Privacy Policy

Who we are

Nexelead is a SaaS CRM operated by Devute UK LTD ("we", "us"). Registered in England & Wales. We act as a UK GDPR data controller for your account information and as a data processor for the lead and customer data you load into Nexelead.

What we collect

• Account info: name, email, workspace name
• Billing: Stripe customer id, last-4 card digits (we never see full numbers)
• Usage telemetry: actions per day, last-seen timestamp, errors (no PII)
• Lead + customer data you import or capture (acting as processor)
• Cookies for session + CSRF protection

How we use it

To operate the CRM, send you product emails, process payments, and improve the service. We never sell your data.

Where it lives

All data is stored in Supabase (Postgres) in the EU West 2 (London) region. Backups are also EU-resident. Some third-party processors (Stripe, Twilio, Anthropic, OpenAI, Resend) process data on our behalf with contractual GDPR safeguards.

Your rights (UK GDPR)

• Right of access (Art. 15) — request a copy of your data via your account settings or by emailing the DPO.
• Right to erasure (Art. 17) — request deletion via your account settings or DPO email.
• Right to rectification (Art. 16) — edit or correct your data in-app at any time.
• Right to portability (Art. 20) — export your leads as CSV or full DSAR JSON.
• Right to object — opt out of product emails via the unsubscribe link on every email.

Data Protection Officer: dpo@nexelead.com. We respond within 30 days.

Retention

Workspace owners can configure per-workspace retention windows for activity, emails, chat messages, and inactive leads (Settings → Privacy & GDPR). A daily background job enforces these. Data past its retention window is permanently deleted.

Cookies

We use first-party cookies for authentication and CSRF protection. We do not run cross-site tracking pixels on our marketing pages.

Your cookie consent preference is stored locally in your browser. Reset cookie preferences or return to the landing page to change it or view the banner again.

Changes

We will email account owners about material changes to this policy. The "Last updated" date at the top reflects the most recent revision.

Complaints

If you believe we have mishandled your data, you can lodge a complaint with the UK Information Commissioner's Office.