Privacy Policy

Account information: name, email, and profile details you or your identity provider (Clerk) provide when you sign up.

Workspace data: the account, contact, deal, note, and message records you or your team create or import into NextShot, including data pulled in via CSV import or a connected CRM, plus your company profile (including the business mailing address added to your emails).

Gmail data: if you connect Gmail, NextShot requests two permissions: gmail.compose, to create drafts and send the messages you approve; and gmail.metadata, to track sends and replies using message metadata (subject, recipients, timestamps, labels). NextShot does not read the body content of emails in your inbox.

Usage data: how you interact with the Service, feature usage, generation counts, and similar diagnostic information, used to operate and improve the product.

Payment information: handled directly by our payment processor, Stripe. We don’t see or store your full card details.

When our users research a company or look for the right people to contact there, NextShot processes information about those people in their professional role:

• Name, job title, and employer
• Work email address, and whether it was verified
• Public professional profile links (such as LinkedIn) and a public profile photo where one exists
• The public web page where they were found, and the date
• Publicly reported news and business information about their company
• Messages our users write to them and, for users who connect Gmail, whether they replied

Where it comes from: public web pages (found through a web search run by our AI provider), email finding and verification by Findymail, a user’s own Apollo account if they connect one, and records our users enter or import themselves. NextShot keeps a record of where and when each contact was found.

Why: to help our users identify and contact relevant people at businesses about matters related to their work. We rely on legitimate interests in business-to-business communication as our legal basis where the GDPR or UK GDPR applies. We don’t sell this information or use it for consumer marketing.

Who decides: the contact records in a user’s workspace belong to that user’s organization, which decides how they’re used. NextShot processes them on that organization’s behalf.

Your choices if you’re one of these contacts: you can reply to any email sent through NextShot to ask the sender to stop, and every such email includes the sender’s business address. You can also email privacy@nextshotai.org to ask what information NextShot holds about you, to have it deleted, or to object to its use. When you ask us to stop, we add you to a NextShot-wide do-not-contact list, which stops every NextShot user from writing to you or finding you through the Service. Where your details sit in a NextShot customer’s workspace, that customer controls those records, and we’ll tell you which organization to contact.

• To provide the core Service: researching accounts, finding contacts, drafting messages, scoring, and tracking outreach
• To enforce do-not-contact requests across the Service
• To bill you and manage your subscription
• To provide customer support
• To maintain security, prevent abuse, and enforce our Terms
• To improve the product, using aggregated or de-identified usage patterns, not the content of your outreach

To generate research, strategy, and drafted messages, relevant Workspace data is sent to our AI provider, currently Anthropic (Claude models), which also runs the web searches used for research and contact finding. Anthropic processes this data under its commercial API terms and does not use data submitted through the API to train its models. NextShot does not use your Customer Data to train any AI model.

We don’t sell personal information. We share it only with the service providers (“subprocessors”) that make NextShot work:

• Anthropic, AI generation and web search
• Findymail, finding and verifying work email addresses
• Neon, database hosting
• Vercel, application hosting
• Cloudflare, DNS and network security
• Clerk, authentication and account management
• Stripe, payment processing
• Resend, transactional email
• Trigger.dev, background job processing (imports, sync, scheduled scans)
• Sentry, error monitoring
• Google, Gmail integration, only if you connect it
• Apollo, email lookup, only if you connect your own Apollo account

A few services receive only a lookup value to display an image or suggestion: logo.dev (a company domain, to show its logo), Clearbit (a company name you type, to suggest matches), and unavatar.io (a public LinkedIn profile link, to show that profile’s public photo).

We may also disclose information if required by law, or in connection with a merger, acquisition, or sale of assets, subject to the same protections described here.

Open tracking is off by default. A sender can turn it on for an individual email, in which case that email includes a small tracking image that tells the sender when it was opened. It can’t be turned on for recipients at organizations based in the EU, the UK, or Switzerland, where it would require the recipient’s consent. Replies are tracked using Gmail message metadata, not the tracking image.

NextShot’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used solely to provide the drafting, sending, signature, and reply-tracking features you explicitly enable, is not used for advertising, and is not shared beyond what this policy describes. You can revoke NextShot’s access at any time from your Google Account permissions or from Settings inside NextShot.

NextShot and most of its service providers are based in the United States, so information may be processed there. Where the GDPR or UK GDPR applies, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We retain Workspace data, including business contact records, for as long as the owning account is active, or until the user deletes it. Results of a contact or company search are kept only until the next search replaces them or the user adds people from them. Intent signals (news and events NextShot finds about a company) are deleted automatically six months after they’re found. If a subscription is cancelled, we retain the workspace data for a reasonable period to allow export or reactivation, then delete it, except where we’re required to keep records for legal or accounting reasons. When a user deletes their account in Settings, their workspace data and login are erased right away; database backups are kept for a limited window for disaster recovery and age out automatically. We keep a security audit log of account and admin actions (who did what, and when) and a team’s do-not-contact entries for as long as needed to honor the request.

We encrypt sensitive credentials at rest, enforce access controls scoped to your account or team (with owner, admin and member roles), keep an audit log of sensitive changes, and use industry-standard practices to protect Workspace data in transit and at rest. More detail is on our Security & data practices page. No system is perfectly secure, but we treat this seriously and continue to invest in it as the product grows.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict how it’s used, and to complain to your local data protection authority. Users can access, update, export (Settings → Data & privacy), or delete most Workspace data directly in the app, and can delete their whole account in Settings → Profile. For anything else, including requests from business contacts described in section 2, email privacy@nextshotai.org. We respond within 30 days.

NextShot is a B2B product intended for business use and is not directed at children under 16.

We may update this policy as the Service evolves. If a change is material, we’ll notify users by email or in-app notice before it takes effect.

Questions about this policy or your data? Reach us at privacy@nextshotai.org.