Privacy Policy

1. Who we are

The Services are provided by the NextGen group. The company responsible for your information depends on where you are:

In this policy, “NextGen”, “we”, “us” and “our” mean whichever of those companies is responsible for your information.

2. Our role: controller or processor

This distinction decides who you should contact about your information, so it is worth being precise about it.

• We are the controller for the information we collect about you as a customer, user or website visitor — your account details, your billing details, your use of the Services, and the technical data described in section 3. This policy applies to that information, and you should contact us about it directly.
• We are a processor for the personal data you put into the platform about your own contacts, customers, patients, members or clients. You are the controller of that data: you decide what to collect and why. We process it only on your instructions. Our processing of it is governed by our Data Processing Agreement, not by this policy — and if one of your contacts wants their data corrected or deleted, they should ask you, and we will assist you.

3. What we collect

Information you give us

• Account and profile details — your name, business name, email address, telephone number, language, and the country and currency of your account.
• Credentials — your password (stored only as a salted hash, never in readable form), API keys (stored only as a hash), and multi-factor authentication settings.
• Billing details — your billing address, tax identifiers, and which payment method you use. Card numbers are entered directly with our payment providers and are not stored on our servers.
• Communications — the content of support requests, chat and emails you send us.

Information we collect automatically

• Usage and technical data — IP address, device and browser type, pages and features used, timestamps, referring page, and error and performance diagnostics.
• Security and audit records — sign-in events, access and permission changes, and a record of who accessed or changed data and when. These are kept for security and to demonstrate compliance.

Information we do not collect

• We do not buy personal information from data brokers.
• We do not sell or share personal information for cross-context behavioural advertising, and we do not use advertising or cross-site tracking cookies on our websites or in the platform.
• We do not use the personal data in your account to train artificial-intelligence models (see section 11).

4. How we use it

5. Our lawful bases

Where the GDPR or the UK GDPR applies, we rely on:

• Performance of a contract (Article 6(1)(b)) — to provide the Services you have signed up for.
• Legal obligation (Article 6(1)(c)) — tax, accounting, and responding to lawful requests.
• Legitimate interests (Article 6(1)(f)) — securing and improving the Services, preventing abuse, and our own direct marketing to business customers. We balance those interests against your rights, and you may object at any time.
• Consent (Article 6(1)(a)) — for marketing where consent is required, and for any optional cookies. You may withdraw consent at any time without affecting what we did before you withdrew it.

We do not use your information for automated decision-making that produces legal effects about you, or that similarly significantly affects you, without human involvement.

6. Cookies and similar technologies

We use a small number of cookies and browser-storage entries. We use no advertising cookies and no cross-site tracking. The categories are:

Your browser lets you block or delete cookies, but blocking the strictly necessary ones will stop you being able to sign in. Our marketing website sets no tracking cookies of its own, and the web fonts it uses are served by our own content-delivery provider, so loading a page does not disclose your IP address to a third-party font service.

7. Who we share it with

We share personal information only as described here.

• Our service providers (sub-processors). Hosting, backup storage, content delivery, messaging and voice transmission, mapping, and artificial-intelligence inference. The complete current list, with where each one processes data and the legal mechanism we rely on, is on our sub-processor page. Each is bound by a written contract that requires it to protect your information and to act only on our instructions.
• Payment providers. Card and direct-debit payments are processed by Stripe, PayPal, GoCardless, NMI or Authorize.net. They receive what is needed to process the payment and handle it under their own privacy terms.
• Professional advisers — lawyers, auditors and insurers, where necessary and under confidentiality.
• Authorities, where the law requires it — including in response to a lawful request from a court, regulator or law-enforcement body. Where we are permitted to tell you, we will, and we disclose only the minimum necessary.
• A buyer, in a corporate transaction — if we are acquired or merge, information may be transferred as part of that transaction, under this policy.

We never sell your personal information.

8. Where your data is held, and international transfers

Our platform runs as self-contained regional deployments. Your account data and its backups are held in the region you select — United States (Virginia), European Economic Area (Frankfurt), United Kingdom (London), Canada (Montreal), Singapore or Australia (Sydney). The United States, European Economic Area and Australian regions are live today; the United Kingdom, Canada and Singapore regions are rolling out, and a region becomes selectable for new accounts once its infrastructure is live. Account data is backed up within its own region in all three live regions — the United States (Virginia), the European Economic Area (Frankfurt) and Australia (Sydney). We do not replicate account databases between regions, with one exception: a small number of features move data between regions when you ask them to (passing a contact to a sub-account in another region, escalating a support ticket to a parent account and returning the escalation state, and recording a child account's sale against a parent). Those transfers happen on your instruction and are described in full in clause 10.7 of the Data Processing Agreement.

