1. Data We Collect
When you use NEXICFLOW, we collect the following categories of information:
- Account Information — Your full name, email address, and business name provided during registration
- Business Information — Your business type, address, and WhatsApp phone number (used to build your storefront's WhatsApp contact link)
- Business Content — Product/service details, FAQs, and other business information you provide, used to generate your storefront's website copy
- Usage Data — Information about how you use the Service, including feature usage, session duration, and interaction logs
- Technical Data — IP address, browser type, device information, and cookies for authentication and security purposes
Your WhatsApp phone number is used only to build a direct contact link on your storefront — messages sent through it go straight to your own WhatsApp, and NEXICFLOW never sees or processes their content.
2. How We Use Your Data
We use the data we collect to:
- Provide the Service — Generate your AI-powered storefront website, verify payment receipts, and power marketplace features
- Account Management — Manage your subscription, authenticate your identity, and maintain your workspace
- Service Improvement — Understand how the Service is used to improve features and fix bugs (using anonymized and aggregated data only)
- Communication — Send you important service updates, security notifications, and (with your consent) marketing communications
- Legal Compliance — Comply with applicable laws, regulations, and legal processes
We do not sell your personal data to third parties.
3. Data Security
We take data security seriously and implement multiple layers of protection:
- Encryption at Rest — Sensitive data including API credentials and connection tokens are encrypted using Fernet symmetric encryption (AES-128-CBC)
- Encryption in Transit — All data transmitted between your browser and our servers is encrypted using TLS/HTTPS
- Access Controls — Strict access controls ensure only authorized systems can access your data
- Regular Audits — We conduct regular security reviews of our systems and practices
While we implement industry-standard security measures, no system is 100% secure. We recommend using a strong, unique password and enabling two-factor authentication where available.
4. Third-Party Services
NEXICFLOW integrates with the following third-party services to deliver functionality:
- Google Gemini AI — We use Google's Gemini AI models to power features like AI website generation and payment receipt verification. Content you provide is transmitted to Google's API for processing in accordance with Google's privacy policies. See Google's Privacy Policy.
- Google OAuth — If you sign in with Google, we receive your name and email address from Google in accordance with your Google account permissions.
- Mapbox — Used for location search, geocoding, and map display on the marketplace.
- Cloudinary — Used to store and deliver images uploaded to the Service.
Your WhatsApp button links directly to WhatsApp's own app or website — NEXICFLOW does not connect to your WhatsApp account or process WhatsApp message content.
5. Data Retention
We retain your data for the following periods:
- Account Data — Retained for the duration of your account and for 30 days following account deletion
- CRM Contact Records — Customer contact details created from orders, bookings, and marketplace interactions are retained for the duration of your account to support the CRM feature
- Usage Analytics — Anonymized usage data may be retained indefinitely for product improvement purposes
- Billing Records — Payment and subscription records are retained for 7 years as required by financial regulations
You may request deletion of your data at any time by contacting us or deleting your account through the dashboard settings.
6. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Right of Access — Request a copy of the personal data we hold about you
- Right to Rectification — Request correction of inaccurate or incomplete data
- Right to Erasure — Request deletion of your personal data ("right to be forgotten")
- Right to Portability — Request your data in a portable, machine-readable format
- Right to Object — Object to processing of your data for direct marketing purposes
- Right to Restriction — Request restriction of processing your data in certain circumstances
To exercise any of these rights, please contact us at privacy@nexicflow.com. We will respond within 30 days.
If you are located in the European Economic Area (EEA), you also have the right to lodge a complaint with your local data protection authority.
7. Cookies
We use the following types of cookies:
- Essential Cookies — Required for the Service to function, including session authentication cookies. These cannot be disabled.
- Preference Cookies — Store your preferences such as theme selection (dark/light mode). Stored in localStorage.
We do not use advertising cookies or third-party tracking cookies. You can control cookie settings through your browser, though disabling essential cookies will prevent you from using the Service.
8. Children's Privacy
The Service is not directed to children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete it.
9. Contact Us
For privacy-related questions, requests, or concerns, please contact our privacy team:
We aim to respond to all privacy inquiries within 5 business days and will complete data requests within 30 days.