NextAgency Agency Management

Mobile Application Privacy Policy

Last Updated: April 6, 2026
App Name: NextAgency Agency Management mobile application
Developer/Publisher: Take 44, Inc. (“Take 44”)
Contact Email: support@nextagency.com

1. Overview

NextAgency Agency Management mobile application (“the App”) is a business-to-business (B2B) mobile application designed for licensed insurance brokers, agents, and their staff. It provides secure mobile access to your organization’s NextAgency CRM, enabling you to view and manage cases, contacts, notes, tasks, benefits, and employees from your device.

This Privacy Policy explains what information the App accesses, how it is used, where it is stored, and your rights regarding that information.

By using the App, you agree to the practices described in this policy. If you do not agree, please do not use the App.

2. Who This App Is For

This App is intended exclusively for:

Licensed insurance agencies
Their brokers and agents
Their authorized staff members
Users with a valid NextAgency account and OAuth credentials issued by their organization’s tenant administrator

This is not a consumer application. Users must be authorized by their agency to access the App and its data. The agency must have an in-force Business Associate Agreement with Take 44, the company that publishes NextAgency.

3. Where Your Data Lives

The NextAgency server is the source of truth for all data. The App itself does not operate a separate database. All data — cases, contacts, notes, tasks, benefits, employees — is stored on and managed by the NextAgency platform, which is operated by Take 44.

The App connects to that server on your behalf to display and update your data. Any temporary copies held on your device (described in Section 5) are short-lived cache entries used to improve performance and enable limited offline access. They are not a separate or independent store of your data.

4. Information the App Accesses

4.1 Setup Information You Provide

When setting up the App, you enter:

Tenant domain: Your organization’s NextAgency subdomain (e.g., “yourcompany”)
OAuth Client ID and Client Secret: Credentials provided by your tenant administrator from the NextAgency API settings
Username and Password: Entered during the OAuth login flow, which is handled by your organization’s NextAgency server — the App never directly receives or stores your password

4.2 CRM Data Accessed via Your Organization’s Server

After authentication, the App reads and, where you take action, writes data to your organization’s NextAgency server. This may include:

Case / Business Data:

Business names, addresses (physical and mailing), phone numbers, websites
Market segment (Individual, Small Group, Large Group)
Sales status, stage, assigned broker/owner, tags
Tax ID, SSN
Effective dates, renewal dates

Contact Information:

Names, email addresses, phone numbers, mailing/physical addresses
Birth dates, titles, vendor information
Notes and tags

Notes and Tasks:

Note and task titles, descriptions, due dates, priorities, authors
Attachments (links only)

Benefits / Policies:

Insured name (whether individual or group benefit)
Carrier names, policy numbers, group IDs
Benefit types (e.g., Medical, Dental, Life)
Premium costs, deductibles, out-of-pocket limits
Effective and renewal dates

Employees:

Names, email addresses, phone numbers
Gender, employment type, start/termination dates
Dependent information (names, relationship, age)

User Profile:

Your name, email address, and role as returned by the NextAgency API after login

4.3 Information Collected Automatically

The App does not collect device identifiers, IP addresses, or telemetry data. The only automatically gathered information is:

Network status: Whether the device is online or offline, and whether connected via WiFi or cellular — used locally to determine caching behavior. This is not transmitted anywhere.
OAuth tokens: Access and refresh tokens issued by your organization’s NextAgency server, stored securely on-device.

5. What the App Can Do With Your Data

The App supports both reading and writing data to your organization’s NextAgency server. Specifically, authorized users can:

View cases, contacts, notes, tasks, benefits, and employees
Create new notes, tasks, contacts, benefits, and employees
Edit existing cases, notes, tasks, contacts, benefits, and employees

All actions are performed on your behalf and are governed by the role and permissions your organization’s administrator has assigned to your NextAgency account. Take 44 does not independently review or process the content of any data you create or modify through the App.

We do not use your data for advertising, profiling, analytics, or any purpose beyond delivering the core CRM functionality described above.

