Nex-XL · Legal
Privacy Policy
1. Who this policy covers
Nex-XL runs the website nex-xl.tech and Nex-XL, a platform that lets a business answer its customers on WhatsApp with an AI assistant and schedule appointments in the business's own Google Calendar. This policy explains what personal data we handle and why, for three groups of people:
- Website visitors reading nex-xl.tech.
- Client users: the owners and staff of a business (a "client") who sign in to Nex-XL.
- End customers: people who message a client's WhatsApp number that runs on Nex-XL.
It is written to comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and with the platform policies of Meta (WhatsApp) and Google.
2. Our role
When you message a business on WhatsApp, that business decides how your conversation is used; it is the data user under the PDPA. Nex-XL processes the conversation on the business's behalf and on its instructions, to answer you and to book the appointment you asked for. For client accounts and for this website, Nex-XL is itself the party responsible for your data.
3. Data we process
Website visitors
Standard server logs (IP address, browser type, pages requested, time) kept for a short period for security and troubleshooting. The website sets no advertising or analytics cookies. A session cookie is set only after a client user signs in. The website remembers, in your browser only, the language you chose and whether you have seen its opening; neither is sent to us.
Website AI adviser
If you use the website chat, your messages and recent conversation are sent to Anthropic to answer your questions, suggest a service and prepare a requirements brief. Only information you type into this chat is used; the website adviser cannot access client CRM accounts or customer records. Please avoid sharing passwords, payment information or sensitive customer data.
The conversation is held temporarily in server memory and in this browser tab's session storage. Inactive chat sessions expire after 30 minutes and are removed during cleanup; the New chat control clears the local conversation and requests deletion of the server session. We do not save website chat transcripts to the CRM or log their contents. Temporary network-address counters help limit abuse, and AI token counts may be logged to monitor usage.
You can review and edit the requirements brief before opening WhatsApp or your email application. Our team receives it only when you send it there. Messages you send through those services are then handled under the relevant messaging and enquiry provisions of this policy.
Client users
Name, email address, password (stored only as a salted hash), role (owner or staff), sign-in times, and a record of actions taken in the platform such as edits to the assistant's knowledge or pausing the assistant.
Client business data
The identifiers and access credentials of the client's WhatsApp Business account (credentials are encrypted at rest and never shown back in the browser), the business knowledge the client writes for its assistant, calendar and appointment settings, the client's plan and monthly usage figures.
End customers
Your WhatsApp phone number, the profile name WhatsApp provides, the content and timestamps of the messages exchanged with the business's number, and, when you book an appointment through the assistant, the details you gave for it (typically your name, the chosen time and a short note).
Google Calendar data
When a client connects its Google Calendar: free/busy information for the bookable window, and the calendar events Nex-XL itself creates for bookings (title containing the customer's name and phone number, start and end time, an optional note). Section 6 describes exactly how this data is used.
4. How we use data
- To generate and send replies on the client's behalf, in the language the customer writes in.
- To offer available appointment times and to create, move or cancel the appointment the customer asks for.
- To show the client its inbox, its bookings, its knowledge and a summary of results.
- To keep the service secure, prevent abuse, and investigate problems.
- To meter usage, enforce the client's monthly limit, and bill the client.
- To support clients when they contact us.
We do not sell personal data, and we do not use it for advertising or profiling.
5. AI processing
To produce a reply, the recent conversation and the client's business knowledge are sent to our AI provider, Anthropic, through its commercial API, and the generated reply is returned to us. Under the provider's commercial terms, data sent through the API is not used to train its models. The assistant answers only from the business's own knowledge; when it cannot answer, it says so once and passes the conversation to a person at the business. Payment details, documents and negotiations are always handed to a person.
6. Google user data
Nex-XL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
A client connects its Google Calendar through Google's own sign-in screen; Nex-XL never sees the client's Google password. We request access to calendar events and read-only calendar access, and we use that access only to:
- read free/busy information for the hours the client marks as bookable, so the assistant offers times that are actually free;
- create, move or delete the calendar events that Nex-XL itself created for bookings;
- show the client, inside Nex-XL, the bookings the assistant made.
We do not read the contents of the client's other events, we do not store calendar data beyond the identifiers of the events we created, we do not share Google user data with third parties except as needed to run the service, we do not use it for advertising, and no person at Nex-XL reads it except for security or abuse investigations, with the client's consent, or as required by law. A client can disconnect at any time from Nex-XL or from myaccount.google.com/permissions; disconnecting revokes and deletes the stored token.
7. WhatsApp and Meta
Messages reach Nex-XL through Meta's WhatsApp Business Platform, using the client's own WhatsApp Business account and phone number. WhatsApp itself is governed by Meta's terms and privacy policy. We store the client's access credentials encrypted and use them only to receive messages for, and send replies from, that client's number.
WhatsApp Business app
When a business connects its WhatsApp Business app to Nex-XL, it may choose to share up to 180 days of its one-to-one chat history and the names saved in its phone's contacts; Nex-XL keeps them only to show that business's own conversations to its staff and as context for its assistant, and deletes them with the business's other data.
Facebook Messenger
A client may also connect its Facebook Page, so that people who message the Page on Facebook Messenger are answered through Nex-XL. The client connects the Page by signing in with Facebook and choosing the Page; Nex-XL never sees the client's Facebook password. For a connected Page we process the Page's name and ID; the Page-scoped ID that Facebook gives each person who writes to the Page, and the name Facebook provides for that person where it is available; the text and times of the messages exchanged with the Page; and any photos and voice notes sent to the Page, which we store and which may be processed by our AI providers so that a photo can be described and a voice note turned into text. The Page's access token, which lets Nex-XL receive and send messages for that Page, is stored encrypted and is never shown back in the browser. This data is used and shared as described in sections 4 and 8 and kept as described in section 9. A client can disconnect its Page from Nex-XL at any time. Disconnecting stops Nex-XL from receiving and sending messages for that Page and removes the stored token; a short-lived encrypted copy is kept only to ask Facebook to stop sending the Page's messages, and is deleted when that finishes and in any case within 48 hours. Conversations already held stay in the client's inbox until they are deleted (see Data deletion). Facebook Messenger itself is governed by Meta's terms and privacy policy.
9. Retention
Conversations, messages and booking records are kept for as long as the client uses Nex-XL, so the business can serve returning customers. They are deleted within 30 days after the client's account ends, on the client's instruction, or on a verified request from an end customer (see Data deletion). Usage counts needed for billing and records we must keep by law are retained for the period the law requires, without message content.
10. Security
Data travels over TLS. WhatsApp credentials, Facebook Page tokens and Google tokens are encrypted at rest with AES-256-GCM. Each client's data is separated from every other client's in our systems, access is role-based, and every action of the assistant is recorded in an audit trail. Server access is restricted to authorised Nex-XL staff. No system is perfectly secure; if a breach affects your data we will notify the affected clients without undue delay and, where required, the authorities.
11. Your rights
Under the PDPA you may ask for access to your personal data, ask us to correct it, withdraw consent, or limit its processing. If you are an end customer, the quickest route is the business you messaged, because it controls your conversation; you may also contact us and we will coordinate with the business. We respond to access requests within 21 days. You may also complain to the Personal Data Protection Department of Malaysia (JPDP).
12. Other terms
Children. Nex-XL is a business service and is not directed at people under 18; we do not knowingly collect their data.
Changes. We will post any change to this policy on this page with a new "last updated" date, and tell clients about material changes by email.