Privacy Policy

For information about our own customers, users, and website visitors, we decide how the information is used. This Policy applies to that information.

For the contacts, leads, notes, documents, and other content that a customer adds to NextAccord about the people they work with (“Customer Data”), the customer decides why and how it is used, and we process it on the customer’s behalf to provide the Service. If you are a lead or client of a NextAccord customer, that customer’s privacy practices apply to their information about you, and requests about it should be sent to them.

We also use limited email delivery and safety information for our own purposes of honoring opt-outs, preventing abuse, and protecting recipients and the Service, as described below. You may contact us directly about that use using the privacy contact details in this Policy.

Depending on how you use the Service, we collect:

• Account and profile information: name, email address, phone number, role, workspace and business details (such as business name, address, and website), and invitations to join a workspace.
• Billing information: your plan, subscription status, and payment status. Payments are handled by our payment processor, Stripe; we do not receive or store your full card number.
• Customer Data you or your team add: contacts and leads (such as names, email addresses, phone numbers, addresses, lead sources, and preferences), notes and activity history, tasks and reminders, appointments, transactions and commission information, properties and listings, uploaded documents and images, templates, campaigns, marketing materials, Landing Pages, and settings.
• Information from Landing Pages and lead forms: what a visitor submits (such as name, contact details, and message), the page it came from, and technical information such as IP address and browser type used for security and abuse prevention.
• Integration information, when you connect a service: for Gmail and Outlook, the messages you send through NextAccord; basic details of messages between you and people in your contacts (such as sender and recipient addresses, subject, date, and thread identifiers, but not the message body); and lead notification emails that match rules you set up, including the sender, subject, a short preview of the message, and the contact details found in it. To find those lead notification emails, we check the sender, subject, and a short preview of your recent messages against your rules, and we keep only the messages that match. For Google Calendar and Outlook Calendar, the appointments you create and send to your calendar. For Calendly, booking details for appointments you receive. We store the access tokens needed to keep an integration working in encrypted form.
• Usage and device information: pages and features used, actions taken in the Service, timestamps, IP address, browser and device type, and log and diagnostic information.
• Email delivery and safety information: sender and recipient addresses, delivery records and failures, unsubscribe and suppression records, bounce and spam-complaint events, and sending activity and reputation information received from our email providers or recorded by the Service.
• Communications: what you send us when you contact support or submit an inquiry form, including our brokerage inquiry form.

We use information to:

• provide, operate, maintain, and support the Service, including features you turn on such as email, calendar, campaigns, Landing Pages, and reporting;
• create and manage accounts, authenticate users, process payments, and administer subscriptions and trials;
• send service messages such as invitations, notifications, security and billing notices, and responses to your requests;
• keep the Service secure, honor email opt-outs and enforce suppression, assess sender reputation and sending safety, prevent fraud, abuse, and spam, and enforce our Terms;
• understand how the Service is used and improve and develop it;
• communicate with you about the Service, and send product updates where permitted; and
• comply with legal obligations and establish or defend legal claims.

We use Customer Data only to provide the Service to the customer that added it, and for the security, support, and legal purposes described in this Policy.

Some features, such as client summaries, next-action suggestions, follow-up drafts, Notes to Actions, and the in-app support assistant, use AI service providers. When you use one of these features, the information needed for your request, such as relevant contact details, recent activity, tasks, transaction context, and any notes or messages you enter, is sent to the provider to generate a response. A request may be routed through an AI gateway to a model provider.

For AI requests that we route through our AI gateway, OpenRouter, we require that each request be handled only by a model provider endpoint that offers zero data retention, meaning it does not keep your prompt or the response after generating it, and that does not collect the submitted information or use it to train models. If no endpoint meeting these requirements is available, the request fails rather than being sent to a provider that does not. Zero data retention limits what a provider may keep after it responds. It does not mean your information stays within NextAccord: to generate a response, the information in your request must be transmitted to, and temporarily processed by, the gateway and the eligible model provider. Which endpoints qualify is determined by the gateway and the providers themselves, and we do not control their practices.

AI-assisted features produce suggestions and drafts for your review; they do not send messages or change your records on their own. We do not use Customer Data to train our own AI models. A request handled by an AI provider outside our gateway is subject to that provider’s own terms and privacy practices, including how long it keeps the information and whether it uses it to improve its models.

