendly, Airtable, Microsoft, Google.