Privacy Policy

1. Introduction

This Privacy Policy explains how Nexcrest IT LLP (“Nexcrest,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use the Nexera CRM product, websites, applications, and related services (the “Service”).

By using the Service, you acknowledge this Privacy Policy. If you do not agree, please do not use the Service.

2. Who we are

Nexcrest provides a cloud-based CRM (Customer Relationship Management) subscription for organizations to manage leads, contacts, follow-ups, sales activities, and related CRM workflows.

Controller / business contact: Nexcrest IT LLP
Email: info@nexcrestit.com
Phone: +91 80759 59947
Address: 2nd Floor, Aroma Building, Opposite Kia Showroom, Athanikkal, West Hill, Kozhikode, Keralam 673005

For CRM subscription payments, Paddle acts as Merchant of Record and processes buyer payment data under its own privacy policy.

3. Information we collect

3.1 Information you provide

Account and profile details (name, email, password or authentication data, organization name)
Billing and CRM subscription details needed to manage your plan (billing contact, company details; payment card data is handled by Paddle)
CRM content and records you or your users enter into the Service (Customer Data), which may include personal data about your own leads, contacts, customers, or other people you store in the CRM
Support communications and feedback

3.2 Information collected automatically

Log and usage data (IP address, device/browser type, pages viewed, feature usage, timestamps)
Cookies and similar technologies used for authentication, preferences, security, and analytics
Diagnostic and performance information related to errors and reliability

3.3 Information from third parties

Payment and subscription status from Paddle
Data from Facebook, Instagram, and WhatsApp when your organization connects them, as described in section 4
Other optional integrations you enable (for example email, messaging, or identity providers), subject to those providers’ policies

4. Data from Meta platforms (Facebook, Instagram, and WhatsApp)

Nexera CRM can connect to Meta Platforms, Inc. (“Meta”) products. We receive data from Meta only when an administrator of your organization chooses to connect your Facebook Page, ad account, or WhatsApp Business number, and only for the permissions they approve.

4.1 What we receive

Connection details: the name and ID of the Facebook user who connected the account, the Pages, ad accounts, and WhatsApp Business accounts they choose, and the access tokens Meta issues for them.
Facebook and Instagram Lead Ads: the lead forms on your connected Pages and the answers people submit in them (such as name, phone number, email address, and any other questions on your form), with the campaign, ad set, ad, and form each lead came from.
Ad performance: names and IDs of your campaigns, ad sets, and ads, with spend, impressions, and clicks, so you can see what each lead cost.
WhatsApp Business: your business phone number and account details, message templates, and the messages exchanged between your business and the people who contact it, including their WhatsApp phone number and profile name, attachments they send, and message delivery and read status.

4.2 How we use it

To place leads from your forms into your CRM, assign them to your team, and show where they came from.
To let your team read and reply to WhatsApp conversations, send the message templates you create, and turn conversations into leads.
To show ad spend and cost-per-lead reports for your own ad accounts.
If your organization turns on the Conversions API feature, to tell Meta when a lead from your ads reaches a stage you choose (for example “qualified”). We send only the Meta lead ID, the event name, and the time. We do not send names, phone numbers, or email addresses.
If your organization turns on AI reply suggestions for WhatsApp, to send the conversation text to the AI provider your organization has configured, only to draft a reply.

We use Meta data only to provide these features to the organization that connected it. We do not sell it, use it for our own advertising, use it to build profiles of individuals, or share it with other customers or with data brokers. Our use of data received from Meta follows the Meta Platform Terms and Developer Policies.

4.3 Where it is kept

Each organization’s Meta data, including its access tokens, is stored in that organization’s own database, separate from every other customer’s, and is available only to that organization’s authorized users and to the Service.

4.4 Disconnecting and deleting

An administrator can disconnect Facebook or WhatsApp in Nexera CRM at any time. We delete the access tokens straight away, and the Service stops exchanging data with Meta for that connection.
You can also remove Nexera CRM from your Facebook account under Settings & privacy → Settings → Business integrations.
Leads and conversations already imported stay in your CRM as Customer Data until your organization deletes them or closes its account (see Retention).
Step-by-step instructions are on our Data Deletion Instructions page.

