Summary
- We process business and conversation data only to provide and improve nexChat for the businesses that use it.
- We do not sell personal data or use customer conversations for advertising.
- Data received from Meta platforms (such as WhatsApp or Instagram) is used only to provide the features a business has enabled.
- You can request deletion at any time. See our Data Deletion Instructions.
1. Introduction
nexChat is an AI-powered customer conversation and business operations assistant for small businesses. It helps businesses answer customer questions, manage product catalogs, carts and orders, share payment instructions, track payment status and keep customer and conversation history, including through messaging channels the business chooses to connect.
This Privacy Policy explains what information is processed when you use the nexChat website at nexchat.exiralabs.com, the nexChat application, and any connected messaging integrations (together, the "Service"), why it is processed, and the choices you have.
2. Who operates nexChat
nexChat is developed and operated by Exira Labs ("Exira Labs", "we", "us", "our"). You can learn more about us at exiralabs.com.
For any privacy question or request, contact us at support@exiralabs.com.
3. Our role and yours
nexChat is used by two kinds of people:
- Business users: businesses and their staff who create a nexChat account to manage their customer conversations.
- End customers: people who message a business that uses nexChat.
For account, billing and website information about business users, Exira Labs decides how the information is used and is responsible for it.
For end-customer information (such as messages, order details and contact details) that a business processes through nexChat, the business decides why and how that information is used, and Exira Labs processes it on the business's behalf to provide the Service. If you are an end customer, the business you contacted is your primary point of contact for privacy questions about your conversations, but you may also contact us and we will help where we can.
4. Information we process
Depending on how the Service is used, we may process the following categories of information:
| Category | Examples |
|---|---|
| Account and contact information | Name, email address, phone number, password (stored in hashed form) and account settings of business users. |
| Business profile information | Business name, description, opening hours, delivery areas, policies, FAQs, payment instructions and other knowledge the business provides. |
| Product catalog data | Products, descriptions, images, prices, variants (such as size or colour) and inventory levels. |
| Customer messages and conversation history | Message content (text and any media sent), timestamps, delivery and read status, and the name, profile name, username or phone number shown by the messaging channel. |
| Orders, payment status and fulfilment | Cart contents, order details, delivery address and notes provided by the customer, payment status recorded by the business, and fulfilment status. nexChat does not collect or store card numbers or bank login details. |
| Technical and usage information | IP address, browser and device type, log and diagnostic data, and how features of the application are used, where applicable. |
| Information from connected integrations | Where a business connects a third-party platform, identifiers and data that platform provides, such as account IDs, page or phone number IDs, access tokens and webhook events (see section 8). |
| Communications with us | The content of emails and support requests you send us. |
5. How we collect information
- Directly from business users, when they sign up, configure their business, upload a catalog or record orders and payments.
- From end customers, when they send messages to a business that uses nexChat. These messages reach us through the channel the business has connected.
- From connected third-party platforms, such as Meta's WhatsApp Business Platform or Instagram messaging APIs, when a business authorises nexChat to access them.
- Automatically, through server logs and essential application functions when you use the website or application.
6. How we use information
We use information to:
- Provide the Service: receive and send messages, generate and suggest replies, help customers find products, build carts, create orders, share payment instructions and track payment and fulfilment status.
- Show businesses their conversations, customer history and orders in the nexChat dashboard.
- Let businesses review conversations and take over from the AI at any time.
- Maintain connections with integrated platforms, including receiving webhook notifications and routing them to the correct business account.
- Secure the Service, prevent abuse and fraud, and troubleshoot problems.
- Maintain and improve the reliability, quality and features of the Service.
- Communicate with business users about their account, support requests and important changes to the Service.
- Comply with legal obligations and enforce our Terms of Service.
We do not sell personal data, and we do not use customer conversations to target advertising or share them with data brokers or marketing platforms.
7. AI processing and automated responses
nexChat uses artificial intelligence, including large language models provided by third-party AI service providers, to understand customer messages and generate responses or actions. To do this, relevant parts of a conversation and the business's own information (such as its catalog, policies and FAQs) are sent to the AI provider for processing.
- Businesses control whether the AI replies automatically, suggests replies for review, or is paused for a conversation.
- AI-generated responses can be inaccurate or incomplete. Businesses remain responsible for the information they provide and for reviewing important actions such as order confirmations and payment status.
