NextLead CRM

Artificial intelligence is labelled coming soon, and it is labelled that honestly, which is worth recording in a category where most vendors this size claim the opposite. The feature block describes what the assistant will do once it exists, generating follow up messages, answering common questions, reading the state of each lead and proposing next steps, and it carries the same coming soon tag as the messaging integration sitting beside it.

The removal test therefore has nothing live to remove. What ships is a visual pipeline, reminders, tasks and a client list, every action driven by a person, and the convention here reserves the lowest band for a marketed claim that fails the removal test rather than for a product that has declined to make one yet.

Everything this product does is done by a person, which keeps the row uncomplicated. Reminders are set by the user, stages are moved by the user, tasks are assigned by the user, and no agent, queue or automated action exists anywhere in the shipped system. One real control appears in the user agreement: access is limited to the users authorised by the account holder, and misuse of that access can bring suspension or cancellation.

Past that the published surface is empty, with roles, permission tiers, approval steps and activity audit all undescribed for a system that holds an entire company's pipeline. The announced assistant sharpens the question rather than answering it, since a feature that reads lead state and drafts messages arrives with no stated oversight model at all.

The announced assistant is described by capability and by nothing else. It will generate follow up messages, answer common queries, analyse the state of each lead and suggest next steps, and provider, model family, version, hosting arrangement and processing terms are absent from the site and from both legal documents.

Both of those documents were revised in April 2026 and neither mentions artificial intelligence anywhere, which means the capability was announced on the marketing pages with no corresponding movement in the contract or the privacy policy. Worth crediting against that: the feature is tagged coming soon rather than sold as present, so a buyer is at least not being told a model is running today.

The evidence section is the weakest surface on this site and three separate things undo it. The statistics block, headed with the claim that statistics do not lie, publishes four percentages for how many follow ups a close requires, and every one of them renders as zero to a fetcher because the figures are a client side counter that never runs. Any machine reading the page, an answer engine included, sees four zeros where the proof was meant to sit.

The three testimonials name individuals and give roles, which is better than this block's average, and then all three are served the same single image file, and the first of them is the founder describing the product he built himself, placed inside a customer testimonial section. Four customer logos sit above them as images behind dead anchors, no customer company is named in text anywhere, and not one quantified outcome is attributed to anybody.

This axis barely bites here and the reason is structural, exactly the note this category carries from its creation: the shipped product sends nothing to a recipient. Messaging through a conversation platform is on the roadmap, and what runs today produces internal reminders and tasks only. What exists is a short prohibited use list in the user agreement covering illicit, fraudulent and unlawful use, malware and reverse engineering.

The compliance apparatus that does exist points at the vendor's own marketing rather than at the customer's selling: commercial communications are separated out as secondary purposes with a named address for objecting, and restriction of use for commercial purposes is enumerated as a user right.

Electronic marketing statutes go unnamed in every jurisdiction the vendor claims to operate across, and consent, suppression and recipient removal are undescribed against the moment the messaging feature ships.

The strongest surface this vendor has, and it outranks vendors many times its size in this index. The controller is named with a full street address, a dedicated privacy address handles requests, and five data categories are enumerated with specifics rather than gestured at. Purposes are split into primary and secondary with a named route to object to the secondary ones. Legal basis is enumerated across four grounds.

Four regimes are named individually, the Mexican federal statute, the Californian pair, the Texan statute and the European regulation, and naming a state level statute most vendors omit suggests this was written rather than generated. Rights run to six including portability and restriction of commercial use, sale of personal data is denied flatly, transfer safeguards are named for international movement, and confidentiality is stated to survive the relationship.

Three things hold it off the top band. Two privacy policies are live at once, one dated June 2025 giving an administration address and one dated April 2026 giving a strategy address, with the older still reachable and still indexed. Retention is left to unpublished internal policies with no period attached. And every data subject in the document is the customer, while the prospects and clients whose names, telephone numbers and entire follow up histories sit inside the platform appear nowhere in it.

The cleanest provenance any architecture can offer, and unusually for this block the contract states it rather than leaving it implied. Every record in the system is entered by the customer. A purchased database, an enrichment supplier, a waterfall, a credit pool and a scraped source are all absent from the product entirely.

The user agreement then goes further than most at this size and states that the data a user loads, records or manages is the property of that user, that the vendor acts as processor over it, and that it will not access, modify or disclose that data except to provide the service, to run an integration the user has authorised, or to meet a legal obligation. Held off the top band by two open edges.

The calendar integration draws event data, times and descriptions from an external account, which is addressed properly, while services from a large social platform are named as possible integrations with no scope or purpose attached to them. And the individuals inside the customer's own pipeline have no stated basis and no route of their own, which is the same gap running through the privacy policy.

Exposure is low by architecture and the one place it exists carries an explicit conformance position, which is the combination this axis rewards. Scraping, identity rental, account rotation, a browser extension and automation against a professional network are all absent.

The single external attachment described is a calendar integration, and both the user agreement and the privacy policy state adherence to that platform's own user data policy by name, including its limited use provisions, with the privacy policy marking the clause as critical. A separate clause allocates responsibility for any third party integration to the user under that provider's own terms. Two things keep it off the top band.

The homepage marks the same calendar integration as coming soon while two legal documents already govern it as operating, so a buyer cannot tell from the site whether it exists. And a conversation platform integration is announced with no position taken on its business messaging rules, which are considerably stricter than a calendar's.

Affirmative statements exist and they sit in the contract rather than the marketing, which counts for something at this size. The vendor undertakes not to access, modify or disclose customer data outside three named circumstances, denies selling personal data, limits access to authorised personnel and to providers bound by confidentiality, and makes that confidentiality survive the end of the relationship. Set against that, the question this axis actually asks goes unanswered.

