GDPR FAQ

Version 1.0 · Updated 2026-09-08

Version: 1.0
Last updated: 8 September 2026

Is neuronxcrm a controller or a processor?

For the marketing site, account management, billing, and prospecting, Kraken Labs (neuronxcrm) acts as controller.

For tenant CRM data, files, and connected mailbox content you store or sync in neuronxcrm, you are the controller and neuronxcrm acts as processor, under the Data Processing Agreement (DPA).

Where is data hosted?

The neuronxcrm application, databases, and remote backups are hosted with Scaleway in France (Paris region, European Union).

Transactional platform email is sent via Scaleway TEM (primary), with Brevo remaining listed as fallback. Optional Google integrations (Gmail, Gemini), when enabled, process data under Google’s terms for those services.

What categories of people may be concerned?

Depending on your use of neuronxcrm, processing may concern:

your internal platform users (admins, members);
contacts, companies, and other people stored in your CRM records;
participants in email threads synced from connected Gmail accounts;
recipients of email campaigns you configure.

You choose what to store and for which purposes; neuronxcrm applies security measures regardless of audience.

What data does neuronxcrm process on my behalf?

For your account as processor, neuronxcrm may process:

account data of your users (name, email, role, settings);
CRM records, metadata, files, and links you create or import;
synced mailbox content when Gmail is connected;
technical logs needed for security and diagnosis.

neuronxcrm does not invent new categories of business data: it hosts and processes what you choose to collect or connect.

How long is data retained?

User accounts: for the contractual relationship, then limited archival for evidence.
Inactive free accounts: may be deleted or anonymised after 24 months without login.
Billing data: for accounting/tax periods (up to 10 years for certain documents).
CRM / mailbox content: for the duration you define as controller; Gmail disconnect cascades deletion of that connection’s synced mail data.
Technical logs: up to 6 months.
Backups: up to 30 days, then automatic deletion.

See the Retention & deletion page for detail.

What happens at contract end? Can I get my data back?

Yes. At contract end you can retrieve data in natively usable formats supported by the product (for example CSV/JSON exports). After the reversibility period, remaining production data are deleted within a maximum of 30 days, subject to legal retention and normal backup overwrite cycles.

Which technical subprocessors are used?

Main providers include:

Scaleway (France, EU) — infrastructure hosting and primary transactional email (TEM);
Brevo — fallback transactional email;
Google — optional Gmail API and Gemini features;
GitHub — source code only (no production personal data).

See the Subprocessors page for the full list.

Does neuronxcrm use AI on my CRM or Gmail data?

Optional product AI features (for example Gemini-assisted metadata proposals from screenshots/video) are used to help configure your tenant and require human approval before installation.

Google user data obtained via Gmail APIs is not used to train general-purpose AI/ML models and is subject to Google Limited Use commitments in the Privacy Policy.

Internal AI coding assistants used by Kraken Labs for development do not receive production personal data by default.

How are security incidents and breaches handled?

neuronxcrm applies a formal incident procedure. When a personal-data breach may affect processing performed for you, Kraken Labs notifies you without undue delay and, where possible, within 24 hours of becoming aware, with information reasonably available at that time.

How do I exercise privacy rights?

Contact privacy@neuronxcrm.com. For data in a customer workspace, also contact that organisation (the controller). Kraken Labs assists customers with data-subject requests under the DPA.