Privacy Policy

Last updated: September 2026

1. Scope and Roles

Neksio is operated by Neksio Technologies (SMC-Private) Limited, a company incorporated in Pakistan (SECP registration no. 0171961). References to "Neksio", "we" or "us" mean that company. This Privacy Policy explains how Neksio processes personal data when customers use our platform to connect social channels and deploy AI agents. In most cases, our customer acts as the data controller and Neksio acts as a processor or service provider on the customer's behalf. For account, billing, and website analytics data, Neksio may act as an independent controller.

2. Supported Platforms

Our platform may connect to the following third-party services through official APIs:

• Facebook (Pages, Messenger, comments, and related Meta endpoints)
• Instagram (DMs, comments, and related Meta endpoints)
• WhatsApp Business Platform / WhatsApp Cloud API (including webhooks)
• Google Business Profile (formerly Google My Business)
• TikTok (business and messaging/comment endpoints where available)
• Shopify (store data, orders, customers, and products via the Shopify Admin API)

3. What We Process

Depending on customer configuration and granted permissions, we may process:

• Account profile data (business name, workspace users, settings)
• Connected channel metadata (page/account IDs, phone number IDs, token metadata)
• Inbox and comment content sent to connected channels
• Message event payloads received via webhooks
• Feedback and sentiment signals for analytics
• Reply drafts created by the customer or by AI tools (for example, review replies)
• Operational logs, security logs, and API request metadata

4. Why We Process Data

We process data to provide the services requested by our customers, including:

• AI agent automation for inbox and comments (for example, answering questions on WhatsApp, Facebook, Instagram, and other connected channels)
• Feedback analysis and conversation intelligence
• Drafting and sending replies to customer messages, comments and reviews, as configured by the customer
• Platform reliability, abuse prevention, debugging, and product support
• Service performance measurement and aggregated reporting

5. Platform-Specific Processing Notes

Facebook and Instagram

We process messages, comments, and related interaction events only to operate customer workflows and AI responses. We do not sell this data. Access is limited to customer configuration and authorized team members.

WhatsApp Business Cloud API

We process webhook events and message content required to deliver customer automation and support flows. Customers are responsible for template compliance and lawful messaging practices under WhatsApp policies.

Google Sign-In

When you sign in to Neksio using Google OAuth 2.0, we receive your Google account name, email address, and profile picture. This information is used solely to create and authenticate your Neksio account. We do not access any other Google account data via Sign-In, and we do not use this data for advertising or share it with third parties beyond what is required to operate the service.

Google Business Profile (Google My Business API)

When you connect a Google Business Profile account, we access review data, business profile details through the Google My Business API. This data is processed exclusively to deliver the review monitoring, reply drafting, and analytics features you have enabled.

Our use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• Google user data is used only to provide or improve user-facing features visible within Neksio.
• We do not use Google user data to serve advertisements.
• We do not allow humans to read Google user data unless you have given explicit permission, it is necessary for security or legal compliance, or the use is aggregated and anonymized for internal operations.
• We do not sell or transfer Google user data to third parties except as necessary to operate the service or as required by law.

You may revoke Neksio's access to your Google account at any time from your Google Account permissions. Revoking access will disconnect your Google Business Profile from Neksio.

TikTok

We process available business account interactions and content actions solely for configured customer workflows and analytics, subject to TikTok developer and platform terms.

Shopify

When you install the Neksio app from the Shopify App Store, we access your store's data via the Shopify Admin API under the scopes you authorize during installation. The categories of data we may access include:

• Store information: shop name, domain, currency, timezone, and contact email
• Customer data: names, email addresses, phone numbers, and shipping addresses — used solely to power messaging automations and AI-driven inbox responses you configure
• Order data: order IDs, line items, and fulfillment status — used to enable order-related automation and support workflows
• Product and collection data: product titles, descriptions, and images — used so your AI agent can recommend products in customer conversations

Shopify merchant and customer data is processed strictly to deliver the features you enable within Neksio. We do not sell or transfer this data to third parties for advertising or any purpose unrelated to the service.

Mandatory GDPR Webhooks

In compliance with Shopify's requirements, Neksio supports the following mandatory privacy webhooks:

• customers/data_request — When a Shopify merchant or their customer requests a copy of the personal data Neksio holds, we will provide the relevant data to the requesting merchant within 30 days.
• customers/redact — When a merchant requests erasure of a specific customer's data, Neksio will delete or anonymize all personal data associated with that customer from our systems within 30 days, unless retention is required by law.
• shop/redact — When a merchant uninstalls the Neksio app or requests deletion of their shop data, Neksio will delete all data associated with that store within 30 days of receiving the webhook, unless longer retention is required by law or our data retention policy.