If you connect a Google or Microsoft account, we access and use that data only to provide the features you enable, such as sending messages you compose, showing relevant email activity on a contact’s timeline, bringing in lead notification emails you set up rules for, and sending appointments to your calendar. If you use an AI-assisted feature on a contact, the subject lines of synced emails shown on that contact’s timeline may be included in the information sent to the AI provider for your request. We store the access tokens for these connections in encrypted form, and when you disconnect an account in NextAccord we delete the stored tokens (and, for connected mailboxes, ask Google or Microsoft to revoke access). Existing records that were already created in NextAccord, such as timeline entries, remain until they are deleted. You can also disconnect an account at any time in your Google or Microsoft account settings.

NextAccord’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or when needed to provide support you have requested.

We do not sell personal information. We share information in these ways:

• Within your workspace: other users in your workspace can see information according to their roles, and workspace owners and admins can manage users and data.
• Service providers that help us run the Service, under agreements that limit their use of the information. They include providers of cloud hosting and databases, authentication (Clerk), payment processing (Stripe), email delivery and processing (Amazon Web Services), file storage and content delivery (Amazon Web Services), and analytics (Google Analytics, where enabled).
• AI providers, including AI gateways and the model providers they route to, to generate the responses you request in AI-assisted features, as described in the AI-assisted features section.
• Integrations you connect, such as Google, Microsoft, and Calendly, to provide the features you enable.
• Recipients you choose: when you send an email, publish a Landing Page, or share a file, the content goes to the recipients or visitors you choose.
• Legal, safety, and business reasons: to comply with law or legal process, to protect rights, safety, and security, and in connection with a merger, acquisition, financing, or sale of assets.
• With your consent or at your direction.

We use cookies and similar technologies that are needed to keep you signed in, secure your account, and remember your settings. These are used by our authentication provider and by the application itself.

We may also use Google Analytics on our websites to understand how they are used. Google Analytics uses cookies and similar identifiers to collect information such as pages viewed, device and browser information, and approximate location. We do not use advertising cookies on the Service. You can control cookies in your browser settings, and blocking some cookies may affect how the Service works.

We keep information for as long as needed to provide the Service and for the purposes in this Policy, including to comply with legal, accounting, and security obligations, resolve disputes, and enforce our agreements. How long we keep information depends on the type of information and why we have it. When we no longer need information, we delete or de-identify it, subject to routine backups and the requirements of law.

Where permitted by law, we may retain limited suppression and email safety records after a contact or account is deleted when needed to honor opt-outs, prevent repeat sending to suppressed addresses, or protect recipients and the Service. These records remain subject to the retention purposes and limits above.

We use administrative, technical, and organizational measures designed to protect information, including access controls that separate each customer’s workspace, encryption of integration access tokens, and scanning of uploaded files. No method of transmission or storage is completely secure, and we cannot guarantee the security of information. Please use a strong password, protect your account, and keep your own copies of important records.

You can update much of your account information in the Service, and you can export information using the tools available in the Service. Depending on where you live, you may have the right to ask us to confirm whether we process your personal information, to access it, correct it, delete it, receive a copy of it, or limit or object to certain uses, and to not be discriminated against for exercising your rights. Some laws also give you the right to opt out of the sale or sharing of personal information; we do not sell personal information.

To make a request, email privacy@nextaccord.com. We may need to verify your identity, and we may decline requests where the law allows. If your information is Customer Data held on behalf of a NextAccord customer, we may refer your request to that customer. You may also contact your local data protection authority if you have concerns.

You can opt out of marketing emails from us by using the unsubscribe link in them. We will still send service messages such as security and billing notices.

To close your account or ask us to delete personal information, email privacy@nextaccord.com. Workspace owners and admins can export workspace data before asking for deletion. We will process verified requests as required by applicable law, and we may keep information that we are required or permitted to keep, for example for legal, security, tax, or fraud-prevention purposes, or that remains in routine backups until it is overwritten.

Cancelling a subscription does not by itself delete an account or its data.

We are based in the United States, and information is processed and stored in the United States and in other countries where we or our service providers operate. Those countries may have data protection laws that differ from the laws where you live. Where the law requires safeguards for transfers, we use appropriate mechanisms.

The Service is intended for business use by adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will take appropriate steps.

The Service may link to or connect with third-party websites and services. Their privacy practices are their own, and this Policy does not apply to them.

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, notify you by email or through the Service. Your continued use of the Service after the update means you accept it.

NextAccord is a product of Pink Huron LLC. For privacy questions or requests, email privacy@nextaccord.com. For other questions, email support@nextaccord.com.