Some of our service providers are outside your region. Those transfers are protected by:

• a European Commission adequacy decision — which covers transfers within the EEA and to the United Kingdom;
• the EU Standard Contractual Clauses, together with the UK Addendum modifications where they apply; and
• the EU–US Data Privacy Framework, where the provider is certified under it.

Countries where recipients are likely to be located. For the purposes of APP 1.4(e) of the Australian Privacy Act, and equivalent disclosure requirements, our recipients are likely to be located in: the United States (artificial-intelligence inference, messaging and voice, mapping, and providers' global infrastructure); the European Economic Area (hosting and content delivery); the United Kingdom (our own UK establishment and our group); and Australia (hosting of the Australian region). Account data for the Australian region is stored and backed up in Australia. As the United Kingdom, Canada and Singapore regions go live, recipients will also be located in those countries. Our content-delivery provider operates a global edge network, which may cache static assets in Singapore, Japan and other edge locations; and our messaging and voice providers operate in the other countries in which their services run. The country for each provider is listed against its name on the sub-processor page.

Where you connect a third-party service yourself — an integration you add, a webhook, an API call or an export — that transfer is yours and you are responsible for it. This includes messaging and email connections you set up with your own credentials (for example Twilio, TextGrid, SendGrid or Mailgun) and social, advertising or workspace connections you enable (for example Meta, Slack, Telegram or Google). We are not a processor or sub-processor for those services, they are not covered by our Data Processing Agreement, and their security, retention, location and onward transfers are matters between you and that provider. Our own messaging and voice transmission uses our own contracted providers, which are listed on the sub-processor page.

9. How long we keep it

• Account and profile data — while your account is active, and afterwards for as long as we need it to meet legal, tax and accounting obligations.
• Deleted accounts — when an account is deleted, we remove its database directory, destroy its encryption key so any surviving copy is unreadable, and purge its backups. This runs on a daily schedule for accounts that have been deleted for more than thirty (30) days.
• Backups — account data may remain in backups for up to thirty-five (35) days after deletion, during which it is isolated, access-restricted and used only for disaster recovery.
• Audit and security logs — at least twelve (12) months, and longer where needed for a security investigation or a legal obligation.
• Support communications — for as long as needed to resolve the matter and for our records.

10. How we protect it

• Isolation. Every account has its own physically separate database, so customers never share tables with each other.
• Encryption at rest. The most sensitive fields — contact field values flagged as encrypted, including email addresses and telephone numbers, and channel and payment-gateway credentials — are encrypted with AES-256-GCM using a unique key for each account. Disk volumes are encrypted as well.
• Key management. A master key held in HashiCorp Vault Transit wraps each account's key and never leaves the key service. Keys are rotated at least annually and destroyed when an account is deleted.
• Encryption in transit. TLS 1.2 or higher for everything you send us, and an encrypted private network between our own servers.
• Access control and monitoring. Role-based permissions, per-account authorisation checks, multi-factor authentication, hashed API keys, least-privilege access to production, and audit logging of access and changes.
• Operations. Hardened and sandboxed services, a default-deny firewall, intrusion prevention, controlled releases with rollback, continuous backup with tested restores, and an incident-response plan reviewed and exercised at least annually.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant regulator as the law requires.

11. Artificial intelligence

Some features use artificial intelligence — conversational assistants and AI agents, AI-assisted voice interactions, AI-assisted page, email and form building, and image generation. When you use them:

• We tell people when they are talking to an AI. Where a feature interacts directly with a person, it discloses that at the start of the interaction.
• We mark AI-generated content — including generated images — as artificially generated in a machine-readable format.
• We do not train models on your data. Your personal data, and your customers' data, are not used to train, fine-tune or improve any artificial-intelligence model.
• Inference runs with zero retention. Our primary text-inference provider operates under contractual zero data retention — prompts and outputs are not kept after the response is returned.
• AI is decision support, not the decision maker. Our AI features do not make decisions that produce legal effects about a person, or that similarly significantly affect them, unless you deliberately configure them to and have satisfied yourself that you have a lawful basis and have made the disclosures the law requires. Where you act on AI output, human review is your responsibility.
• Do not send sensitive information to an AI feature unless your agreement permits it and you have the appropriate configuration and consents in place.

