Privacy Policy

Next Genesis Sites builds custom websites and provides CRM, automation, and related digital systems for businesses. If you have any questions about this policy, contact us at matt@nextgenesissites.com or 3009 Grandview St, Colorado Springs, CO 80907.

Information you give us directly. When you fill out a form, request information, purchase a service, or request cancellation or a refund, we may collect your name, business name, email address, phone number, subscription and billing details, and the details of your inquiry or project.

Project materials. To deliver our services, you may share content, files, and account access or login credentials for third-party platforms (for example, your website host, domain registrar, Google, or social accounts). We use this information only to perform the work you have engaged us to do.

Payment information. Payments are processed by our third-party payment processor (Stripe). We do not collect or store your full card number on our own systems. Stripe handles your payment data under its own privacy and security terms.

Information collected automatically. When you visit the Site, we and our analytics providers may automatically collect technical information such as your IP address, browser type, device information, pages viewed, and how you interact with the Site, using cookies and similar technologies.

We use the information we collect to:

• Provide, operate, and deliver the services you request;
• Set up, build, and manage your website, CRM, and automation systems;
• Process payments, manage your subscription, address delinquent balances, and administer collections when necessary;
• Communicate with you about your account, projects, and support requests;
• Send you marketing emails and, where you have separately opted in, marketing text messages;
• Improve and secure the Site and our services;
• Comply with our legal obligations.

If you opt in to receive text messages from us, we use your mobile phone number to send the messages you consented to (such as marketing offers, updates, and account or service messages). Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP, and you can reply HELP for assistance.

We will not sell, rent, or share your mobile phone number, SMS opt-in information, or text-messaging consent with any third parties or affiliates for their own marketing or promotional purposes. Mobile opt-in and consent data is excluded from any other sharing described in this policy and is not shared with third parties except as strictly necessary for us to deliver the messaging service you requested (for example, our messaging provider that transmits the texts on our behalf).

We do not sell your personal information. We share information only in these limited circumstances:

• Service providers. We share information with trusted vendors who help us operate our business and deliver our services - for example, our payment processor (Stripe), our messaging and communications provider, our CRM and automation platform, our hosting and analytics providers, and professional advisers or collection providers used to resolve an unpaid business account. These providers may use your information only to perform services for us.
• Legal requirements. We may disclose information if required by law, regulation, legal process, or governmental request, or to protect our rights, safety, or property.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

When a client business supplies customer records or directs us to process information through its CRM, the client determines the business purpose of that use. We handle those records to deliver the agreed service under the client's instructions, subject to law and provider terms. The client is responsible for lawful collection and notices. Where a data-processing agreement is required, that agreement must separately address the parties' duties; this notice does not replace it.

A billing dispute or service suspension does not make client records our property. We distinguish client-owned records from our proprietary software and workflow logic. Standard exports, transition requests, and retention are addressed in the Terms, but legally required access, return, deletion, security, and breach-notification duties are not conditional on payment of an account balance. We verify requests and limit disclosures to authorized recipients.

For a billing dispute or collection, we use relevant account, invoice, payment, and correspondence records, not an entire customer database merely to pursue a debt. Mobile opt-in and consent information remains subject to the stricter SMS section of this policy.

Next Genesis LLC also makes software apps ("Apps"), such as Review Leaderboard, that businesses install into their CRM account through a CRM app marketplace. The business that installs an App (or the company that installs it for that business) is our customer. For data about its team and its customers, that business is in charge (the controller) and we process the data on its behalf (its processor or service provider) under Section 18 of our Terms. For the business's account details and keeping Apps secure, we decide how the data is used. If you are a team member or a customer of a business that uses an App, please contact that business first; we'll help it answer you.

What Review Leaderboard collects. Each App lists its own data here as it launches.

• About the business (from the CRM when it installs, with its permission): business name, address, time zone and logo link; CRM account and business account IDs; install, plan and trial status; and the Google listings we found for the business (name and address of up to three matches) so it can pick the right one.
• Set by the team in the App: team member display names on badges, review page links (Google or Facebook), settings, and a log of changes (badge names before and after, count resets, link and setting changes, and whether each change was made in the CRM or from a manager phone link).
• When a customer scans a badge: the time, which badge, and two one-way codes, one made from the scanner's internet address and browser type and one from the internet address alone (for IPv6, its network part). They let us count one scan per phone per badge per day and stop scripted floods. We never store the internet address itself in our App database. The codes are made with a secret key, so nobody without that key can work them back into an address, and we don't try to. We don't collect customers' names, phone numbers, emails or locations, don't record scans from link previews or bots, and the scan link sets no cookies. The App can't tell whether the customer went on to write a review.
• Sign-in and security: when a user opens the App in the CRM, the CRM sends us their user ID, role and account. We use them to give the right access and don't save them in our database; they travel in a sign-in token that expires after 12 hours. Install tokens are stored encrypted, manager phone links only as one-way codes. The App's pages keep a few display preferences in the browser's local storage; there are no tracking or advertising cookies.
• Team member cards: each card link shows only that person's name, their own scan counts and rank. Anyone with the link can open it, so it should be shared only with that person.
• Daily review count: once a day we read the business's public Google review count and rating, so the board can show its review total over time.

