Privacy Policy

NeoKivo is a customer-relationship-management (CRM) service operated by its founder, Julien Tielemans. Throughout this policy, "NeoKivo", "we", "us" and "our" refer to that operator. "You" means the person or organization that holds a NeoKivo account.

NeoKivo has not appointed a separate data-protection officer; privacy questions and the requests described below go directly to the operator at hello@neokivo.com.

How data-protection law applies to NeoKivo depends on which data we are handling, so we split our role in two. This distinction matters, and we want to be precise about it:

• For your account and billing data (your name, email, login credentials, subscription and payment records), NeoKivo is the data controller — we decide how that data is used to run the service and bill you.
• For the CRM content inside your workspace (your contacts, companies, deals, notes, captured emails, documents and everything else you or your team put in), you are the controller and NeoKivo is your processor. We hold and process that content on your behalf and under your instructions, so that you can run your business. When your CRM records include personal data about your own contacts, you are responsible for having a lawful basis to store it; we act on your behalf.

We collect only what the product needs to work. Concretely:

• Account data — your name, email address, and a securely hashed password (if you sign up with email and password) or a Google account identifier (if you sign in with Google).
• Workspace / CRM content — the records you create or import: contacts, companies, deals, notes, tasks, pipelines, custom fields, saved views, and emails captured into the CRM (via BCC, a reply-capture domain, or your connected Gmail).
• Documents — files you upload, stored encrypted (see section 7).
• Billing records — your subscription status, seat count, plan interval, invoices, and AI credit purchases. Card payments are handled by Stripe; we never receive or store your full card number.
• Usage and technical data — session cookies that keep you logged in, and server logs (such as IP address, timestamps, and request metadata) generated when your browser or a connected app talks to our API. Security-relevant actions in a workspace are also recorded in an audit log, which can include the acting user and their IP address.

The absence of certain things is as important as what we do collect, so we state it plainly:

• We do not use third-party advertising trackers, analytics pixels, or behavioral profiling on our website or in the app. There is no Google Analytics, no Meta pixel, no session-replay tool.
• We do not sell your data, and we do not share it with data brokers or advertisers.
• We do not use the contents of your workspace to train AI models — not ours, and not any provider’s. This is a firm commitment, described further in section 6.

We use the data above only to run and improve the service you are paying for:

• To provide the CRM: store and display your records, run your pipeline, power search, and let you export.
• To operate accounts and security: authenticate logins, keep sessions valid, enforce roles and permissions, and maintain the audit log.
• To send the emails you enable: reminders, digests, notifications, and password-reset or account-security messages.
• To send email on your behalf when you connect it: if you connect Gmail, outbound sales email is sent through your own Gmail account so it comes from your address (see section 6).
• To bill you: process subscription payments and AI credit purchases through Stripe, and issue invoices.
• The legal bases we rely on are: performing our contract with you (providing the service and billing), your consent (optional integrations such as Gmail), our legitimate interests (security, fraud prevention, keeping the service running), and compliance with legal obligations (such as tax records).

Some features involve sending data to a third party, and only run if you choose to use them. We describe them separately so the trade-off is clear.

AI assistant. If you use the AI assistant, the text of your prompt and the specific CRM records relevant to your request are sent to our AI model provider (currently OpenAI) to generate a response. That processing happens through the provider’s API. Under the provider’s API terms, data sent this way is not used to train their models. We do not use it to train models either. If you never use the AI features, no workspace content is sent to an AI provider.

Google user data and the Limited Use requirement. If you connect a Gmail account to send email, NeoKivo requests only the gmail.send permission — enough to send mail as you, and nothing that reads your mailbox. NeoKivo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data solely to provide and improve the email-sending feature you requested; we do not transfer it to others except as needed to provide that feature, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and no humans read this data except with your explicit consent, for security or legal reasons, or where the data has been aggregated and anonymized. You can disconnect a Google account at any time in your settings, and revoke access in your Google account permissions.

