Privacy Policy

1. Who We Are & Scope of This Policy

NexDial ("we", "us", "our") is a SaaS CRM platform designed for Indian small and medium businesses. We provide lead management, WhatsApp inbox, sales pipeline, call logging, and AI-powered follow-up tools.

This Privacy Policy applies to all users of NexDial — including business owners who sign up ("Workspace Admins"), their team members ("Agents"), and the leads/contacts stored within the platform ("End Contacts"). It covers all data processed through our website, onboarding flow, CRM dashboard, and APIs.

2. What Data We Collect

A. Account & Profile Data

When you sign up, we collect:

• Full name, work email address, mobile number
• Company name, business type, industry, company size
• Job title, time zone, business location
• Profile avatar (if uploaded)
• Google OAuth profile data (if you sign in with Google)

B. Onboarding Configuration Data

During onboarding we collect workspace preferences:

• Business goals and selected lead sources (WhatsApp, Website, Facebook, etc.)
• Sales pipeline stage names
• WhatsApp Business number(s) and support email addresses
• AI & alert notification preferences

C. CRM & Lead Data

Data you or your team enters into NexDial about your business contacts (leads):

• Contact name, phone number, email, company, tags
• Lead status, pipeline stage, assigned agent
• Call logs, activity timeline, notes, follow-up reminders
• WhatsApp conversation history (displayed in inbox)

D. Payment & Billing Data

We do not store your card number, bank account details, or UPI credentials. All payment processing is handled by Razorpay (PCI-DSS compliant). We only store:

• Razorpay Order ID and Payment ID (for verification and receipts)
• Mandate status and subscription plan
• Billing history (plan, amount, date)

E. Technical & Usage Data

• IP address, browser type, device information
• Pages visited, features used, session duration
• Error logs and crash reports (for debugging)

3. How We Use Your Data

We use your data strictly to provide and improve the NexDial service:

• Deliver the Service: Power your CRM dashboard, lead inbox, pipeline, and team features.
• Authentication: Verify your identity on login via NextAuth (email/password or Google OAuth).
• Billing: Process your ₹1 mandate authorization and monthly subscription renewals via Razorpay.
• AI Features: Use your lead interaction data to generate AI-powered follow-up suggestions and lead scores. This processing happens within our platform — your data is never shared with external AI providers for training.
• Notifications: Send you email alerts for follow-up reminders, payment receipts, and trial expiry warnings.
• Support: Respond to your help requests and diagnose technical issues.
• Product Improvement: Analyze aggregated, anonymized usage patterns to improve the platform.

We do not use your data for advertising, profiling for third-party marketing, or selling to data brokers.

4. Who We Share Your Data With

We do not sell or rent your data. We share data only with trusted service providers who help operate NexDial, under strict data processing agreements:

• Supabase / PostgreSQL (Database): Your workspace data, leads, and CRM records are stored in a secure PostgreSQL database hosted on Supabase (AWS infrastructure, ap-southeast-1 region).
• Razorpay (Payments): Payment processing and e-mandate management. Razorpay is PCI-DSS Level 1 certified and RBI regulated. We share only the minimum data required to create and manage your subscription.
• Google (OAuth):If you use "Sign in with Google," Google shares your name, email, and profile picture with us. We do not share your NexDial data back with Google beyond standard OAuth tokens.
• Vercel (Hosting):Our application is deployed on Vercel's edge network. Vercel may process request logs containing IP addresses per their own privacy policy.
• Meta / WhatsApp Business API:When you connect a WhatsApp Business number, messages flow through Meta's API. Message content is subject to Meta's privacy policy.

We disclose data to authorities only if required by law, court order, or to protect NexDial from fraud.

5. Data Storage & Security

All NexDial data is stored in India or AWS ap-southeast-1 (Singapore) region. We implement the following security measures:

• Encryption in Transit: All data between your browser and NexDial servers is encrypted via HTTPS/TLS 1.3.
• Encryption at Rest: Database storage is encrypted at rest by Supabase.
• Password Security: Passwords are hashed using bcrypt (never stored in plain text).
• Access Control: Role-based access control (ADMIN / AGENT) ensures team members only access data relevant to their role.
• No Card Storage: We never store your payment card details — all payment data is handled by Razorpay's PCI-certified vault.

6. Data Retention & Deletion

• Active subscription: Your workspace data (leads, contacts, pipeline, call logs) is retained for the duration of your active subscription.
• After cancellation: We retain your data for 30 days after subscription cancellation, giving you time to export. After 30 days, workspace data is permanently deleted.
• Inactive trial accounts: If no subscription is started after the 15-day trial, your account data is deleted after 60 days of inactivity.
• Activity logs & system logs: Retained for 90 days for debugging and security purposes, then purged.
• Billing records: Invoices and payment references are retained for 7 years as required by Indian GST and accounting regulations.

7. Your Data Rights

Under Indian IT Act and global best practices, you have the following rights regarding your personal data:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate data via your Settings page or by emailing us.
• Deletion: Request full deletion of your account and all associated data. We will process deletion within 7 business days.
• Export: Request an export of your lead and contact data in CSV format from the CRM Settings page.
• Withdraw Consent: Cancel your subscription and Razorpay mandate at any time. Withdrawal does not affect data already processed.

To exercise any of these rights, visit your CRM Settings → Account page or contact us at privacy@nexdial.io. We will respond within 7 business days.

8. Contact Us

If you have any questions, concerns, or requests about this Privacy Policy or how your data is handled, please contact us:

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice in your NexDial dashboard.