In Australia, APP 1.7 requires organisations to disclose in their privacy policy the kinds of automated decisions they make that significantly affect individuals, and the kinds of personal information used. Our platform performs automated processing such as engagement scoring, lead classification and segmentation, and supports AI-driven agents. Where you use those functions to make decisions about individuals, you are the decision-maker, and you are responsible for that disclosure in your own privacy policy and for any human review. We provide the platform-side information you need in order to make it.

12. Your rights, and how to use them

To exercise any right, email legal@mail.thenextgencrm.com. We will verify your identity before acting, and we respond within the period the applicable law allows — normally one month under the GDPR, and 30 days under the Australian Privacy Act. There is no charge unless a request is manifestly unfounded or excessive.

If you are in the EEA or the UK

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate or incomplete.
• Erasure — deletion, where we have no overriding legal reason to keep it.
• Restriction — we pause processing while a dispute is resolved.
• Portability — your data in a structured, machine-readable format.
• Objection — including to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — at any time, where we rely on consent.
• Rights about automated decisions — not to be subject to a decision based solely on automated processing that produces legal effects about you or similarly significantly affects you.

If you are in Australia

• Access to the personal information we hold about you (APP 12).
• Correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13).
• Complaint to us, and then to the Office of the Australian Information Commissioner (section 14 below).
• Anonymity and pseudonymity where it is practicable for us to deal with you that way.
• Not to receive direct marketing — you can opt out at any time, and our emails include a working unsubscribe facility.

Where you are a contact of one of our customers rather than our own customer, we are a processor: we will forward your request to that customer, assist them in responding, and tell you that we have done so.

If you are in the United States

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and equivalent laws in other states, you may have the right to know what personal information we collect and how we use and disclose it, to request a copy or deletion, to correct inaccurate information, to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not use it to build advertising profiles. We will not discriminate against you for exercising these rights. You may use an authorised agent to make a request; we may require proof of authorisation. Some information is exempt, for example information we hold in order to provide the Services to a business customer.

13. Children

The Services are business tools, and accounts are not available to anyone under 18. We do not knowingly collect personal information from children as a controller. If you are a customer and you collect information about children through the platform, you are responsible for obtaining any consent or authorisation the law requires — including under the Children's Online Privacy Code once it is registered under the Australian Privacy Act — and for the safeguards that apply. You should not use our AI features to interact directly with a child without taking the steps you consider necessary.

14. Complaints

Please contact us first at legal@mail.thenextgencrm.com — most concerns can be resolved quickly. You also have the right to complain to a regulator:

• EEA — the supervisory authority in the country where you live, work, or where the alleged infringement happened.
• UK — the Information Commissioner's Office.
• Australia — the Office of the Australian Information Commissioner, at oaic.gov.au or 1300 363 992.

Our representatives and data protection contact

• Data protection contact: Andrew Hewerdine, Chief Executive Officer — legal@mail.thenextgencrm.com.
• European Union representative (Article 27 GDPR): Andrew Hewerdine (legal@mail.thenextgencrm.com) is our representative under Article 27 GDPR, established in a Member State of the European Union. NextGen OS LLP is established in the United Kingdom and is not established in the European Union, and a representative under Article 27 must be established in a Member State; that appointment is in place. You can contact our EU representative at the address above.

15. Changes to this policy

We may update this policy to reflect changes to our practices, the Services, or the law. We will revise the “last updated” date, and if a change materially affects you we will give notice in the product or by email before it takes effect. Where the law requires your consent, we will ask for it.

16. Contact

Questions about this policy, or about how we handle your information:

NextGen — Legal & Compliance
Email: legal@mail.thenextgencrm.com

NextGen OS, Inc.
30 North Gould Street, Ste R
Sheridan, WY 82801
United States

NextGen OS LLP
128 City Road
London, EC1V 2NX
United Kingdom

For the data protection terms that apply when you are the controller and we are your processor, see our Data Processing Agreement and our sub-processor list.