Privacy Policy

This Privacy Policy explains how NexlyFlow Pte. Ltd. (UEN 202632611H), a company incorporated in Singapore (“NexlyFlow”, “we”, “us”, or “our”), collects, uses, discloses, and protects personal data when you use the NexlyFlow platform, websites, and related services (the “Service”). We handle personal data in accordance with the Singapore Personal Data Protection Act 2012 (“PDPA”) and other applicable data protection laws.

1. Scope

This Policy applies to personal data we process about our account holders and website visitors, and to business contact information processed within the Service. If you use NexlyFlow to contact individuals, you act as the party responsible for that data and are required to have your own lawful basis and privacy notices in place.

2. Information We Collect

We collect the following categories of information:

• Account information — such as your name, work email address, phone number, password, and company details you provide when registering.
• Usage and technical data — such as log data, device and browser information, IP address, and activity within the Service.
• Billing information — such as plan, transaction records, and limited payment details processed securely by our third-party payment processors (we do not store full card numbers).
• Business records — company and business-contact information made available within the Service that is compiled from official business registries and other public sources.
• Communications — messages, support requests, and campaign content you create or send through the Service.

3. Sources of Data

We obtain personal data directly from you, automatically through your use of the Service, and from official business registries and other publicly available or lawfully licensed sources for the business records feature. Business-contact information is intended for legitimate B2B communication.

4. How We Use Information

We use personal data to provide, operate, secure, and improve the Service; to create and manage your account; to process payments; to provide customer support; to communicate service-related information; to prevent fraud, abuse, and spam; to comply with legal obligations; and for legitimate business purposes consistent with this Policy and applicable law.

5. Legal Bases and Consent (PDPA)

Where required, we collect, use, and disclose personal data with your consent or on another lawful basis permitted under the PDPA, such as the legitimate interests of NexlyFlow or a third party, the performance of a contract with you, or compliance with legal obligations. You may withdraw consent as described below, subject to legal or contractual restrictions.

6. Disclosure of Information

We do not sell your personal data. We may disclose personal data to: service providers and sub-processors who help us operate the Service (for example, hosting, email/SMTP delivery, and payment processing) under appropriate confidentiality obligations; professional advisers; authorities where required by law or to protect our rights; and, in connection with a merger, acquisition, or reorganisation, to the relevant parties.

7. Third-Party Services and Links

The Service integrates with and may link to third-party services and websites, including email/SMTP providers, payment processors, and external sites. These third parties operate under their own terms and privacy policies, and we are not responsible for their content, security, or data practices. We encourage you to review the privacy policies of any third-party service before providing them with personal data. Any information you share with a third party is governed by that third party’s policies, not this one.

8. Data Security and Confidentiality

We treat the data in your workspace as confidential and apply reasonable administrative, technical, and organisational measures designed to protect personal data against unauthorised access, use, alteration, disclosure, or loss. These measures include access controls, encryption in transit, and restricting access to personnel who need it to operate the Service. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal data for as long as necessary to provide the Service, to comply with our legal obligations, resolve disputes, and enforce our agreements. When personal data is no longer required, we will take reasonable steps to delete, anonymise, or securely dispose of it.

10. International Transfers

We may process and store personal data in Singapore and in other countries where we or our service providers operate. Where personal data is transferred outside Singapore, we take reasonable steps to ensure it is afforded a standard of protection comparable to that under the PDPA.

11. Your Rights under the PDPA

Subject to applicable law, you may request access to the personal data we hold about you, request correction of inaccurate or incomplete data, and withdraw consent to our continued collection, use, or disclosure of your personal data. To exercise these rights, contact us using the details below. We may need to verify your identity before responding, and some requests may be subject to legal exceptions or limitations.

12. Cookies

Our website and application use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Service is used. You can control cookies through your browser settings; disabling certain cookies may affect how the Service functions.

13. Children

The Service is intended for business use and is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children.

14. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date of this document and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

15. Contact and Data Protection Queries

If you have questions about this Policy, wish to exercise your rights, or have a data protection concern, please contact us at:

NexlyFlow Pte. Ltd.
UEN 202632611H
Email: info@nexlyflow.com

Please also review our Terms of Service, which govern your use of the Service.

Data Sources & Attribution

Contains information from the ACRA Information on Corporate Entities datasets accessed from data.gov.sg, which is made available under the terms of the Singapore Open Data Licence version 1.0.

NexlyFlow Pte Ltd is an independent company and is not affiliated with, or endorsed by, the Accounting and Corporate Regulatory Authority (ACRA) or the Singapore Government. Company information in the NexlyFlow library is provided "as is" for business reference only; users are responsible for how they use it and for complying with applicable laws, including the Personal Data Protection Act 2012.

Unsubscribes and Suppression

When a recipient clicks the unsubscribe link in any email sent through NexlyFlow, that address is added to the sending customer’s suppression list automatically, and future campaigns from that customer skip it. Suppression entries created by an unsubscribe cannot be removed by the customer. We do not sell personal data to third parties.

Contact Information Removal

If you believe that any contact information available through NexlyFlow affects your rights or interests, or you do not wish your details to appear in our library, please contact us at help@nexlyflow.com. We will remove the information within 24 hours of receiving your request, and add it to our suppression list so it will not be re-imported in the future.

