Privacy and data protection
Last updated: 4 October 2026
NexProp CRM is provided by Irfan Invest, a company registered in the Sultanate of Oman, under the trade name NexProp. This notice explains what personal data the service holds, why, where it is stored and how you can exercise your rights under the Oman Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulations (Ministerial Decision 34/2024).
Who is responsible
Each company that uses NexProp CRM decides what it records about its own leads, clients and contacts. For that data the company is the controller, and NexProp processes it only on the company's behalf and on its instructions.
For the accounts of the people who sign in, demo requests and support tickets, NexProp is the controller.
What data we hold
- Account details: name, email address, role, profile photo, time zone and interface language.
- Company details entered at setup: company name, address, VAT and commercial registration numbers and logo.
- Workspace records a company enters: leads, contacts, deals, offers, follow ups, notes and documents.
- Demo requests sent from the website: name, email, phone number, company and job title.
- Support tickets, including any screenshots attached to them.
- Technical records: sign in events, error reports and the log of support access to a workspace.
Why we use it
- To provide the CRM and keep each company's workspace working.
- To answer support tickets and fix problems.
- To protect the service and detect misuse.
- To bill companies and meet our legal obligations.
We do not sell personal data and do not use workspace data for advertising.
Where the data is stored
The database, file storage and the application run in Tokyo, Japan, so data entered in Oman is transferred outside the Sultanate. Our providers protect it with encryption in transit and access controls.
Companies are responsible for informing the people whose data they enter and for obtaining their consent where the law requires it, including consent to this transfer.
Service providers
- Supabase: database, file storage and sign in (Tokyo, Japan).
- Vercel: application hosting (Tokyo, Japan).
- Google: only when you choose to sign in with Google.
- Anthropic: AI assistance used by the NexProp support team to read and propose fixes, only for companies whose AI support access is switched on. Every change is approved by a person.
Who at NexProp can see your data
Members of the NexProp support team can open a company's workspace to answer its support tickets and fix problems. Every such access is recorded in an access log.
How we protect it
- Every company's records are kept apart at database level, so one company can never read another company's data.
- Roles decide what each member of a company can see and change.
- All traffic is encrypted with HTTPS.
Your rights
You can ask to see your personal data, receive a copy, correct it, have it deleted, have it transferred to another provider or withdraw your consent. We answer within 45 days and free of charge.
If your data was entered by a company that uses NexProp CRM, we pass your request to that company and help it carry the request out.
How long we keep it
Workspace data is kept while the company's subscription is active. When it ends, the company can ask for an export, and the data is deleted within 90 days unless the law requires us to keep it longer.
Data breaches
If a breach puts personal data at risk, we inform the affected companies and the Ministry of Transport, Communications and Information Technology within 72 hours, and the people affected when the risk to them is high.
Data Protection Officer
For any question or request about your personal data, contact our Data Protection Officer.
- Name
- Amir Reza Shamsipour
- a.shamsipour@irfaninvest.com