Skip to main content
neuronxcrm
Sign in
Book a call

Privacy Policy

Version 1.0 · Updated 2026-09-08

Version: v1.0
Last updated: 8 September 2026

1. Purpose of this policy

This policy explains how Kraken Labs, publisher of neuronxcrm, collects, uses, and protects personal data when you:

  • browse neuronxcrm websites and interfaces (for example neuronxcrm.com);
  • use the neuronxcrm multi-tenant CRM platform;
  • connect third-party services such as Gmail;
  • exchange with Kraken Labs teams (sales, support, billing).

It is drafted in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act as amended.

2. Who is the controller?

2.1. Marketing site and platform accounts

Unless stated otherwise, the controller is:

Kraken Labs
Simplified joint-stock company (SAS)
Registered office: 27 quater Avenue de la Duragne, 33850 Léognan, France
RCS Bordeaux No. 994 290 484 00017
General contact: sales@neuronxcrm.com
Privacy / DPO contact: privacy@neuronxcrm.com

Kraken Labs is controller for processing related to:

  • the neuronxcrm marketing website and contact forms;
  • customer and user accounts (invitation, authentication, billing, support);
  • commercial prospecting and product communications about neuronxcrm.

2.2. Tenant CRM data and connected mailboxes

When your organisation uses neuronxcrm to store CRM records, metadata, files, or synced mailbox content, your organisation remains the controller of that customer data. Kraken Labs acts as a processor under the GDPR.

That relationship is governed by a separate Data Processing Agreement (DPA), which sets out the respective obligations of the Customer and Kraken Labs.

3. Whose data may be processed?

Depending on how customers use neuronxcrm, processing may concern:

  • platform users (tenant admins, members, contributors);
  • contacts, companies, and other persons stored in tenant CRM records;
  • participants in email threads synced from connected Gmail accounts;
  • prospects and contacts reached through email campaign features configured by the customer;
  • any other data subjects whose information the customer chooses to store or process in neuronxcrm.

In all cases, the customer remains responsible for choosing what data to collect and the applicable legal bases.

4. What data do we collect?

4.1. Account and identification data

When a neuronxcrm account is created or used:

  • name;
  • email address;
  • hashed password or other authentication factors (for example MFA);
  • organisation / tenant membership and role;
  • account settings and preferences.

4.2. Contractual and billing data

For the commercial relationship:

  • billing contacts (name, postal address, country, VAT number where applicable);
  • subscription plan, options, and billing history;
  • payment information required for invoicing (card data is handled by the payment provider when used; neuronxcrm does not store full card numbers).

4.3. Platform usage data

When you use neuronxcrm:

  • authentication and technical logs (date, time, IP address, browser type, security events);
  • CRM metadata configuration (entities, properties, layouts) and operational telemetry;
  • aggregated usage metrics needed to operate and secure the service.

4.4. Tenant CRM content (processor role)

As processor for the customer, neuronxcrm may store:

  • CRM records and related links, history, and files the customer creates or imports;
  • workflow and automation metadata configured by the customer;
  • email campaign kernel data (templates, audience snapshots, send jobs, events) when the customer uses those features.

4.5. Gmail and Google user data

When a user or tenant admin connects Gmail, neuronxcrm may process Google user data necessary to provide mailbox features, including:

  • OAuth tokens stored in a secured credentials store;
  • mailbox account metadata (email address, sync cursors, mailbox kind);
  • message metadata and content (threads, messages, headers, bodies);
  • attachments associated with synced messages;
  • links between messages and CRM records created by the customer.

See Section 13 for Google API Services Limited Use commitments.

4.6. Support and communications

When you contact us:

  • content of emails or support messages;
  • attachments you choose to send (screenshots, exports, documents).

Transactional platform email is sent via Scaleway Transactional Email (TEM) as the primary sender, with Brevo SMTP as fallback until a later cutover. Professional support and contractual email may use Kraken Labs business mail hosted in the EU.

4.7. AI-assisted product features

Where the customer enables AI features (for example screenshot/video ingestion proposing CRM metadata via Google Gemini), prompts and derived structural proposals may be processed to deliver that feature. AI never directly changes production tenant metadata without human approval. Google user data obtained via Gmail APIs is not used to train general AI models.

5. Purposes and legal bases

5.1. Accounts and service delivery

  • Purpose: create and administer accounts, manage access rights, provide neuronxcrm features, functional and technical support.
  • Legal basis: performance of a contract or pre-contractual steps at your request.

5.2. Billing and commercial relationship

  • Purpose: invoicing, payment follow-up, subscription management, accounting.
  • Legal bases: contract performance and legal obligations (accounting, tax).

5.3. Security and abuse prevention

  • Purpose: secure systems and data; prevent attacks, fraud, or abusive use.
  • Legal basis: legitimate interest of Kraken Labs in securing its services.

5.4. Service improvement

  • Purpose: improve features, performance, reliability, and usability.
  • Legal basis: legitimate interest, subject to data minimisation and, where possible, anonymisation or aggregation.

5.5. Prospecting and product communications

  • Purpose: informational and commercial emails about neuronxcrm.
  • Legal bases: consent where required, or legitimate interest, subject to your right to object.

