Privacy Policy

1. Scope and our role

This Policy applies to NEXT Impact 360’s public website, staff application, visitor check-in, communications, and integrations. For account, billing, website, and support information, NEXT Impact 360 determines how information is used. For contacts, donors, visitors, staff records, notes, messages, tours, and other content entered by a customer, NEXT Impact 360 generally processes information for that customer under its instructions. The customer remains responsible for its own privacy notices, lawful basis, permissions, and responses to individuals.

2. Information we collect

• Account and organization information: name, email, phone, organization, role, company access, authentication identifiers, preferences, branding, and configuration.
• Customer content: contact and donor records, relationship details, notes, tasks, projects, tours, forms, photos, files, reports, and annual-plan information.
• Communications: email and text content, participants, addresses, phone numbers, attachments, timestamps, delivery events, consent, opt-outs, and provider identifiers.
• Integration data: authorized mailbox, calendar, fundraising, AI, and provider data required for enabled features, plus tokens and synchronization state.
• Usage and security data: IP address, device and browser details, session data, audit events, errors, feature use, and diagnostic information.
• Support and transaction information: requests, correspondence, service plan, invoice references, and related account records.

3. Sources

We receive information from users, customer administrators, contacts and visitors who submit forms, connected services authorized by users, service providers, and automatically from use of the service. Customers may import information they have lawfully collected from their own systems.

4. How we use information

We use information to provide and personalize authorized features; authenticate users; enforce company and role boundaries; synchronize integrations; send requested communications; maintain consent and suppression records; operate tours, tasks, projects, and reports; provide support; secure, audit, and troubleshoot the service; improve reliability and usability; comply with law; and enforce agreements. We do not use customer content for unrelated advertising.

5. Google Workspace data

NEXT Impact 360’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve visible, user-facing features requested through the service; is not sold; is not used for advertising; and is not used to train or improve generalized AI or machine-learning models. Human access is limited to user-authorized support, security, legal obligations, or aggregated and anonymized internal operations as permitted by Google policy.

6. When we disclose information

We disclose information to the customer and its authorized users; to subprocessors and integration providers that operate the requested service; when directed or consented to by the customer or user; to protect rights, safety, and service security; to comply with valid legal process; and in a corporate transaction subject to appropriate protections. Providers may include Supabase, Vercel, Google, Microsoft, Twilio, SendGrid, Blackbaud-connected workflows, and optional AI services, depending on configuration. We do not sell personal information or share it for cross-context behavioral advertising.

7. Email and text messaging

Customers determine recipients and purposes for messages they send. NEXT Impact 360 processes delivery, reply, consent, unsubscribe, bounce, complaint, and suppression information to provide the service and help enforce messaging preferences. Recipients may use provided unsubscribe methods or recognized SMS opt-out keywords. Message and data rates may apply to text messages.

8. Cookies and similar technologies

We use essential cookies and local storage for authentication, security, navigation, and device-specific settings. We may use limited operational measurements to understand performance and errors. We do not use customer CRM content for targeted advertising.

9. Retention

We retain information for as long as needed to provide the service, satisfy customer instructions and agreements, maintain security and audit records, resolve disputes, and meet legal obligations. Retention varies by data type, customer configuration, provider behavior, backups, and legal requirements. Integration data is deleted or disconnected according to available customer controls, provider procedures, and applicable obligations.

10. Security

We use administrative, technical, and organizational safeguards designed for the nature of the service, including authentication, role-based access, company separation, encryption of supported credentials, audit logging, and provider security controls. No system, network, storage, or transmission method is completely secure. Users must protect credentials, devices, exports, and connected accounts and promptly report suspected misuse.

11. Your choices and rights

Users can manage certain profile, company, communication, integration, and access settings in the service. Connected Google and Microsoft access can also be revoked through the provider account. Individuals may have rights to know, access, correct, delete, export, restrict, or object to processing and to opt out of sale, sharing, or certain communications, depending on location and applicable law. We do not discriminate for exercising applicable privacy rights.

If your information was placed in NEXT Impact 360 by one of our customers, contact that organization first; it controls the record and must evaluate your request. We will assist the customer as required. Requests may require identity and authority verification, and legal exceptions may apply.

12. California disclosures

The categories collected during the preceding 12 months may include identifiers, customer-record information, internet or electronic activity, professional or employment information, communications, visual information such as tour photos, and inferences created for requested CRM features. We collect and disclose these categories for the business purposes described above. We do not sell personal information or share it for cross-context behavioral advertising. Where California law applies, residents may exercise rights to know, delete, correct, limit certain sensitive-information uses, and receive equal service. Authorized agents may submit requests subject to verification.

13. Children

The staff service is not directed to children under 13. Customers must not create staff accounts for children. If an organization collects information about minors through a tour or form, that organization is responsible for appropriate notice, consent, and supervision. Contact the responsible organization or account administrator if information was submitted improperly.

14. International use

The service and its providers may process information in the United States and other countries where safeguards and laws differ. Customers are responsible for determining whether the service and their configuration satisfy requirements that apply to international transfers and users.

15. Changes and contact

We may update this Policy as the service, providers, or law changes. The effective date identifies the current version, and material changes may require notice or renewed acknowledgment. Privacy questions and requests may be sent to support@nextimpact360.com. Requests concerning customer-controlled records should be directed to that customer first.