Privacy Policy

1. Who we are

NextQom is operated by NextGroup Investment Limited, a private limited company registered in England and Wales under company number 17450986. Registered office: 11 Coniston Road, Blackburn, England, BB1 5PU. In this policy, "NextQom", "we" and "us" mean NextGroup Investment Limited.

Questions about this policy or about your personal data: [email protected].

2. What this policy covers, and our two roles

NextQom is a CRM platform for businesses. Each business that uses it (our customer) gets its own CRM, a client portal for its own clients and, if it chooses, a website we host. This policy covers our website nextqom.com, the NextQom platform (the business addresses under nextqom.com, such as yourbusiness.nextqom.com, and a business's own domain when it points to NextQom), and the portals our customers and partners sign in to.

When we are the controller

We decide how and why personal data is used, and are its controller, for: visitors to nextqom.com; people who book a demo, call us or use Ask Qom AI; the account, contract and billing data of our customers and their users; our partners; and people we send offers or demo briefs to.

When we are the processor

The data a business keeps in its NextQom CRM about its own clients, leads and contacts is that business's data. The business is the controller and decides what is stored and why; we are its processor and use the data only on its instructions, to provide the service, under our data processing agreement with it. If you are a client or contact of a business that uses NextQom, that business's own privacy notice applies, and requests about your data go to it (see Delete your data).

3. What we collect and where it comes from

Booking a demo with the form

What you type: your name, e-mail address and company and, if you give them, your phone number, industry, team size, preferred day and time of day, the language for the demo and a message. With it we receive your time zone as your browser reports it, the time the form was opened (it helps us tell people from bots), your agreement that we contact you about the demo, and your internet address, which is used to limit how often bookings can be sent. The booking goes to our team's console and our team is told by e-mail. If the console cannot take it at that moment, the booking is kept in this website's own database instead.

Calling us from the website

Call us connects your browser to NextQom's AI receptionist, which talks with you and books your demo. The call starts only when you press Call us and allow your microphone, and the call screen tells you that you are talking to an AI assistant and that the call is transcribed to book your demo.

• Your voice is streamed during the call to Google's Gemini service, which turns it into text and produces the assistant's spoken answers. We never store the audio.
• When you book a demo in the call, we keep the booking details you give (as on the form), a short summary of the call, how long it lasted and the words of the call as text. The words of the call are deleted after 30 days at the latest.
• When a call ends without a booking, nothing of what was said is kept.
• Your internet address is used to limit how often one visitor can call. We keep it only as a keyed code (a hash) that cannot be turned back into the address without our secret key, and that code, not your address, is what Google receives as an identifier.
• Nothing about a call is stored in your browser.

Ask Qom AI, the assistant on this website

What you type to Ask Qom AI is sent to Google's Gemini service to produce the answers; we do not keep the conversation. If you book a call with our team through it, we keep what you give for the booking (your name, e-mail address, phone number, business, what you want built and the time you chose) as a pending customer account with the booked call, and our team and you are told by e-mail.

Asking us to build your CRM

The project form asks for your name, business name and e-mail address and, if you give them, your phone number, what you need and a time for a call. Sending it creates a pending customer account for you, and we confirm by e-mail.

Offers and demo briefs we send you

When our team or a partner sends you an offer, we record when you open it and, when you sign, the name you type, the time and your internet address. When we send you a demo brief, we keep the answers you give (for example what your business does, your brand, your current website and links to your material) and pass them to the team building your demo.

Our customers and their users

For a business that uses NextQom and its staff: names, e-mail addresses, phone numbers, roles and sign-in details (passwords are stored only as secure hashes), the business's details and settings, its plan, invoices and payment status, and our correspondence and support conversations with it. Card payments are handled by Stripe; we never see or store full card numbers.

Our partners

For partners who refer customers to us: their account details, referral code, the customers they referred, their commissions, and the bank details they give us for payouts.

Data a business keeps in its CRM

A business uses NextQom to keep data about its own clients, leads and contacts, for example names, contact details, enquiries, bookings, cases and jobs, documents, messages, quotes and invoices. We process it for the business, as its processor (see our two roles).

Technical data

Like any website, our servers record each request: the internet address it came from, the time, the page asked for and the browser's description of itself. Our pages load their typefaces from Google Fonts, so your browser asks Google's servers for them, which shows Google your internet address. We use no analytics, advertising or tracking tools on this website.

4. WhatsApp and Meta

A business can connect its own WhatsApp Business Account to NextQom through Meta's Embedded Signup, so that it can send and receive WhatsApp messages and manage its message templates from its CRM. The sign-in happens in Meta's own window: NextQom never sees the business's Facebook password.

What we receive

• For each connected business: the WhatsApp Business Account id, the phone number id, the number's display name, status and quality rating, the business's message templates, and an access token (a system-user token Meta issues for the business).
• Through the Inbox: the messages the business sends and receives (text and, for received media, the file), the sender's WhatsApp phone number and profile name, and delivery and read receipts.

