Next Heights CRM logo Next Heights
Legal

Privacy Policy

Last updated: July 12, 2026

Your trust matters to us. This policy explains what we collect and how we protect it.

This Privacy Policy explains how Next Heights (“Next Heights”, “we”, “us”, “our”) collects, uses, shares, stores, and protects information in connection with the Next Heights CRM website, applications, and services (the “Service”). It applies to visitors, account holders, and Authorised Users. By using the Service you acknowledge the practices described here. This Policy forms part of, and should be read together with, our Terms & Conditions. Capitalised terms not defined here have the meaning given in the Terms.

1. Scope of this policy

This Policy covers information we process as a business (a “data fiduciary” / controller) about our own users and visitors, and information we process on your behalf (as a “data processor”) when you use the Service to manage your customers’ and leads’ data. Where we act as a processor, you are responsible as the controller for the lawful basis, notices, and consents for the data you upload.

2. Information we collect

We collect the following categories of information:

  • Account & identity data: name, business name, email, phone number, role, and login credentials;
  • Billing data: GSTIN, billing address, transaction records, and limited payment metadata (full card details are handled by our payment processors, not stored by us);
  • Customer Data you upload: leads, contacts, property details, notes, tasks, messages, and files you or your Authorised Users add to the Service;
  • Usage & log data: pages viewed, features used, actions taken, timestamps, and diagnostic logs;
  • Device & technical data: IP address, browser type, operating system, device identifiers, and approximate location derived from IP;
  • Cookies & similar technologies: as described below;
  • Communications: messages, support requests, and feedback you send us.

3. How we collect information

We collect information directly from you (when you register, subscribe, or contact us), automatically (through your use of the Service and through cookies and similar technologies), and from third parties (such as payment processors, analytics providers, and integration partners) where you have authorised such sharing or where permitted by law.

4. Cookies and similar technologies

We and our service providers use cookies, local storage, and similar technologies to keep you signed in, remember preferences, secure the Service, measure performance, and understand usage. Some cookies are strictly necessary for the Service to function; others are analytical or functional. You can control cookies through your browser settings, but disabling some may impair functionality.

5. How we use information

We use information to:

  • Provide, operate, maintain, secure, and improve the Service;
  • Create and administer your Account and authenticate users;
  • Process payments, billing, invoicing, and renewals;
  • Provide customer support and respond to your requests;
  • Send service, security, and transactional communications;
  • Send product updates and marketing where permitted, subject to your opt-out;
  • Monitor, detect, prevent, and address fraud, abuse, security incidents, and technical issues;
  • Develop new features and generate aggregated, de-identified analytics; and
  • Comply with legal obligations and enforce our Terms.

Where required by Applicable Law (including the Digital Personal Data Protection Act, 2023), we rely on lawful bases such as your consent, performance of a contract, our legitimate business interests, and compliance with legal obligations.

6. WhatsApp and third-party processors

The Service integrates with third parties, including WhatsApp / Meta, payment gateways, cloud hosting, email, and analytics providers, who process information on our behalf or as independent controllers. Your use of messaging features is subject to the relevant provider’s terms and policies. We share only the information necessary for these services to function and require our processors to protect the information they handle.

7. Sharing and disclosure

We do not sell your personal data. We may share information with: (a) service providers and sub-processors who help us operate the Service under confidentiality obligations; (b) payment processors to complete transactions; (c) professional advisors, auditors, and insurers; (d) authorities, courts, or parties where required by law, legal process, or to protect our rights, safety, or property; and (e) an acquirer or successor in the event of a merger, acquisition, financing, reorganisation, or sale of assets, subject to this Policy.

8. International data transfers

We and our providers may store and process information in India and in other countries. Where information is transferred across borders, we take steps to ensure an adequate level of protection consistent with Applicable Law. By using the Service you understand that your information may be processed in locations outside your own country.

9. Data retention

We retain personal data for as long as your Account is active and for a reasonable period thereafter as needed to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Customer Data you upload is retained per your instructions and our Terms; after termination we may delete it in the ordinary course, subject to legal requirements. Aggregated or de-identified data may be retained indefinitely.

10. Security

We implement reasonable technical and organisational measures designed to protect information against unauthorised access, loss, misuse, or alteration, including encryption in transit, access controls, and monitoring. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and for the security practices of your Authorised Users.

11. Your rights

Subject to Applicable Law, you may have the right to access, correct, update, or delete your personal data, to withdraw consent, to object to or restrict certain processing, to request portability, and to lodge a complaint with a supervisory authority. To exercise these rights, contact us at the address below; we may need to verify your identity and may retain certain information where required by law. Where we process data on your behalf as a processor, requests from your customers should be directed to you as the controller.

12. Data of your customers and leads

When you upload data about your own customers, leads, or contacts, you act as the controller and we act as the processor. You represent and warrant that you have provided all required notices and obtained all required consents for that data, and that our processing on your behalf is lawful. You will indemnify us for claims arising from your failure to do so, as set out in the Terms.

13. Marketing communications

We may send you marketing communications about our products and offers where permitted. You can opt out at any time using the unsubscribe link or by contacting us. We will still send you non-promotional service and transactional messages necessary to operate your Account.

14. Children

The Service is intended for business use by adults and is not directed to individuals under eighteen (18). We do not knowingly collect personal data from children. If we learn that we have collected such data without appropriate consent, we will delete it.

15. Automated processing

Certain features may use rules-based or automated processing (for example, lead scoring or property matching) to help you work more efficiently. These features are decision-support tools; you remain responsible for decisions you make using the Service.

16. Third-party links

The Service may contain links to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their policies before providing information.

17. Data breach

In the event of a personal-data breach that is likely to result in risk to affected individuals, we will take appropriate steps and, where required by Applicable Law, notify the relevant authority and/or affected persons within the applicable timeframes.

18. Changes to this policy

We may update this Policy from time to time. Material changes will be notified through the Service or by email or by updating the “Last updated” date above. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

19. Grievance officer and contact

For any questions, requests, or complaints about this Policy or your personal data, or to reach our Grievance Officer under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, contact us at [email protected]. We will endeavour to respond within the timeframes required by Applicable Law.

Questions about this policy? Email [email protected] or message us on WhatsApp.

Privacy Policy · Terms & Conditions · Refund Policy