WhatsApp Business Platform & Meta Data Practices

Last updated: 8 September 2026

NexlyFlow (operated by NexlyFlow Pte Ltd, Singapore) provides customer-engagement software that lets businesses (“our customers”) communicate with their own contacts through the WhatsApp Business Platform, which is provided by Meta Platforms, Inc. and its affiliates (“Meta”). This section explains how we handle information when WhatsApp is used through NexlyFlow. It supplements, and does not replace, the rest of this Privacy Policy.

1. Our role

For WhatsApp conversations, our customer is the data controller: they decide whom to message, what to say and why. NexlyFlow acts as a data processor and as a Meta Business Solution Provider, processing messages on our customer’s instructions. Meta is an independent controller for the operation of the WhatsApp service itself, under the WhatsApp Business Data Processing Terms.

2. Information we process

• Contact identifiers: WhatsApp phone numbers, display names and profile names of people who message our customers or whom our customers message with consent.
• Message content and metadata: the text, media and templates exchanged, timestamps, delivery and read status, and the WhatsApp message identifiers Meta assigns.
• Business account data: our customer’s WhatsApp Business Account ID, phone number ID, display name, quality rating, messaging limits and approved message templates, obtained through the Meta Graph API.
• Consent records: when and how a contact opted in or out of receiving messages, and the lawful basis our customer recorded.
• Usage and diagnostic data: webhook events, delivery errors and system logs needed to keep the service running and to detect abuse.

3. How we use it

• To send and receive WhatsApp messages on behalf of our customers, including template messages, replies and automated responses they configure.
• To show our customers a shared inbox, contact records, conversation history and delivery analytics.
• To enforce WhatsApp’s 24-hour customer-service window, opt-out requests (“STOP”), messaging limits and Meta’s Business Messaging Policy.
• To provide optional AI features (lead scoring, intent detection, reply suggestions) that analyse conversation text for our customer. These features can be switched off per workspace.
• To secure the platform, prevent spam and fraud, and comply with legal obligations.

We do not sell WhatsApp data, do not use it to advertise to end users, and do not use message content to train general-purpose AI models.

4. Sharing

• Meta: messages are transmitted through Meta’s WhatsApp Business Platform. Meta receives message content and metadata as necessary to deliver them, under its own terms. See the WhatsApp Business Policy, the WhatsApp Privacy Policy and the Meta Privacy Policy for how Meta handles your data.
• Our customer: the business you are communicating with sees the conversation and your contact details in their NexlyFlow workspace.
• Sub-processors: hosting (Hostinger), email delivery, and AI providers used only for the features described above. A current list is available on request.
• Legal: where required by law, regulation or valid legal process.

5. Retention

Conversation data is kept for as long as our customer’s account is active and for up to 90 days after it closes, after which it is deleted or anonymised. Consent records are kept for as long as needed to demonstrate lawful messaging. Diagnostic logs are kept for 30 days.

6. Your rights and choices

• Opt out: reply STOP to any message. The sending business will not send you further marketing messages, and we record the opt-out.
• Access, correction, deletion: contact the business that messaged you, or contact us at help@nexlyflow.com and we will forward your request to the relevant customer and act on their instructions. We respond within 30 days. Step-by-step instructions: nexlyflow.com/data-deletion.
• Singapore PDPA: individuals in Singapore may exercise access and correction rights under the Personal Data Protection Act by writing to help@nexlyflow.com.

7. Security

WhatsApp access tokens are stored encrypted; data is transmitted over TLS; access is restricted to our customer’s authorised team members and to NexlyFlow staff on a need-to-know basis. Webhook payloads from Meta are verified using Meta’s signature mechanism before processing.

8. International transfers

Data is processed in Singapore. Meta may process WhatsApp data in other countries in accordance with its own transfer mechanisms. Where we transfer personal data outside Singapore, we do so in accordance with the PDPA transfer requirements.

9. Contact

NexlyFlow Pte Ltd · Singapore · help@nexlyflow.com

Facebook Login & Meta Platform Data

NexlyFlow offers “Facebook Login for Business” so that our customers can connect their WhatsApp Business Account to NexlyFlow without copying credentials by hand. This section explains what we receive from Meta when you use it. Meta’s own handling of your Facebook data is described in the Meta Privacy Policy and Meta Terms of Service.

What we receive

• Public profile (public_profile): your name, profile picture and Facebook user ID, used only to show who connected the account and to keep an audit trail.
• Business assets you authorise (whatsapp_business_management, whatsapp_business_messaging): the WhatsApp Business Account ID, phone number IDs, display names and an access token scoped to those assets, used to send and receive messages and manage templates on your behalf.

What we do with it

• Establish and maintain the connection between your NexlyFlow workspace and your WhatsApp Business Account.
• Store the access token encrypted at rest; it is used only for the WhatsApp API calls described in the WhatsApp section above.
• We do not post to your Facebook profile or pages, do not read your personal Facebook content, and do not share Facebook data with third parties except the sub-processors needed to run the service.

Revoking access

You can disconnect at any time from Settings → Connection → Disconnect in NexlyFlow, which deletes the stored token. You can also remove NexlyFlow from Facebook Settings → Apps and Websites; we receive Meta’s deauthorisation notice and delete the token within 24 hours.

Data deletion

To have all data NexlyFlow holds about you deleted, follow the steps at nexlyflow.com/data-deletion or email help@nexlyflow.com. Requests are completed within 30 days.