Privacy Notice
Version 2026-10-12-draft
Who we are
Nexmogen CRM is provided by Nexmogen ([legal entity name and registered address — to be completed]). For your account with us, Nexmogen is the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
Our published business contact address is Ashok Nagar, Noida, Uttar Pradesh, India.
When a business uses Nexmogen CRM to keep records about its own customers and leads, that business decides why and how those records are used. For that data the business is the data fiduciary and Nexmogen processes it on the business’s behalf. Questions about those records should go to the business first.
What we collect about you
- Account details: your name, email address and a protected (hashed) password.
- Workspace details: the organisation name, address and settings you choose, and your role.
- Security records: sign-in times, IP address, browser type and actions such as changing a role, kept to protect your account and investigate misuse.
- Messages we send you: invitations, password resets and service notices, and whether they were delivered.
Why we use it
- To create your account and give you access to your workspaces.
- To keep the service secure, prevent abuse and meet legal obligations.
- To send messages about your account and the service (not marketing).
- To support you when you ask for help.
We rely on your consent, which you give when you create your account, and on legitimate uses allowed by the DPDP Act (such as security and legal compliance). We do not sell personal data.
Who we share it with
Only service providers who help us run Nexmogen CRM, under contract: cloud hosting (Amazon Web Services, United States region during the pilot), web hosting (Vercel), email delivery, and bot protection on the signup page (Cloudflare Turnstile). Nexmogen staff can see a workspace’s records only through time-limited, audited support access that the workspace’s Admins can see and end.
How long we keep it
Account details are kept while you have an account. When a workspace is deleted, its records, files and the accounts that belong only to it are normally scheduled for erasure after a 30-day recovery period. A Super Admin can start permanent deletion earlier for a workspace already scheduled for deletion. Accounts shared with other workspaces and Super Admin accounts are kept. Security records are kept for [retention period — to be decided]. Deleted records may remain in backups until those backups expire.
Your rights
- Get a summary of your personal data and how it is used.
- Correct or update it, and erase it when it is no longer needed.
- Withdraw your consent. This may mean we can no longer provide your account.
- Nominate someone to exercise these rights if you cannot.
- Complain to us, and then to the Data Protection Board of India.
Contact and grievances
Write to our grievance contact at contact@nexmogen.com [name of grievance officer — to be completed]. We reply within 30 days.
You can also contact Nexmogen by phone at +91-8650457900.
Changes
If this notice changes in a way that matters, we will tell you and, where needed, ask for your consent again.