Improving the service is enumerated as a legitimate interest, and usage analysis and functionality development sit among the secondary purposes, so customer activity does feed product work with an opt out available. Whether anything trains on customer content is addressed nowhere in either document.

The announced assistant turns that from theoretical into live, because a feature that reads the state of every lead and drafts messages from it was announced with no accompanying position in a contract revised the same season.

Structural again, and the category note applies: nothing in the shipped product reaches a recipient, so the strongest version of this question is not yet askable here. The version that is askable goes unanswered. Every data subject in the privacy policy is the customer, which leaves the prospect or client whose name, telephone number, comment history and complete follow up record sits inside the platform with no notice, no lookup, no route and no rights statement of their own.

The announced assistant will generate follow up messages that go out under the seller's name, and no position is taken on whether a recipient learns a model wrote them, which is the European obligation now in force for systems that interact with people, and the same European regime the vendor claims compliance with elsewhere in that document.

The integrations strip on the homepage is entirely placeholder. Every entry under it is tagged coming soon and every link behind it is an empty anchor, with a calendar and a conversation platform named as the two intended destinations. Three further links in the site footer go nowhere in the same way, the help centre, the sales academy and the cookie policy.

Against that picture, both legal documents describe the calendar integration as operating, and the privacy policy carries the kind of platform user data disclosure a provider requires before it will approve an application, which suggests the connector is live and the marketing strip is stale rather than aspirational. Either way a buyer cannot tell which.

What is missing throughout is the equipment a system of record needs most: a programmatic interface, webhooks, an import or export function, a marketplace listing and developer documentation are absent from every surface read.

Corporate jurisdiction is unambiguous and data jurisdiction is unaddressed, which is the split this index keeps recording. The entity is named with a full Guadalajara street address, Mexican law governs, and Guadalajara courts are selected as the exclusive forum. Where the data actually sits is stated nowhere: hosting provider, country, region and residency options are absent from every page and from both documents.

The privacy policy does confirm that international transfers happen and names standard contractual clauses and other recognised mechanisms as the safeguard, which is what holds this clear of the bottom band, and it identifies neither the origin nor the destination of those transfers. Providers are described only by category, technology suppliers for email and databases, analytics and marketing tools, and not one of them is named.

The entire security disclosure is three bullet points inside the privacy policy: encryption of data, access control and secure authentication. A standard, certification, audit, report, attestation or penetration test is named nowhere on the site, a trust page or security page is absent from the navigation and the footer, and no route is published for reporting a vulnerability.

This is a system of record holding a company's whole customer list, pipeline, contact details, comment history and activity log, which makes the absence squarely applicable rather than incidental. The user agreement does commit to a minimum annual availability of ninety nine percent, and availability is a different thing from security, as this index has recorded before. A documented control set inside the privacy policy would move this one band, which is precisely what separated two vendors graded earlier in this same sweep.

The purchase path is published in full and in local currency, which is more than several of this index's largest vendors manage. Two hundred and ninety five pesos per user per month, three thousand pesos per user per year with the sixteen percent saving stated on the card, one plan carrying every feature so there is no gate to discover later, a thirty day free trial, and cancellation available at any point before the billing date. A buyer can budget a team of any size exactly.

Three defects hold it off the top band and a buyer should see all three. The frequently asked questions explain the difference between an essential plan and a business plan, and neither exists on the price card, which sells monthly, annual and enterprise. The annual tier's own button is a broken doubled address leading nowhere, sitting directly on the paid conversion path. And the enterprise tier is quote only with a conversation platform deep link as its entire contact route. Worth noting alongside these: the vendor's own listing on a major review site advertises a different entry price under a plan name that appears nowhere on its site.

Better documented than most of this index, and the document is candid about its own limits, which is what this axis rewards. The user agreement fixes a maximum of thirty calendar days for secure deletion once a subscription is cancelled and outstanding amounts are settled, grants the user an advance right to request a backup, states plainly that deletion is final and irreversible, and a dedicated account deletion page sits in the footer.

Ownership is settled separately, with the data a user loads stated to be that user's property. The candid part is an exclusion list and it deserves reading twice against what this product is sold for. The backup is limited to registered contact details, and comments, histories, internal notes, activity logs and anything derived from use of the system are expressly excluded from it.

The product's entire promise is that a follow up is never forgotten, and its contract says the follow up record does not leave with the customer. Off the top band on that substance and on two further points: a self serve export function, format or path is described nowhere, and the privacy policy enumerates portability as a user right in the same month the user agreement enumerates what cannot be carried out.

The shipped product sends nothing, so this axis reaches only as far as the category note says it will reach on a system of record. Reminders, alerts and task notifications run inside the platform and go to the seller. Messaging out to a contact through a conversation platform is announced as coming, and it arrives with no sending posture attached to it whatsoever: volume guidance, template and consent handling, complaint routing and a position on that platform's business messaging rules are all absent, and those rules are stricter than most sending surfaces this index grades. Graded here on what is knowable, with the structural context carried in this note rather than in the band.

The buyer is described once, directly, and the answer excludes nobody. Asked who can use the platform, the vendor answers anyone with active commercial processes, then lists independent sellers, entrepreneurs, sales teams, agencies, smaller businesses and large companies, which is the whole market rather than a segment of it. Some shape emerges indirectly and it is worth reading.

Pricing is denominated in Mexican pesos, the site and both legal documents are Spanish only, the entity and its chosen forum are in Guadalajara, and the three testimonials place the product in insurance, furniture retail and general owner led selling, so the real market is legible even though it is never stated. Absent is everything a buyer actually compares on: seat bands, customer count, a region statement, industry focus, any ceiling, and any description of who this product would be wrong for.