Why

Only to let the business send and receive WhatsApp messages and manage its templates from its CRM. Nothing else: no advertising, no profiling, no sale, and we do not use the data to train AI models.

Where it is stored and who can see it

In the business's own database on NextQom's servers (one database per business). The access token and the phone number's registration PIN are sealed (encrypted) with a key of that business alone, and are never shown on a screen, written to a log or put in a web address. The staff of that business see the messages according to their role in NextQom. NextQom's own engineers do not read a business's messages; support access is read-only unless the owner of the business allows changes, is recorded, and ends with the session.

Who it is shared with

Meta, because WhatsApp is Meta's channel, and the service providers listed under Who we share data with (hosting, e-mail, and the AI features a business switches on). It is never sold, and never used by another business. Meta is an independent provider and handles WhatsApp data under its own terms: see the WhatsApp Privacy Policy and the Meta Privacy Policy.

How long we keep it

Until the business disconnects WhatsApp (the token, the PIN and the cached templates are deleted at once) or ends its account (the whole database, its files and its keys are deleted after the 30-day grace period of the offboarding). A person's messages are deleted when the business deletes them or asks NextQom to erase that person. The steps are under Delete your data.

5. Google and Microsoft accounts a business connects

A business can connect its own Google or Microsoft accounts to its NextQom CRM. We ask only for the access listed here, only when a user of the business starts the connection, and only after they approve it on Google's or Microsoft's own consent screen.

What we access

• Google Search Console and Google Analytics, read only (webmasters.readonly, analytics.readonly), with the connected account's e-mail address (openid, email): the business's verified sites and their search performance (clicks, impressions, click-through rate, average position, top search queries and pages), and its Analytics properties and website reports (visitors, sessions, engagement, top pages and traffic channels), for the CRM's SEO pages.
• Google Calendar (calendar.events) or Microsoft Outlook calendar (Calendars.ReadWrite), when a staff member connects their own calendar: the events needed to keep their calendar and the CRM in step.
• Gmail (mail.google.com) or Microsoft 365 / Outlook mail (IMAP and SMTP access), when a business connects its mailbox: the e-mails of that mailbox are read into the business's Inbox in the CRM and, if the business chooses, its replies are sent from that mailbox.
• Google Drive, read only (drive.readonly), when a business connects its Drive: the files in the folders it chooses are listed and linked in its CRM. The files themselves stay in its Drive.

How we use it

• To show the business its own search and website figures, calendar, e-mail and files in its CRM, and to send the e-mails its users write.
• When the business asks NextQom for SEO help, to let our team see the same figures and do that work for the business.
• When the business switches on Qom AI's access to e-mail (it is off by default), to send the e-mail conversations a user asks Qom AI about to the AI provider (Google's Gemini service), to answer that user.

We do not sell this data, use it for advertising, use it to build profiles for any other purpose, or use it to train artificial intelligence models. We do not share it with anyone except the service providers that host and run NextQom, or when the law requires it. Our staff do not read it unless the business asks us to (for example for an SEO service request), for security, or to comply with the law.

How it is stored and deleted

• The access tokens are stored encrypted, separately for each business.
• Daily copies of the search and Analytics figures are kept in the business's own database, so its screens never wait for Google.
• Disconnect in the CRM deletes the stored tokens and what the connection set up (for SEO the chosen site and property, for Drive its links and folder mappings). You can also remove NextQom's access at any time at myaccount.google.com/permissions, or in your Microsoft account's app permissions.
• When a business leaves NextQom, this data is deleted with the rest of its data (see How long we keep data).

NextQom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Why we use personal data, and our legal basis

Where UK data protection law (the UK GDPR and the Data Protection Act 2018) or the EU GDPR applies, we rely on these legal bases:

• To arrange the demo or call you asked for and to answer your enquiry: the steps you ask us to take before a contract, and our legitimate interest in answering business enquiries. You also agree that we contact you about the demo, and you can withdraw that at any time.
• To provide NextQom to our customers, run their accounts, support them and bill them: the contract with the customer.
• To credit a partner for a customer they referred: our legitimate interest in running our partner programme.
• To keep our services secure and working (sign-in protection, limits against abuse, logs, investigating problems): our legitimate interest in a secure and reliable service.
• To keep accounting and tax records: our legal obligations.
• To process the data a business keeps in its CRM: the business's instructions, under our data processing agreement. The business decides its own legal basis for that data.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see Your rights). We do not make decisions about you by automated means that have legal or similarly significant effects on you.

