Privacy Policy

It matters which data is in question:

• When you visit our website or hold an account with us, we are the controller of your data — your contact details, billing information, and how you use the service.
• When an agency uses the Next Lead CRM, that agency is the controller of the records it stores about its own leads, students, and staff — including student documents such as passports — and we act only as a processor, handling that data on the agency’s instructions. Individuals should direct requests about those records to the agency they applied through.

• Account & billing: name, work email, phone, agency name, and the billing details needed to provide and invoice the service (in BDT).
• Enquiries: what you send us through the contact form.
• Usage & device: log data, IP address, browser, and basic analytics used to keep the service secure and working.
• CRM content (as processor): whatever an agency enters — leads, students, applications, documents, and payments — processed only to run the service for that agency.

To provide, maintain, and secure the service; to process payments and support requests; and to comply with the law. We do not sell personal information.

We process data to perform our contract with you, to meet legal obligations, and for our legitimate interest in running and securing the service; where required, we rely on consent. Agencies are responsible for having a lawful basis and any consent needed from the individuals whose data they store in the CRM.

We share data only with the service providers who help us run the platform — hosting and infrastructure, email delivery, search, and file storage — under confidentiality obligations, and where the law requires it. If an agency chooses to connect an integration such as Meta or Google Lead Ads, data flows to those providers under their own terms.

Each agency’s data is scoped to its own organisation; the platform is built so one agency cannot see another’s records. We use access controls, encryption in transit, and least-privilege access to sensitive data such as student documents. Data is hosted in Bangladesh. No method of storage or transmission is perfectly secure, but we work to protect your information.

We keep account data while your account is active and as needed for legal, tax, and security purposes. CRM content is retained while the agency’s account is active; on termination, an agency may export its data within the window stated in our Terms, after which it is deleted.

If an agency connects its Facebook Page to Next Lead, the agency’s administrator signs in with Facebook and chooses the Page. Through Meta’s permissions we then receive:

• the list of Pages the administrator manages, with each Page’s ID and name, so they can choose one;
• an access token for the Page they selected, which we store encrypted;
• the answers submitted on that Page’s Lead Ads forms, which become leads in the agency’s own account;
• messages sent to that Page on Messenger or Instagram, shown in the agency’s inbox, where messaging is enabled.

We use this data only to provide those features to the agency that connected the Page. We do not sell it, use it for advertising or profiling, or share it with other agencies. Each agency sees only its own Page data. The agency can disconnect at any time from Integrations, and can also remove the app in Facebook under Settings → Business integrations; when it does, we stop receiving data from that Page.

You can ask us to delete the data we hold about you by emailing digitosbd@gmail.com from the address linked to your account; see our data deletion instructions. We confirm the request and delete the data within 30 days, unless the law requires us to keep some of it. Data an agency holds about its own leads and students is controlled by that agency, so we pass those requests to the agency.

Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal information by contacting digitosbd@gmail.com. If your request concerns records an agency holds about you in the CRM, please contact that agency, which controls the data.

We use only what the site needs to function, plus small preferences saved in your browser (such as your chosen language and theme). We keep analytics minimal and do not use advertising trackers on this site.

Our service is for businesses, not children. Agencies may store data about applicants who are minors; as controllers, they are responsible for handling that data lawfully.

Where data is processed outside Bangladesh, we take the steps required by applicable law to protect it.

We may update this policy. We will change the date above and, for material changes, take reasonable steps to let you know.

Digit OS (a Digit Pulp company), Hazipara Singapore Market, 5th floor, Agrabad, Chattogram, Bangladesh. Questions about this policy or your data: digitosbd@gmail.com.