What we use it for. To run Apps (set up the account, count scans, show the leaderboard and cards), find the Google listing, keep Apps secure and prevent abuse, answer support requests, and fix and improve Apps. We don't sell personal data, share it for advertising, use it for targeted advertising or profiling, or share it with other customers.

Who else handles App data.

• Cloudflare, Inc. hosts our Apps, their database (stored in western North America) and their logs (cloudflare.com/privacypolicy). Its request and error logs can include the internet address, browser type and page address of a request and are kept for up to 7 days; Cloudflare also uses internet addresses to block attacks before they reach an App.
• The CRM platform and its app marketplace, which the business chose and contracts with directly, provide sign-in, install and billing. We read the business's details from it with permission; its own privacy policy covers what it does.
• treg (treg.to), a data service, and the Google Maps search provider it uses receive the business's name and address when an App looks up its Google listing at setup, and the listing's public ID when it reads the daily review count. No team or customer data is sent.
• Google LLC (Google Workspace) hosts our email, including support emails (policies.google.com/privacy).
• Google and Facebook: when a customer scans a badge they leave the App for the business's review page on that site. Our link doesn't pass on where they came from, and that site's own privacy policy applies.

We update this list at least 30 days before adding a new provider that handles personal data in an App.

How long we keep App data. While an App is installed: its settings, badges, change log and scan history (with their coded values), so year and all-time totals stay correct. After uninstall: 30 days, so a reinstall restores everything, then deleted automatically; install tokens are deleted at uninstall, and deleted data can remain in our hosting provider's database restore history for up to 30 more days. Hosting logs: up to 7 days. Support emails: as long as needed to help, then deleted after 2 years.

Choices, rights and security for Apps. Account admins can see, change and reset an App's data. To get a copy, correct something or have an account's App data deleted sooner, email matt@nextgenesissites.com; we'll confirm the request comes from that account and answer within 30 days, and if we can't do what you ask we'll explain why and you can ask us to reconsider. Because we process App data for the business that uses it, we pass individuals' privacy requests (for example under Colorado or California law) to that business and help it answer; scan codes usually can't be tied to a named person. App data is sent over HTTPS, each account's data is kept separate and checked by automated tests, requests are rate limited, and only the owner of Next Genesis can sign in to the Cloudflare account that holds the database. If a breach affects App data, we'll tell the account's admin or the company that installed it without undue delay. Apps are business tools offered in the United States and aren't directed to children; we don't knowingly collect personal information from children under 13 through an App.

We use cookies and similar technologies to operate the Site, remember your preferences, and understand how the Site is used. You can control cookies through your browser settings, though disabling them may affect how the Site functions.

We use Google Analytics and Microsoft Clarity to understand how visitors use the Site. Microsoft Clarity captures how you use and interact with the Site through behavioral metrics, heatmaps, and session replay, using first-party and third-party cookies. We use this to improve the Site and our marketing. For more about how Microsoft collects and uses data, see the Microsoft Privacy Statement at https://www.microsoft.com/privacy/privacystatement.

We take reasonable administrative, technical, and physical measures to protect your information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We keep your information for as long as needed to provide our services, maintain our business records, preserve a suspended account for a reasonable transition period, process an authorized data export, collect unpaid balances, comply with legal obligations, resolve disputes, and enforce our agreements. Service data may be deleted after termination as described in our Terms. We retain proof of SMS and marketing consent for as long as required to demonstrate compliance.

• Email. You can unsubscribe from marketing emails at any time using the unsubscribe link in any marketing message.
• Text messages. You can opt out of text messages at any time by replying STOP.
• Access and deletion. You may request access to, correction of, or deletion of your personal information by contacting us at matt@nextgenesissites.com. We will respond as required by applicable law.
• Subscription requests. You may use that same email address to submit a cancellation, satisfaction-guarantee, or refund request. We retain the request and related billing records as needed to process it, document the transaction, and comply with law.

Depending on where you live, you may have additional rights under state privacy laws. We honor those rights as applicable.

The Site may link to third-party websites or services we do not control. This policy does not apply to those sites, and we are not responsible for their privacy practices.

Our Site and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children under 16.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" above. We provide additional notice or obtain consent when applicable law requires it. A policy update does not authorize a new use of personal information that requires separate consent.

If you have questions about this Privacy Policy or how we handle your information, contact us at:

Next Genesis Sites
Next Genesis LLC
3009 Grandview St, Colorado Springs, CO 80907
matt@nextgenesissites.com