Merchants may also submit data deletion or access requests directly by emailing info@neksio.com. To delete your Neksio account, see Delete Your Account.

Payments (Paddle)

Neksio Premium subscriptions are sold through Paddle.com Market Limited ("Paddle"), which acts as our reseller and Merchant of Record. When you buy Premium, Paddle collects and processes your payment and billing information — such as your name, email address, billing address, country, tax or VAT number, and payment card or other payment method details — as an independent data controller to process the transaction, calculate and remit taxes, prevent fraud, handle refunds and chargebacks, and meet its legal obligations. Paddle's handling of this data is governed by the Paddle Privacy Notice.

Neksio does not receive or store your full card number or security code. Paddle shares with us the information we need to manage your subscription: your customer and subscription IDs, email address, country, the plan purchased, amounts, currency, transaction and invoice records, subscription status, and the last four digits and type of your card. We use this data to activate and manage your Premium access, provide billing support, keep financial records, and comply with tax and accounting obligations. We keep billing records for as long as required by applicable tax and accounting laws.

Neksio Mobile App (Android)

The Neksio app for Android lets you and your team read and reply to customer conversations from your phone. When you use it, we process:

• Account data — your name, email address and role, to sign you in and show the conversations you are allowed to see.
• Messages — the conversations of your business, including your customers' names, phone numbers or usernames, and the messages you send and receive.
• Voice recordings — only when you tap the microphone to record a voice note. The app asks for microphone permission first, records only while you are recording, and sends the clip to your customer through the connected channel.
• Photos, videos and files — only the ones you choose to attach to a message. The app uses the system file picker and does not access your photo library or storage otherwise.
• Device identifiers — a push notification token from Google Firebase Cloud Messaging, used only to alert you about new messages.

All data is encrypted in transit (HTTPS and secure WebSockets). Sign-in tokens are stored encrypted on your device and excluded from device backups. The app shows no ads, does not use the advertising ID, and contains no third-party analytics or tracking. You can request deletion of your account from the app (Settings → Delete account) or on our Delete Your Account page.

6. AI and Knowledge Base Usage

Customer-provided knowledge base content and channel data are used to produce contextual AI responses (for example, RAG-based answers). Unless explicitly agreed in writing, data processed for customer workflows is not used to train public foundation models. Customers retain ownership of their business content.

7. Legal Basis

Where applicable, we process personal data based on contractual necessity, legitimate interests in secure operations, and legal obligations. Customers are responsible for ensuring they have an appropriate legal basis to collect and share end-user data with Neksio.

8. Data Sharing and Subprocessors

We may share data with trusted subprocessors that provide hosting, infrastructure, monitoring, and support tooling, with Paddle.com (our Merchant of Record) for payment processing, and with Google Firebase Cloud Messaging to deliver mobile push notifications, as described above. We require contractual safeguards and access controls. We may also disclose data when required by law or valid legal process.

9. International Transfers

Data may be processed in countries where our providers operate. Where required, we implement transfer safeguards such as standard contractual clauses or equivalent legal mechanisms.

10. Security

We implement technical and organizational safeguards including encryption in transit, access control, audit logging, secret management, and incident response procedures. No system can guarantee absolute security, but we continuously improve controls.

11. Retention

We retain data for as long as needed to provide services, fulfill contractual obligations, resolve disputes, and comply with legal requirements. Customers may request deletion of workspace data subject to legal and operational limitations.

12. Customer Controls and User Rights

Customers can revoke platform access tokens, disconnect channels, and request data deletion. Depending on jurisdiction, individuals may have rights to access, correction, deletion, restriction, portability, and objection. Requests can be submitted through the relevant customer account owner or directly to us where applicable.

13. Third-Party Platform Terms

Use of connected channels is also governed by the applicable third-party platform terms and policies (including Meta, WhatsApp Business, Google, and TikTok). Customers are responsible for complying with those terms when using our automation features.

14. Children's Data

Our services are intended for business use and are not directed to children. Customers must not use the platform to knowingly process children's data in violation of applicable law.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material updates will be reflected by the updated date on this page and, where appropriate, notified through our platform or website.

16. Contact

For privacy questions or data requests, contact Neksio Technologies (SMC-Private) Limited at info@neksio.com.