- The AI acts within limits set by the business. It does not make decisions that produce legal or similarly significant effects on end customers on its own.
- We choose AI providers whose terms restrict them from using the data we send to train their general-purpose models, and we send only the data needed for the request.
- We do not use end-customer conversations to train our own AI models for use with other businesses.
8. Meta, Instagram and WhatsApp platform data
Where a business connects nexChat to products of Meta Platforms, Inc. (such as the WhatsApp Business Platform, Instagram messaging or Facebook Login), we may receive:
- Account identifiers, such as Meta user IDs, WhatsApp Business Account IDs, phone number IDs, Instagram professional account IDs and Facebook Page IDs.
- Access tokens and permissions granted by the business during authorisation.
- Inbound and outbound message content, timestamps, and delivery and read receipts.
- The public profile name, username or phone number of people who message the business.
- Webhook event metadata needed to deliver messages and keep the connection working.
We use this data only to provide the messaging and business features the business has enabled in nexChat. In particular, we:
- Comply with the Meta Platform Terms, Developer Policies and the applicable WhatsApp and Instagram policies.
- Do not sell, license or purchase Platform Data, or use it for advertising, profiling unrelated to the Service, or to build data sets about individuals.
- Do not share Platform Data except with service providers who help us run nexChat (section 10), or where required by law.
- Store access tokens using encryption and limit access to staff and systems that need it.
- Delete Platform Data when it is no longer needed to provide the Service, when a business disconnects the integration and requests deletion, or when we receive a valid deletion request.
Businesses can disconnect a Meta integration at any time from nexChat or from their Meta account settings. To delete data already stored, follow our Data Deletion Instructions.
Use of WhatsApp, Instagram and Facebook is also governed by Meta's own terms and privacy policy.
9. Legal bases for processing
Where data protection laws require a legal basis, we rely on:
- Contract: to provide the Service to business users under our Terms of Service.
- Legitimate interests: to secure, maintain and improve the Service and communicate with users, balanced against individuals' rights.
- Consent: where we ask for it, which you may withdraw at any time.
- Legal obligation: where we must process or retain data to comply with law.
For end-customer data processed on a business's behalf, the business is responsible for having an appropriate legal basis, including any consent required to message its customers.
11. Data retention
We keep information only for as long as needed for the purposes in this policy:
- Account and business information is kept while the account is active, and deleted after the account is closed, unless we must keep some of it for legal, tax or dispute-resolution reasons.
- Conversation, customer and order data is kept while the business's account is active, or until the business deletes it or asks us to.
- Access tokens for connected platforms are deleted when the integration is disconnected.
- Technical logs are kept for a limited period for security and troubleshooting, then deleted or anonymised.
Residual copies in backups are removed as those backups expire on their normal rotation.
12. Data deletion
Business users can delete conversations, customers, products and orders in the application, and may close their account at any time. Anyone can request deletion of their data by emailing support@exiralabs.com.
Full step-by-step instructions, including for data received from Facebook, Instagram or WhatsApp, are on our Data Deletion Instructions page.
13. Security
We use reasonable technical and organisational measures to protect information, including encryption of data in transit, encrypted storage of access tokens and credentials, access controls limiting who can view data, and monitoring for misuse. No system is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify affected users and authorities as required by law.
14. International data transfers
Our service providers may process information in countries other than the one where you live. Where required, we use appropriate safeguards for these transfers, such as standard contractual clauses.
15. Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and get a copy.
- Correct inaccurate or incomplete data.
- Delete your data.
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent where processing is based on consent.
- Complain to your local data protection authority.
To exercise these rights, email support@exiralabs.com. We may need to verify your identity before acting on a request. If your request concerns data a business controls, we may refer it to that business or help them respond.
16. Children's privacy
nexChat is a business tool and is not directed at children. Business accounts may only be created by people who are at least 18 years old, or the age of majority where they live. We do not knowingly collect personal data from children for our own purposes. If you believe a child has provided us with personal data, contact us and we will delete it.
18. Changes to this policy
We may update this Privacy Policy as nexChat develops. We will change the "Last updated" date above and, for material changes, notify business users by email or in the application before the changes take effect.
19. Contact us
If you have questions about this Privacy Policy or how we handle information, contact Exira Labs at:
Email: support@exiralabs.com
Website: nexchat.exiralabs.com