We take reasonable technical measures to protect your data:

• Structured CRM data is stored in a managed PostgreSQL database. Documents are stored in Cloudflare R2 object storage and encrypted at rest using envelope encryption, with a distinct encryption key derived per workspace.
• Passwords are never stored in plain text — they are hashed by our authentication layer (better-auth) before storage. API keys are stored only as a SHA-256 hash; the full key is shown to you once and never again.
• Access to workspace data is governed by roles and permissions, per-deal visibility rules, and an audit log of security-relevant actions.
• Traffic to the service runs over HTTPS. Outbound webhooks you configure are signed so your endpoint can verify they came from NeoKivo.
• No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security. Keep your own exports of data that is critical to you.

No provider can promise a breach will never happen, so what matters is how we respond when one does. If we become aware of a personal-data breach affecting data in your workspace, we will notify you without undue delay, so that you can meet your own obligations as the controller of that content. We do not claim to detect every possible incident, but we commit to acting on the ones we find.

Where the GDPR requires it, we will also notify the competent supervisory authority within 72 hours of becoming aware of a qualifying breach. Our process follows four steps:

• Assess — confirm what happened, which data and which workspaces are affected, and the likely impact.
• Contain — stop the exposure, revoke compromised credentials, and close the vector that allowed it.
• Notify — tell affected customers what we know, what we are doing, and what they should do, and inform a supervisory authority where the law requires it.
• Post-mortem — fix the root cause and record what changed, so the same failure does not recur.

To run NeoKivo we rely on a small set of infrastructure and service providers. Each processes only the data needed for its function, and each is itself bound to protect it. Our current sub-processors are:

• Stripe — subscription billing and payment processing.
• Cloudflare — application delivery, object storage (documents), and email routing/delivery (inbound email capture and outbound transactional email). Some transactional email may instead be delivered through Resend.
• OpenAI — AI model processing, only when you use the AI assistant.
• Google — Gmail sending and Google sign-in, only if you use those features.
• We do not claim a specific hosting country in this policy because our providers operate globally. Where data leaves the European Economic Area, it is covered by the safeguards those providers offer (such as Standard Contractual Clauses). We will keep this list current; material changes to sub-processors will be reflected here with an updated date.

NeoKivo lets you push your own data outward on purpose. When you configure a webhook, create an API key, or connect an MCP client, your workspace data is sent to the endpoint or application you point it at. That destination is under your control, not ours, and this policy does not govern what happens to the data once it reaches a system you chose. Treat API keys and webhook secrets as credentials and keep them safe.

We keep your account and workspace data for as long as your account exists. If your trial ends or your subscription lapses, your workspace becomes read-only — your data is retained, still viewable, and still exportable — rather than deleted, so you can come back.

If you ask us to delete your account, we will delete your workspace content within a reasonable period. To protect you against accidental or premature loss, we retain a lapsed or cancelled workspace in read-only form for at least 90 days before any deletion, and we will give you prior notice before permanently deleting it. Some records (such as billing and tax records) may be kept longer where the law requires. Read/archived notification records are automatically purged after 90 days.

You can export everything in your workspace at any time — CRM records as CSV, and documents by download. Beyond export, because NeoKivo serves customers in the European Union, we honor the rights the GDPR provides, for every user regardless of location:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your personal data (subject to the retention above).
• Portability — receive your data in a portable format (our export serves this).
• Restriction and objection — ask us to limit or stop certain processing.
• Complaint — lodge a complaint with your local data-protection supervisory authority if you believe your rights have been breached.

If someone whose personal data lives inside a customer’s workspace (for example, one of your contacts) asks us to access or delete their data, we will refer them to you, the workspace controller, and support you in responding. We act on the controller’s instructions for that content.

We use cookies only for what the service needs to function: chiefly a session cookie that keeps you signed in after you log in. We do not use advertising or cross-site tracking cookies.

NeoKivo is a business tool and is not directed at children. It is not intended for anyone under 16, and we do not knowingly collect data from them.

We may update this policy as the product evolves. When we make material changes we will update the date at the top of this page, and where appropriate notify account holders. Continuing to use NeoKivo after an update means you accept the revised policy.

For any privacy question, or to exercise any of the rights above, email hello@neokivo.com. Privacy requests are not routed through a support tier: they are handled directly by the operator responsible for your data.