6. How Data Is Temporarily Stored on Your Device

Because the NextAgency server is the authoritative data store, the App only keeps data on your device temporarily for performance and offline access purposes:

Storage Mechanism	What Is Stored	Retention
Android Keychain and iOS Keychain (encrypted)	OAuth tokens (access & refresh), tenant configuration (domain, Client ID, Client Secret)	Until logout or “Change Server”
AsyncStorage (encrypted)	Cached API responses for offline browsing, dropdown field options	Up to 7 days; cleared on logout
In-Memory (RAM only)	Active session data, search results	Cleared when app is closed

All locally cached data is encrypted. Credentials are stored using OS-level encryption via Android Keychain and iOS Keychain, accessible only when the device is unlocked. This temporary device cache does not represent an independent or permanent copy of your data — it is a performance layer that mirrors what is already on your NextAgency server.

7. Data Sharing

We do not sell, rent, or share your data with any third party.

Data flows only between:

Your device (temporary encrypted cache)
Your organization’s NextAgency server (*.nextbroker.io or *.nextbroker.info)

The App does not transmit data to any advertising networks, analytics platforms, data brokers, or other external services.

8. Third-Party SDKs and Services

The App uses the following third-party libraries. None of them transmit data to external servers:

Library	Purpose	Data Transmitted Externally
react-native-inappbrowser-reborn	Opens system browser for OAuth login	None (browser handles auth with your server)
react-native-keychain	Secure token/credential storage	None
@react-native-async-storage/async-storage	Local offline cache	None
@react-native-community/netinfo	Network status detection	None
axios	HTTPS API client	API calls to your organization’s NextAgency server only
jwt-decode	Local JWT token parsing	None
react-native-sha256	PKCE code challenge, cache key hashing	None

No analytics, crash reporting, or advertising SDKs are integrated. The App does not include Firebase, Sentry, Crashlytics, Mixpanel, Amplitude, or any similar services.

9. Device Permissions

The App requests only the following Android permission:

Permission	Why
`INTERNET`	Required to communicate with your organization’s NextAgency server

The App does not request or use:

Camera
Microphone
Location
Device Contacts
Storage / Files
Calendar
SMS or Phone

The App declares intent queries for the phone dialer (tel:), email client (mailto:), and web browser (http:, https:) so that tapping a phone number, email address, or website link can open the appropriate app on your device. This does not grant the App access to those apps’ data.

10. Authentication & Security

OAuth 2.0 Authorization Code + PKCE: The industry-standard secure mobile authentication flow. Your credentials are entered in your organization’s web login page (opened in the system browser), not in the App itself.
HTTPS only: All network communication uses TLS encryption. Cleartext HTTP is disabled.
Token security: Tokens are stored in encrypted OS storage, never written to plain files, never included in URLs, and automatically redacted from any internal logs.
PII redaction in logs: Sensitive values (tokens, SSN, Tax ID, passwords) are automatically removed from any diagnostic logs. Logs are not transmitted externally.
Automatic token refresh: Access tokens are refreshed automatically before expiry to maintain your session without re-authentication.

11. Offline Access

The App caches API responses locally to support browsing when your device is offline. While offline, data cannot be created or modified — the cache is read-only. This cached data:

Is encrypted in local storage
Is cleared entirely when you log out
Can be manually cleared via Settings → Clear Cache
Is a temporary mirror of data that permanently resides on your NextAgency server

12. Your Controls

You have the following controls over locally stored data within the App:

Action	What It Does
Logout	Clears all OAuth tokens and cached API data from the device
Settings → Clear Cache	Manually clears all locally cached API responses
Change Server	Clears tenant configuration and signs you out entirely

Your organization controls its CRM data as the account holder on the NextAgency platform; Take 44 processes that data on your organization’s behalf through the NextAgency product. For rights related to the underlying CRM data (access, correction, deletion), contact your organization’s administrator or NextAgency support at support@nextagency.com.

13. Data Relating to Minors

This App is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this document. Continued use of the App after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy, please contact:

Take 44, Inc. Email: support@nextagency.com Website: nextagency.com

This policy applies to the NextAgency Agency Management mobile application published on Google Play and the Apple App Store. It does not govern the NextAgency web platform or API, which are covered by separate terms, available here.