Privacy Policy

Last updated: 5 November 2026

This Privacy Policy explains how Omnizon Networks GmbH ("we") processes personal data when you use NGCRM (the "Service"), in accordance with the EU General Data Protection Regulation (GDPR).

1. Data controller

OMNIZON NETWORKS GmbH, Werinherstraße 3, 81541 München, Germany. Contact: support@ngcrm.ai, +49 89 215305555.

2. What we collect

• Account data — name, email, organisation, language, and login identifiers.
• Usage data — how you interact with the Service, for security and improvement.
• Billing data — handled by our payment provider (Paddle); we do not store full card details.
• Content — the data you enter into your CRM/helpdesk ("Your Data").
• Support communications — messages you send us.

Sign in with Facebook

You can register for and sign in to NGCRM with your Facebook account. If you choose this, we receive from Meta only your name and email address, and we use them only to create your account and sign you in (performance of a contract, Art. 6(1)(b)). The controller for this data in NGCRM is Omnizon Networks GmbH. We do not receive your friends list, posts or other Facebook data, and we never post on your behalf. When you register this way for the first time, you still confirm your email address. Meta processes your Facebook login under its own terms and privacy policy (facebook.com/privacy/policy). You can remove NGCRM from your Facebook account at any time in your Facebook settings, and you can exercise your rights over the data we received as described in section 8.

3. Purposes & legal bases

• Provide and operate the Service — performance of a contract (Art. 6(1)(b)).
• Billing and compliance — contract / legal obligation (Art. 6(1)(b),(c)).
• Security, fraud prevention and improvement — legitimate interests (Art. 6(1)(f)).
• Optional communications — consent (Art. 6(1)(a)).

4. Processors & sub-processors

We use trusted providers who process data on our behalf, for example for hosting (Vultr), network and storage (Cloudflare), email (Resend), the WhatsApp channel (Twilio), payments (Paddle, dLocal) and AI features (Anthropic). The full, current list with purposes and locations is on our Sub-processors page.

5. AI assistants and connectors (MCP)

NGCRM lets you connect an AI assistant of your choice, for example Claude by Anthropic, to your NGCRM account through the Model Context Protocol (MCP).

• You decide. A connection exists only if an administrator of your account has enabled AI access and the account owner has given consent. Write access (creating or updating records) requires separate consent from the account owner. Each user signs in and approves the connection themselves (OAuth), and access can be revoked at any time in NGCRM settings or in the AI assistant.
• What is shared. When you ask the assistant a question or give it a task, NGCRM sends the assistant only the data needed to answer that request, within your own permissions — for example organisations, contacts, leads, tickets, notes and activities you are allowed to see. NGCRM never shares data from other accounts or organisations you do not belong to.
• Who is responsible. The AI assistant is a service you choose and use under your own agreement with its provider. Data passed to the assistant is processed by that provider under its own terms and privacy policy (for Claude: anthropic.com/legal/privacy). The AI provider is not a processor of NGCRM.
• What we log. For security and audit purposes, NGCRM records each tool call: which tool was used, when, by which user, the search filters applied (for example a name or tax ID) and the result status. These logs are kept for 90 days and then deleted automatically. We do not store the content of your conversations with the assistant.
• No training. NGCRM does not use your data to train AI models.
• AI features inside NGCRM. Separately from connectors you choose, some NGCRM features use Anthropic's Claude to process the data needed for that feature (for example a ticket you ask to summarise). In that case Anthropic acts as our sub-processor. Under Anthropic's commercial terms, data sent through its API is not used to train its models. If your account uses its own AI key, the processing runs under your own agreement with the provider.

6. International transfers

NGCRM runs in two regions. In the EU cell (eu.ngcrm.ai), Your Data is hosted in Frankfurt, Germany. In the Brazil cell (br.ngcrm.ai), Your Data is hosted in São Paulo, Brazil; attachments and encrypted backups of both cells are stored in the EU. Where any processing occurs outside the EEA, we rely on appropriate safeguards such as EU Standard Contractual Clauses. For AI features inside NGCRM, Anthropic stores data in the United States and may process it in other regions where it operates; these transfers are covered by EU Standard Contractual Clauses in Anthropic's data processing addendum.

7. Retention

We keep personal data for as long as your account is active and as needed to provide the Service, then delete or anonymise it, subject to legal retention obligations.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to certain processing. You may exercise these rights by emailing support@ngcrm.ai. You also have the right to lodge a complaint with your local data-protection supervisory authority.

9. Cookies

We use essential cookies and browser storage (for example, to keep you signed in and to remember your language). On our website we additionally use the Meta Pixel and the Google Ads tag to measure and improve our ads, but only if you allow it in the cookie banner (Art. 6(1)(a) GDPR); you can withdraw your consent at any time. Our ads on Facebook and Instagram and the Meta Pixel are currently managed through the Meta business account of our group company Megatrend Redok d.o.o., Velika cesta 47, 10000 Zagreb, Croatia. Our Google Ads account is also managed by Megatrend Redok d.o.o. Details: Cookies & browser storage.

10. Changes

We may update this policy; material changes will be notified via the Service or by email.