Privacy Policy
Last updated: October 24, 2026
This policy explains how personal data is processed when you visit this website and when you use the NextCRM app.
Controller
Michael Papst
Viktor-Franz-Straße 24
8051 Graz
Austria
info@nextcrm.ai
This website
- Hosting and server logs: when you open a page, the web server processes your IP address, date and time, requested page, referrer and browser information to deliver the page and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Logs are deleted after at most 6 weeks.
- Web analytics only with your consent: if you accept “Statistics” or “Marketing” in the cookie banner, this website loads Google Analytics and Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure how visitors use the website and our advertising. They use cookies and process your IP address, device and browser data and the pages you visit; data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021), which you can withdraw at any time with effect for the future via “Cookie settings” at the bottom of every page. Without consent, nothing is loaded from Google Analytics or Google Tag Manager. Fonts come from our own server. Google reCAPTCHA is loaded only when you start filling in the waitlist form (see Waitlist below).
- Language preference: if you close the language suggestion, this choice is stored in your browser's local storage only on your device.
- Beta tester applications: if you apply as a beta tester, we process your name, e-mail address, company (optional), role, team size, current CRM (optional), your CRM and testing experience, devices, areas of interest, languages, available time, your motivation and the versions of the consent and terms you accepted, to select testers and to contact you about the beta program (your consent, Art. 6(1)(a) GDPR, and steps before a contract at your request, Art. 6(1)(b) GDPR). Spam protection works as for the waitlist (see below). The application is stored in the website's own database in the EU; you and we receive a confirmation e-mail. If you are not selected, your application is deleted 30 days after our decision, and at the latest 180 days after you applied if no decision was made. You can withdraw your consent at any time by e-mail.
- E-mail: if you write to us, we process your message and address to answer your request (Art. 6(1)(b) and (f) GDPR).
- Sign-up links pass the selected language, plan and campaign parameters (utm_*) to the NextCRM app so that your registration starts with the right settings.
- Waitlist: if you join the waitlist, we process your name, e-mail address, language, the page and campaign parameters (utm_*) you signed up with, and the time and text version of your consent, in order to send you a confirmation e-mail (double opt-in) and – after you confirm – news about the NextCRM launch (consent, Art. 6(1)(a) GDPR). To prevent abuse, the server also processes your IP address for rate limiting (legitimate interest, Art. 6(1)(f) GDPR). Only a keyed hash of the IP address and browser is stored; rate-limit records are deleted after 2 days, and sign-ups that are not confirmed are deleted after 30 days. You can withdraw your consent at any time with the unsubscribe link in every e-mail; we then stop sending launch e-mails. The waitlist is stored in its own database on this website's server in the EU, separate from the NextCRM app, and the e-mails are sent from that server. If you have accepted “Spam protection” in the cookie settings, the waitlist form uses Google reCAPTCHA v3 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to keep bots out: it is loaded once you start filling in the form; Google then processes technical data such as your IP address, browser details and how you interact with the page, may store data in your browser for this purpose and may transfer data to Google LLC in the USA (EU-US Data Privacy Framework). Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021), which you can withdraw anytime via “Cookie settings”. Without this consent, reCAPTCHA is not loaded and the form is protected by our own checks only. Google's privacy policy applies: https://policies.google.com/privacy
The NextCRM app
When you use the NextCRM app, the following privacy notice from the app applies:
1. Information We Collect
We collect information you provide directly to us, such as when you create an account, update your profile, or use our interactive features.
2. How We Use Information
- Provide, maintain and improve our services.
- Process transactions and send related information.
- Send technical notices, updates, and support messages.
- Detect, investigate and prevent fraudulent transactions.
3. AI Processing Transparency
NextCRM is an AI-first platform. By using our service, you acknowledge:
- Data is sent to LLM providers for processing.
- Vector embeddings are stored for semantic search.
- Voice data is processed for transcription and synthesis.
- We do not sell your data to third parties.
4. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing.
5. Your Rights
You have the right to access, correct, or delete your personal data. You can export your workspace data at any time from the settings menu.
6. Changes to Policy
We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page.
Service providers used by the app
Depending on the features you enable, the app works with these providers:
- Hosting: servers in Germany (EU) – application, database, file storage, search index
- Sign-in: Google, Microsoft (OAuth)
- Payments: Stripe
- AI: Google Gemini, OpenAI, Anthropic, xAI – managed by NextCRM or with your own key
- Voice: Google Gemini (speech recognition and speech synthesis)
- Messaging you connect: Twilio (SMS), Meta (WhatsApp, Facebook, Instagram), Telegram, your e-mail provider
- Forms: Google reCAPTCHA (optional, per form)
- Address suggestions: Google Maps (Places), only when you enter an address in a profile, the workspace profile or lead details (optional)
- Mailbox and calendar connections you enable: Google Workspace (Gmail + Calendar), Microsoft 365 (Outlook + Calendar)
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can withdraw any consent at any time with effect for the future, without affecting the lawfulness of processing before the withdrawal. To exercise your rights, contact us at info@nextcrm.ai. You also have the right to lodge a complaint with a supervisory authority; in Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.