7. Who we share data with

We do not sell personal data. We share it only with the providers that help us run NextQom, and when the law requires it:

• Hostinger, whose servers in Malaysia run this website, the NextQom platform and their databases;
• Neon, which hosts the database of this website (enquiries, customer accounts, projects and booked calls);
• Cloudflare, for DNS and the storage of uploaded files;
• Google: Google Workspace for our own e-mail; the Gemini service for Call us, Ask Qom AI and the AI features a business switches on; Google Fonts for this website's typefaces; and the Google services a business connects (see Google and Microsoft accounts);
• Stripe, for card payments;
• Meta, for WhatsApp and Lead Ads, only for a business that connects them (see WhatsApp and Meta);
• Microsoft, only for the Microsoft services a business connects;
• the AI provider a business's Website Studio uses (Anthropic, OpenAI or another provider the business chooses), only when that feature is on; it receives the website brief and the business's public details, never its customer data;
• Twilio, for text messages and calls, only for a business that switches them on.

If you came to us through a partner's referral link, that partner can see your booking and contact details. We may also share data with our professional advisers, and with authorities when the law requires it. A business that connects its own account with a provider (for example its own AI or e-mail account) has its own contract with that provider.

8. International transfers

Our main servers, which run this website and the NextQom platform and hold their data, are in Malaysia, and some of our providers process data in other countries, including the United States (for example Google, Meta, Microsoft and Stripe). Some of these countries are not covered by an adequacy decision of the UK or the EU.

Where the law requires a safeguard for such a transfer, we rely on one the law recognises, such as the standard contractual clauses (with the UK addendum) in our providers' data processing terms, or a provider's certification under the EU-US Data Privacy Framework and its UK extension. You can ask us for details at [email protected].

9. How long we keep data

• The words of a call, as text: 30 days at the most, then deleted automatically. The audio of a call: never stored.
• Demo bookings, enquiries and pending customer accounts (from the form, a call or Ask Qom AI): as long as we need them to arrange the demo and follow up with you, or until you ask us to delete them.
• A customer's account and business data: while the business uses NextQom. When it leaves, it can have an export of its data; the business is then deleted after a 30-day grace period, during which it can still be reactivated.
• WhatsApp data: as described under WhatsApp and Meta.
• Backups: they expire after 30 days, so deleted data is gone from them at the latest 30 days after it was deleted.
• Invoices, payment and accounting records: as long as tax and company law requires.
• Server logs: only as long as needed for security and operations; they are rotated and overwritten.
• The referral cookie: up to 90 days in your browser (see Cookies and browser storage).

10. Security

All connections use HTTPS. Each business has its own database, and every request, job and webhook is bound to one business. Access tokens and other secrets are encrypted with a key of their business. Passwords are stored only as secure hashes. Backups are encrypted. Access is limited to the people who need it, and NextQom's own staff sign in with a second factor.

No system is perfectly secure. If a breach affects your data, we tell you, or the business that holds your data, as the law requires.

11. Your rights

Under UK and EU data protection law you have the right to:

• access the personal data we hold about you and get a copy;
• have it corrected if it is wrong or incomplete;
• have it erased;
• restrict how we use it;
• object to how we use it, including at any time to direct marketing;
• data portability: receive the data you gave us in a common machine-readable format, or have it sent to another organisation;
• withdraw your consent where we rely on it, without affecting what was done before.

To use any of these rights, write to [email protected]. We answer within one month, and may ask you to confirm who you are first. Some rights have limits, for example where the law requires us to keep a record.

If a business holds your data in its NextQom CRM, send your request to that business. If you send it to us, we pass it on to the business and help it answer.

You can complain to the Information Commissioner's Office (ICO), the UK's data protection authority: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the EU or EEA, you can also complain to the data protection authority of your country. We would be glad to try to resolve your concern first.

13. Cookies and browser storage

We use no advertising or analytics cookies and no tracking tools. This is everything this website keeps in your browser:

• nq_ref (a cookie): set only when you arrive through a partner's referral link. It holds the partner's code and the time you arrived, so that the partner is credited if you become a customer. It lasts up to 90 days.
• nq_theme, nq_sound and nq_lang (local storage): your choice of light or dark theme, of sound effects on or off, and of language. They stay until you clear them.
• nq_access_token and nq_refresh_token (local storage): keep you signed in to the client portal, and are removed when you sign out.
• nq_brief_lang (local storage): the language you chose on a demo brief page.
• Booking a demo, calling us and Ask Qom AI keep nothing in your browser.

Loading our typefaces from Google Fonts sends your internet address to Google; it sets no cookies. You can delete everything above in your browser's settings at any time; that signs you out and resets your choices.

14. Children

NextQom is a service for businesses. It is not meant for children, and we do not knowingly collect children's personal data.

15. Changes to this policy

We update this policy when our services or practices change, and show the date of the latest version at the top. Important changes are announced to the businesses that use NextQom. Our Terms of Service are on their own page.

16. Contact

NextGroup Investment Limited (NextQom), 11 Coniston Road, Blackburn, England, BB1 5PU. E-mail: [email protected].