Privacy policy

Last updated 1 October 2026

NextIsWhat ("NIW", "we") is a sales and marketing app for businesses, run by EKM ServiceFine, India. This page explains what personal data we handle, why, who else is involved, and the choices you have. It is written for India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Two kinds of data

• Your account data — the names, work email addresses, mobile numbers and passwords of the people who use NIW in your company. For this data we decide how it is used, so we are the Data Fiduciary.
• Your customers' data — the leads, contacts, companies, deals, notes, files and emails your company keeps in NIW. Your company decides what goes in and how it is used; we only store and process it to run the service for you, on your instructions. Your company is the Data Fiduciary and we act as its Data Processor. People who want to see, correct or remove what a business holds about them should contact that business first; we help the business answer.

2. What we collect

• Sign-up and account details: company name, your name, work email, mobile number, and your password (stored only as a one-way hash, never readable).
• Whatever your company enters or imports: leads, contacts, deals, next actions, notes, call and WhatsApp logs, attached files, email text.
• Web form enquiries sent through your company's NIW forms, with the time the person gave consent.
• Marketing email results for emails your company sends through NIW: whether an email was delivered, opened or clicked, and unsubscribes. Unsubscribed addresses are kept on a "do not email" list so they are never emailed again.
• Security and usage records: sign-in times, the internet address (IP) a request came from, failed sign-ins, and a log of important changes (who changed what, and when).
• Payment records: the amount, date and UPI reference of payments you make to us. We do not take or store card details.

3. Why we use it

• To run NIW for your company: show your records, remind people of next actions, send the emails you ask it to send.
• To keep accounts safe: confirm email addresses, stop repeated wrong passwords, find and fix faults.
• To send service emails: confirmations, password resets, reminders, trial and payment notices.
• To bill you and keep the records the law requires.

We do not sell personal data, we do not show advertising, and we do not use your customers' data for our own marketing.

4. Who else handles it (service providers)

• Hosting: NIW and its database run on servers rented from GoDaddy. These servers may be outside India.
• Email: our service emails go out from our own mail server. If your company switches on marketing emails, they are sent through the sending service EKM sets up for you (for example Brevo or Amazon Web Services), which receives the recipient's address and the email.
• Your own mailbox: if you connect your Gmail or Microsoft 365 mailbox, NIW sends the emails you write through Google or Microsoft. We keep only an encrypted access key, never your mailbox password, and we do not read your Gmail inbox.
• Optional AI features: if your company switches on NIW's AI features, NIW sends only the information needed for each request (for example a customer's name, company, deal stage and value, and short notes from recent activity; email addresses and phone numbers are removed) to Google LLC's Gemini API, which processes it on our behalf to produce a draft or summary for you. Google may process this data outside India. Under Google's paid Gemini API terms, Google does not use it to improve its products and keeps it only for a limited period to detect abuse and meet legal obligations. Nothing written by the AI is sent to your customers unless a person in your company sends it. NIW keeps only usage figures (who used which feature, the amount used and its cost), not the text.

Each provider gets only what it needs for its part of the work. We may also share data when the law requires it.

5. How long we keep it

• While your company uses NIW, we keep its data so the service works.
• If your company's owner asks us to delete the company's data, it is hidden at once and removed within 30 days. Copies in our daily backups disappear as the backups are replaced (we keep 14 days of backups).
• Payment and invoice records are kept as long as Indian tax and accounting law requires.

6. How we protect it

• Every page uses an encrypted (https) connection.
• Each company's data is kept apart from every other company's; people in a company see only what their role allows.
• Passwords are hashed; mailbox access keys are encrypted; secret keys are kept outside the website folder.
• EKM staff who run NIW see companies, their users and usage counts, not your leads, deals or contacts, unless you ask us to help with a problem.

7. Cookies

NIW uses one cookie to keep you signed in, and your browser keeps a few small settings (for example a dismissed notice). There are no advertising or tracking cookies. Marketing emails sent through NIW contain a tiny image and tracked links so your company can see opens and clicks; every such email has an unsubscribe link.

8. Your rights

Under the DPDP Act you can ask us to tell you what personal data we hold about you, correct or complete it, delete it, and you can name someone to act for you. You can withdraw consent you gave (for example by unsubscribing). Company owners can export all their company's data at any time from NIW (Settings → Export) and can ask for it to be deleted. We reply within 30 days.

9. Contact and grievances

Privacy contact and Grievance Officer: Shivaraj Kadival, privacy@nextiswhat.com.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

10. Children

NIW is a business tool for adults. It is not meant for anyone under 18.

11. Changes

If we change this policy, we will update the date at the top, and tell company owners by email before an important change takes effect.