Last updated: February 1, 2026

1. Introduction

This Privacy Policy describes how CREACH AGENCY (SAS, €2,500 capital, RCS Paris 979 948 551, located at 60 rue François 1er, 75008 Paris) collects, uses, and protects personal data through the NEXTLEAD platform.
As a CRM for SMEs (TPE/PME), we understand the critical nature of the data you entrust to us.

2. Roles and Responsibilities

• As a Data Controller: We manage your account data (billing, login, contact).
• As a Data Processor: We process the data you import into the CRM (your leads, your customers). You remain the owner and “Data Controller” of your own client database.

3. Data Collected

A. Account Information

• Identity: Name, professional email, phone number.
• Organization: Company name, VAT number, industry.
• Billing: Transaction history (payment methods are handled securely by Stripe).

B. Connecting Google, Gmail and Google Calendar

Connecting Google is optional. Google presents the requested permissions before you grant them. NEXTLEAD uses your name, email address and the profile information needed to identify the connected account.

Gmail. When you authorize Google email access, NEXTLEAD accesses messages and threads associated with your CRM contacts, including senders, recipients, timestamps, subjects, message content and attachments. This enables you to view conversations and attachments, compose and send messages, reply to threads and mark messages as read. Messages are sent to the recipients you select. The integration does not provide permanent deletion of Gmail messages.

Google Calendar. When you authorize Google Calendar access, NEXTLEAD reads events from your primary calendar associated with a CRM contact’s email address, within three months before and after the date of consultation. Displayed information includes available titles, descriptions, dates, attendees, locations and meeting links. This integration is read-only: it does not create, modify or delete Google Calendar events.

Google Contacts. This connection does not request access to your Google Contacts address book or automatically import it.

Processing and retention. NEXTLEAD servers make requests to Google APIs and display the results in the CRM. NEXTLEAD stores the connected account identifiers, granted permissions and OAuth tokens needed to maintain the connection. Messages sent from NEXTLEAD may also be stored in CRM history, including their content, subject, recipients and sending date. Organization members with the appropriate permissions can access that history. Original messages and events remain in your Google account.

Recipients. Processing uses the NEXTLEAD hosting providers described in the subprocessors section. Sending an email transmits its content and attachments to the recipients you select. The native integration calls Google APIs directly and does not use Unipile. Other integrations activated separately retain their respective operation.

Access controls. You may withdraw NEXTLEAD’s permissions from your Google account’s third-party connections page: https://myaccount.google.com/connections. Withdrawing permissions stops the corresponding Google access. It does not delete original messages or events in Google, or history already stored in the CRM. To request deletion of data retained by NEXTLEAD, contact dpo@nextlead.app.

Limited Use. NEXTLEAD’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. Google data is neither sold nor used for targeted advertising. Human access to Google data requires the user’s explicit agreement for the data concerned, except where necessary for security, legal compliance or other cases expressly permitted by that policy.

4. Purposes and Legal Basis

We process data based on:

1. Contract Performance: To provide the CRM service, support, and billing.
2. Legitimate Interest: To improve platform security and analyze usage to develop new features.
3. Legal Obligation: For tax and accounting purposes.

5. Data Retention & Deletion

• Active Accounts: Data is stored for the duration of your subscription.
• Termination: Upon account closure, data is archived for 30 days and then permanently deleted.
• Financial Records: Kept for 10 years (French law).
• Google tokens: OAuth tokens maintain the authorized connection. Withdrawing permissions from your Google account prevents their use for the revoked access. Deleting your NEXTLEAD account deletes the tokens linked to that account. Disconnecting or revoking access does not itself delete CRM history already stored; deletion can be requested at dpo@nextlead.app.

6. Data Security & Hosting

• Hosting: All CRM databases are hosted by Supabase (AWS/Dublin, Ireland) within the European Economic Area (EEA).
• Encryption: Databases are encrypted at rest. All communications are HTTPS encrypted.
• Isolation: Each customer’s data is logically isolated.

7. Subprocessors (Third Parties)

We only share data with trusted partners under Data Processing Agreements (DPA):

• Hosting: Supabase (EU), Vercel (EU/US).
• Analytics: PostHog (EU-hosted).
• Payments: Stripe.
• Communications: Resend (Email delivery).
• No Selling: We never sell your data or your customers’ data to third parties.

8. User Rights (GDPR)

Under the GDPR, you have the right to access, rectify, or delete your data, and the right to data portability. To exercise these rights: dpo@nextlead.app. You also have the right to file a complaint with the CNIL.

9. Changes to this Policy

Users will be notified via the platform or email at least 15 days before any significant change to this policy.