The data controller is Impresa Digital Marketing, LLC, a company based in Texas, United States, which operates Nexicall. Contact: info@nexicall.com. We are responsible for the processing of your personal data as described in this Privacy Policy.
We collect the following categories of personal data: (a) Account data — name, email address, and authentication credentials (including OAuth tokens from Google or Apple Sign-In); (b) CRM data — contacts, call logs, call notes, call settings, scheduled follow-ups (Wiedervorlage), and birthday information you enter; (c) Subscription data — payment method details (processed by Stripe, Apple, or Google), subscription status, and billing history; (d) Usage data — anonymized interaction patterns, feature usage, and session data; (e) Device data — device type, operating system version, app version, and push notification tokens.
We process your data for the following purposes: (a) Providing and maintaining our CRM services, including contact management, call logging, call scheduling, birthday tracking, and team management; (b) Processing payments and managing subscriptions; (c) AI-powered call analysis (KI Analyse) to provide pre-call briefings and post-call summaries; (d) Sending transactional emails such as password resets and account notifications; (e) Improving our service through anonymized analytics; (f) Ensuring security and preventing abuse.
We process your data on the following legal bases under GDPR Article 6: (a) Contract performance (Art. 6(1)(b)) — Processing necessary to provide our CRM services, manage your account, and fulfill our contractual obligations; (b) Legitimate interest (Art. 6(1)(f)) — Analytics to improve our service, security measures to protect our platform, and error tracking to ensure reliability; (c) Consent (Art. 6(1)(a)) — Marketing communications, optional analytics cookies, and AI-powered analysis features. You may withdraw consent at any time without affecting the lawfulness of prior processing.
We share your data with the following processors who act on our behalf: - Supabase (Database & Authentication): Stores all user data including contacts, call logs, and authentication. Hosted in the United States (AWS). Privacy: https://supabase.com/privacy - Stripe (Web Payments): Processes subscription payments for web users. Privacy: https://stripe.com/privacy - RevenueCat (Mobile Subscriptions): Manages in-app purchases for iOS and Android. Privacy: https://www.revenuecat.com/privacy - Sentry (Error Tracking): Collects crash reports and performance diagnostics to maintain service reliability. Privacy: https://sentry.io/privacy - PostHog (Analytics): Tracks anonymized usage patterns to help us improve the product. Privacy: https://posthog.com/privacy - Google (OAuth & Android): Provides sign-in authentication for Google accounts. Privacy: https://policies.google.com/privacy - Apple (OAuth & iOS): Provides sign-in authentication for Apple accounts. Privacy: https://www.apple.com/privacy - Resend (Transactional Email): Sends password reset and account notification emails. Privacy: https://resend.com/legal/privacy-policy
Active accounts: Your data is retained for as long as your account exists and is necessary to provide our services. Deleted accounts: When you request account deletion, a 30-day cool-off period begins. During this period you can cancel the deletion and restore your account. After 30 days, all data is permanently and irreversibly removed, including contacts, call logs, settings, and your authentication record. Backups: Any backup copies containing your data are purged within 30 days of permanent deletion.
Under GDPR Articles 15-22, you have the following rights: (a) Right of access — obtain confirmation of whether your data is processed and request a copy; (b) Right to rectification — correct inaccurate or incomplete data; (c) Right to erasure — request deletion of your data (available via Settings > Delete Account); (d) Right to restriction — limit processing in certain circumstances; (e) Right to data portability — receive your data in a structured, machine-readable format; (f) Right to object — object to processing based on legitimate interest. To exercise any of these rights, contact us at info@nexicall.com. You also have the right to lodge a complaint with your local data protection supervisory authority.
We use only essential cookies required for authentication and session management. PostHog analytics tracking is enabled only with your explicit consent. We do not use advertising cookies or tracking pixels.
Your data is stored and processed in the United States, where our database provider Supabase is hosted (on AWS). For users in the EU/EEA this constitutes an international data transfer. These transfers, to Supabase and to our other US-based processors (Stripe, Sentry, PostHog), are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection.
Nexicall is not intended for users under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly.
We may update this Privacy Policy from time to time. Changes will be communicated via email to the address associated with your account. Your continued use of the service after notification constitutes acceptance of the updated policy. Last updated: April 2026.