Last Updated: September 2026

Privacy Policy

At Nexo CRM (operated by CodePeak Agency), your privacy and data security are foundational to our mission. This Privacy Policy details how we collect, process, protect, and retain personal and workspace data across our CRM platform, APIs, and AI integrations (including ChatGPT Connectors and Model Context Protocol servers).

1. Information We Collect

We collect the following categories of information when you create an account, manage workspaces, or integrate external applications:

Account Credentials: Name, email address, password hashes (salted via Argon2), and role within workspaces.
Workspace & CRM Data: Records, contact details, company profiles, deal pipelines, custom properties, meeting notes, and timeline activities created by you and your team.
Third-Party Integrations & OAuth: Authorization codes, scoped access tokens, and connector identifiers when linking OpenAI ChatGPT, Claude, or external tools.
Usage & Telemetry: Log files, API invocation counts, IP addresses, browser/user-agent headers, and error traces utilized strictly for diagnostic reliability and quota enforcement.

2. How We Use Your Information

Your information is used solely to provide and enhance your CRM service:

To provide CRM functionality, record management, pipeline tracking, and team collaboration.
To execute user-directed prompts and actions initiated via the Nexo ChatGPT Plugin / MCP Connector.
To authenticate sessions and enforce workspace-level access boundaries.
To monitor service availability, detect abuse, and prevent security breaches.

3. AI Integrations & No Model Training Guarantee

Zero Model Training Guarantee: Nexo CRM does not use your private customer data, meeting notes, contact lists, or pipeline metrics to train public or proprietary AI models. Data exchanged via ChatGPT or MCP tools is processed transiently and strictly to answer the active user session request.

4. Data Sharing & Third-Party Subprocessors

We do not sell, rent, or trade personal data. We disclose information only to vetted infrastructure service providers necessary to operate our platform:

Cloud Hosting & Compute: Infrastructure providers hosting our encrypted PostgreSQL databases and API services.
Payment Processing: Stripe (for subscription handling and payment transactions; Nexo never stores raw credit card details).
OpenAI / Anthropic: When you voluntarily connect Nexo to ChatGPT, only the CRM records requested by your prompts are transmitted to fulfill the prompt.

5. Data Retention & Deletion Timelines

We retain workspace data as long as your account remains active. If you delete a record, workspace, or account:

Soft-deleted records are archived and permanently scrubbed from active storage within 30 days.
Upon written account closure or workspace deletion, all associated customer records, notes, and activity timeline entries are purged from backups within 60 days.

6. Security Measures

We employ industry-standard administrative, physical, and technical safeguards:

End-to-end encryption in transit via modern TLS 1.3 protocol.
AES-256 encryption at rest for database instances, file attachments, and credential stores.
Strict tenant isolation enforcing row-level workspace separation across all database queries.
OAuth 2.0 PKCE (RFC 7636) with SHA-256 challenge validation for AI connector handshakes.

7. User Rights & Data Controls

You retain full sovereignty over your CRM data, including:

Access & Export: Export your contacts, deals, and datasets at any time in standard JSON or CSV formats.
Revoke Connector Access: Disconnect ChatGPT or third-party OAuth apps immediately via your workspace settings or OpenAI Apps management.
Right of Erasure (GDPR / CCPA): Request complete data deletion by contacting our privacy compliance team.

8. Contact Us

For privacy inquiries, data subject access requests, or regulatory questions, reach our compliance team at:

Email: privacy@codepeak.agency

Support Desk: support@codepeak.agency

Entity: Nexo CRM · CodePeak Agency