Privacy Policy

When you create an account, we collect:

• Name and email address
• Company name and mailing address
• Phone number (optional)
• Company logo (optional)
• Password (hashed, never stored in plain text)

When you subscribe to the Service, payment is processed by Stripe, Inc. We do not store your credit card number, CVV, or full card details on our servers. We receive and store your Stripe customer ID, subscription status, and billing history metadata. See Stripe's privacy policy at https://stripe.com/privacy for details on how Stripe handles your payment data.

You may enter or import data about property owners, surplus funds cases, and related records ("Lead Data") into the Service. This data may include:

• Property owner names, mailing addresses, phone numbers, and email addresses
• Property addresses, parcel numbers, and county/state information
• Surplus fund amounts, recovery fee percentages, and claim details
• Case notes, activity logs, and stage history
• Documents uploaded to the Service

Lead Data is your data. We process it solely to provide the Service to you. We do not sell, share, or use Lead Data for advertising or any purpose unrelated to providing the Service.

If you connect your Gmail account, we request the following Google OAuth scopes:

• gmail.readonly, to sync and display your email inbox within the Service
• gmail.send, to send emails on your behalf from within the Service
• userinfo.email and userinfo.profile, to identify your Google account

What we access: Email messages, subject lines, sender/recipient addresses, timestamps, and message bodies for emails synced to your inbox view within the Service.

What we store: Email metadata and message content are cached in our database to enable inbox search and display. Emails are associated with your user account and your organization.

What we do not do: We do not use your Gmail data for advertising, market research, or any purpose other than displaying and sending email within the Service. We do not share your Gmail data with third parties except as required to provide the Service (e.g., our database hosting provider).

Google API Services User Data Policy Compliance: Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Gmail data to provide and improve the email features of the Service
• We do not transfer Gmail data to third parties except as necessary to provide the Service, as required by law, or as part of a merger/acquisition with adequate data protections
• We do not use Gmail data for serving advertisements
• We do not allow humans to read your Gmail data unless you provide affirmative consent for specific messages, it is necessary for security purposes (e.g., investigating abuse), it is necessary to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymized

We collect anonymized usage data through PostHog to understand how the Service is used. This includes:

• Pages visited and features used
• Session duration and frequency
• Browser type, device type, and screen resolution
• Referring URL

We do not use this data to identify individual users or for advertising purposes.

We use Sentry for error monitoring. When an application error occurs, Sentry may capture:

• The error message and stack trace
• Browser and device information
• The URL where the error occurred

Error data does not include your Lead Data, email content, or payment information.

You have the right to:

• Access your personal information by contacting us
• Correct inaccurate personal information through your account settings or by contacting us
• Export your Lead Data via CSV export within the Service
• Disconnect your Gmail account at any time through Settings, which stops syncing and deletes cached email data

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross context behavioral advertising, so there is nothing to opt out of.
• Right to Non Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, email us at support@nextsurplus.com. We will verify your identity and respond within 45 days.

You may revoke the Service's access to your Google account at any time through your Google Account permissions page at https://myaccount.google.com/permissions. Revoking access will stop email syncing and disable email sending through the Service.