5.6. Legal compliance and disputes

  • Purpose: respond to authorities; manage disputes.
  • Legal bases: legal obligations and legitimate interest in defending Kraken Labs’ rights.

5.7. Processing on behalf of customers

  • Purpose: host and process tenant CRM data, synced mail, and related features under documented customer instructions.
  • Legal basis (customer): determined by the customer as controller; Kraken Labs processes as processor under the DPA.

6. Who can access your data?

6.1. Internal Kraken Labs teams

Access is limited to people who need it for their roles: engineering/operations, support, billing/customer success, and management as required. All are bound by appropriate confidentiality obligations.

6.2. Technical subprocessors

Kraken Labs uses carefully selected providers, including:

  • Scaleway — infrastructure hosting (servers, databases, object storage) in the Paris region (France, EU), and Scaleway TEM as the primary transactional email sender;
  • Brevo — fallback transactional email delivery for platform notifications;
  • Google — Gmail API (when customers connect Gmail) and Gemini models for optional AI product features;
  • GitHub — source code hosting for development (no production personal data in repositories).

Providers that process personal data on our behalf are bound by GDPR-compliant contracts. See the Subprocessors page for details.

6.3. Authorities and authorised third parties

We may disclose data to administrative or judicial authorities, or other authorised third parties, when required by law or to defend our rights.

Kraken Labs does not sell or rent personal data.

7. Where is data hosted?

neuronxcrm application data and databases are hosted on Scaleway infrastructure in France (Paris region, EU), with encryption and access controls.

Some optional integrations (for example Google Gmail or Gemini) may involve processing by Google under Google’s terms and locations applicable to those services. Customers choose whether to enable those integrations.

8. How long is data retained?

Retention is limited to what is necessary for the purposes and legal obligations. See also the Retention & deletion page.

  • Paid accounts: for the contractual relationship, then archived up to five (5) years for evidence, subject to longer legal duties.
  • Inactive free accounts: may be deleted or anonymised after twenty-four (24) months without login, subject to legal retention duties.
  • Billing records: up to ten (10) years where required by accounting/tax rules.
  • Tenant CRM / mailbox content: as instructed by the customer controller; deleted or returned at contract end per the DPA. Disconnecting a Gmail connection cascades deletion of that connection’s mail accounts, threads, messages, attachments, and related links.
  • Technical/security logs: up to six (6) months unless a longer legal duty applies.
  • Backups: up to thirty (30) calendar days, then automatic lifecycle deletion.
  • Support communications: for the time needed to handle requests, then archived up to five (5) years.
  • Prospecting data: until consent withdrawal / objection, or up to three (3) years from last interaction.

9. Your rights

Subject to GDPR conditions, you may exercise: access, rectification, erasure, restriction, objection (including to prospecting), portability where applicable, and instructions regarding data after death.

Contact:

  • Email: privacy@neuronxcrm.com
  • Mail: Kraken Labs — Privacy / DPO, 27 quater Avenue de la Duragne, 33850 Léognan, France

We may request additional information to verify your identity. We respond within one (1) month of receipt under Article 12 GDPR.

For data stored in a customer’s neuronxcrm workspace, please also contact that organisation (the controller). We will assist customers with data-subject requests under the DPA.

10. How we protect data

Kraken Labs implements appropriate technical and organisational measures, including:

  • access control and least privilege;
  • strong authentication on administrative environments where available;
  • TLS encryption in transit;
  • encrypted backups with automated lifecycle rules;
  • multi-tenant isolation enforced at the database layer (tenant identifiers and row-level security);
  • logging of significant actions with limited retention;
  • documented incident and personal-data breach procedures.

If a personal-data breach affects processing performed for a customer, Kraken Labs notifies that customer without undue delay and, where possible, within twenty-four (24) hours of becoming aware, with information reasonably available at that time.

11. Cookies and similar technologies

Cookies and similar technologies may be placed when you browse our sites. Categories, purposes, and choices are described in the Cookie Policy.

12. Changes to this policy

This policy may change to reflect legal, product, or organisational updates. New versions are published on neuronxcrm.com with an updated “Last updated” date.

13. Google API Services User Data Policy (Limited Use)

neuronxcrm’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, when you connect Gmail:

  • We use Google user data only to provide or improve user-facing features that are prominent in the neuronxcrm mail experience (sync, display, send/reply, CRM linking, and related mailbox management).
  • We do not sell Google user data.
  • We do not use Google user data for serving advertisements.
  • We do not allow humans to read Google user data unless:
    • we have your affirmative agreement for specific messages;
    • it is necessary for security purposes (for example investigating abuse);
    • it is necessary to comply with applicable law; or
    • the data is aggregated and used for internal operations in a way that does not identify end users or their Google accounts.
  • We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, for security, to comply with law, or as part of a merger/acquisition/bankruptcy with notice and continuing compliance.
  • We do not use Google user data to train general-purpose AI / ML models.

Revoking Google access (disconnecting the Gmail connection in neuronxcrm or via your Google Account permissions) stops further sync and triggers deletion of that connection’s synced mailbox data from neuronxcrm production systems as described in our retention documentation.