Privacy Policy
Last updated
NexusPortal is a white-label CRM that agencies use to run their clients' contacts, conversations, pipelines and calendars. This policy explains what personal data we handle, why, and the choices you have. It is written for the agencies that sign up with us, their staff, and visitors to this website.
1.Who we are
In this policy, “we” and “us” mean NexusPortal and the team that runs it. We decide how personal data is used for the accounts agencies open with us and for this website, so for that data we are the controller.
Agencies also use NexusPortal to manage data about their own clients and those clients' customers. For that data the agency is the controller and we act on its instructions as a processor. If your details are in an agency's workspace, that agency's privacy notice applies, and requests about your data should go to them first — we will help them answer.
2.What we collect
Account information
Your name, email address and role, and the agency and sub-accounts you belong to. Passwords are held by our authentication provider in hashed form; we never see them.
Agency information
Business name, workspace address and any custom domain, logo and brand colour, and the plan you are on.
Billing information
Payments are taken by Stripe. We receive customer and subscription identifiers and payment status — never your full card number.
Workspace content
The contacts, conversations, opportunities, appointments and notes that live in the CRM your workspace is connected to. We fetch and display them, and keep a backup copy of contact records (name, email, phone, company and address) so agency admins can recover a contact that was removed from the CRM.
Calls
When you place a call from the browser we log the number dialled, the caller ID used, the outcome and the duration. If the agency or sub-account has switched recording on, our telephony provider records the call.
Connected accounts
Google Calendar, if you connect it (see Google user data), and any social accounts a sub-account connects for posting.
Technical data
Our hosting provider processes IP addresses and request logs to deliver and secure the service. We do not use analytics or advertising trackers.
3.How we use it
- To provide the service: signing you in, syncing with the CRM and calendar, and showing your workspace.
- To bill for subscriptions and, where a workspace uses prepaid calling, to measure the minutes used.
- To send service email such as invitations and password resets, in the agency's name.
- To keep the service secure, prevent abuse, and keep each agency's data separate from every other.
- To answer support requests and meet our legal obligations.
We do not sell personal data, and we do not use it for advertising.
Where data protection law asks for a legal basis, ours are: performing our contract with you; our legitimate interest in running a secure, reliable service; compliance with legal obligations; and your consent, for optional cookies.
4.Google user data
When you connect Google Calendar we ask Google for your basic profile and email address, permission to manage calendar events, and read-only access to your list of calendars. We use them to identify the connected Google account, let you choose which calendar to sync, and keep appointments in step between the CRM and that calendar, in both directions.
We do not request access to Gmail, Drive or Google Contacts. Tokens are encrypted at rest, and disconnecting the calendar revokes our access at Google.
NexusPortal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7.How long we keep it
We keep account and workspace data for as long as the agency's account is open. Backed-up contacts are kept even after they are removed from the CRM, so they can be recovered; an agency can ask us to delete them at any time.
When an account closes, we delete or anonymise its data within a reasonable period, except records we must keep by law — invoices and payment records, for example.
8.Security
Data is encrypted in transit. Access tokens for connected services are encrypted at rest, and every request is checked against the agency it belongs to, which keeps each agency's data separate. No system is perfectly secure, but if a breach affects your data we will tell you as the law requires.
9.International transfers
Our providers may process data outside your country, including in the United States. Where the law requires it, these transfers are covered by safeguards such as the European Commission's Standard Contractual Clauses.
10.Your rights
Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict how we use it, and withdraw consent you have given. You can also complain to your data protection authority.
To use any of these rights, email support@nexusportal.digital. We will respond within one month. If your data sits in an agency's workspace, contact that agency — we will pass on anything sent to us.
11.Children
NexusPortal is a business tool and is not meant for anyone under 16. We do not knowingly collect their data.
12.Changes to this policy
When this policy changes we will update the date at the top. If the change is significant, we will email account owners before it takes effect.
13.Contact
Questions about this policy or your data: support@nexusportal.digital. See also our Terms of Service.