4.5 People who contact our customers

If you filled in a lead form or sent a WhatsApp message to a business that uses Nexera CRM, that business controls your data and we process it on its behalf (see section 7). Please contact that business about your data. If you cannot reach them, contact us and we will pass your request on.

5. How we use information

We use personal information to:

Provide, operate, secure, and improve the Service
Create and manage accounts, tenants, seats, and CRM subscriptions
Process subscription transactions and send billing-related notices (often via Paddle)
Provide customer support
Communicate product updates, security notices, and (where permitted) marketing messages
Detect, prevent, and investigate fraud, abuse, and security incidents
Comply with legal obligations and enforce our Terms of Service

6. Legal bases (where applicable)

If you are in a region that requires a legal basis for processing (such as the EEA/UK), we typically rely on:

Contract: to provide the Service you requested
Legitimate interests: to secure, improve, and administer the Service
Consent: where required (for example certain cookies or marketing)
Legal obligation: where we must retain or disclose information by law

7. Customer Data and roles

When your organization uses Nexera CRM, you (the customer) generally control Customer Data uploaded into your CRM tenant, including leads and conversations received from connected platforms such as Facebook, Instagram, and WhatsApp. In that case:

You act as the data controller (or equivalent) for Customer Data
We act as a data processor / service provider processing Customer Data on your instructions to provide the Service

You are responsible for ensuring you have a lawful basis to collect and process personal data within your tenant, and for responding to requests from individuals whose data you control.

We may share personal information with:

Service providers who help us host, operate, support, or analyze the Service (under contractual confidentiality and security obligations)
Paddle, for payment processing and tax compliance
Meta, only when your organization uses a Meta feature that sends data back to Meta, such as sending WhatsApp messages or Conversions API events (see section 4)
Professional advisors (legal, accounting) when needed
Authorities, when required by law, court order, or to protect rights, safety, and security
A successor entity in connection with a merger, acquisition, or asset sale

We do not sell personal information for money. We do not share Customer Data with unrelated third parties for their own marketing.

9. International transfers

We may process and store information in countries other than where you live. Where required, we use appropriate safeguards for cross-border transfers (for example contractual protections).

10. Retention

We retain personal information only as long as needed for the purposes described in this Policy, including:

While your account is active
For billing, accounting, dispute, and legal compliance periods
For backup and security retention windows

Meta access tokens are deleted as soon as the connection is removed. When Customer Data is no longer needed, or after account closure, we delete or anonymize it within 30 days of a verified request or account closure, unless law requires longer retention. Copies in backups are overwritten within 90 days.

11. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including keeping each organization’s data in a separate database, encrypting data in transit, and limiting staff access. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

You are responsible for protecting account credentials and configuring user access within your organization.

12. Cookies

We use cookies and similar technologies for:

Essential session and authentication functions
Remembering preferences
Security and abuse prevention
Analytics and product improvement (where enabled)

You can control cookies through your browser settings. Disabling essential cookies may break parts of the Service.

13. Your rights

Depending on your location, you may have rights to:

Access personal information we hold about you
Correct inaccurate information
Delete information
Restrict or object to certain processing
Data portability
Withdraw consent where processing is based on consent

To exercise these rights for account information we control, contact us at the email below. For Customer Data stored in a tenant, contact the organization that administers that tenant first; we may need to redirect your request to them. To delete data, see our Data Deletion Instructions.

You may also have the right to lodge a complaint with a data protection authority.

14. Children’s privacy

The Service is intended for business and organizational use and is not directed to children under 16 (or the age required in your jurisdiction). We do not knowingly collect personal information from children for our own purposes.

15. Third-party links and integrations

The Service may link to or integrate with third-party sites and services. Their privacy practices are governed by their own policies. We encourage you to review those policies before using those services, including Meta’s Privacy Policy and WhatsApp’s Business Policy if you connect those services.

16. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Where required by law, we will provide additional notice.

17. Contact

For privacy questions or requests:

Company: Nexcrest IT LLP
Email: info@nexcrestit.com
Phone: +91 80759 59947
Address: 2nd Floor, Aroma Building, Opposite Kia Showroom, Athanikkal, West Hill, Kozhikode, Keralam 673005