Privacy Policy

1. Introduction

This Privacy Policy explains how Nexagrowthhub ("we", "us", "our") collects, uses, stores, shares, and protects personal data when you visit nexagrowthhub.com, create an account, use our WhatsApp Business Platform, CRM, automation, and commerce tools (the "Service"), or otherwise interact with us.

We are committed to protecting your privacy and processing personal data in accordance with applicable laws in India, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), as applicable, along with other relevant regulations.

By accessing or using the Service, you acknowledge that you have read this Privacy Policy. Where the law requires consent for specific processing activities, we will obtain your consent separately or as part of signup and cookie choices.

2. Who We Are and Our Role

Nexagrowthhub operates a multi-tenant SaaS platform. Our role depends on whose data is being processed.

2.1 Data Fiduciary (our own customers and website visitors)

For the purposes of the DPDP Act, Nexagrowthhub acts as a Data Fiduciary for personal data we determine the purpose and means of processing for: our marketing website, account registration, login, billing, support tickets, and product analytics.

2.2 Data Processor (WhatsApp and CRM data belonging to your business)

Nexagrowthhub processes WhatsApp Business Platform data on behalf of businesses using the Nexagrowthhub platform to provide messaging, customer communication, automation, storefront, and CRM services.

When you connect a WhatsApp Business Account and import or receive contacts, you remain the Data Fiduciary (or equivalent controller) for your end customers. We process that data on your instructions as a Data Processor. You are responsible for having a lawful basis, valid WhatsApp opt-in, and privacy notices for those individuals.

2.3 Contact details

Registered / business address: Door no- 22, Desk no - 88G, Vijaya Bank Colony, 6th Cross road, Palm Heights, Banaswadi, Bangalore, Karnataka - 560043.

General enquiries: contact@nexagrowthhub.com | Phone: +91 9090031523.

3. Information We Collect

We collect personal data that you provide directly, data generated through your use of the Service, data received from Meta/WhatsApp and other integrations you enable, and data collected automatically through cookies and similar technologies.

3.1 Account and identity information

First name and last name (or full name)
Email address (used for login, verification, and communications)
Password (stored only as a secure cryptographic hash — we never store plain-text passwords)
Company or business name (optional at registration)
Workspace and team member details (name, email, role) when you invite staff
Profile image, if you choose to upload one

3.2 Authentication and session data

Session tokens and cookies required to keep you signed in
Account identifiers linked to NextAuth / session management
Password reset tokens (hashed) and related metadata when you request a password reset
Workspace API keys (stored as a hash; only a prefix is shown in the dashboard)

3.3 WhatsApp Business Platform data (processed on your behalf)

When you use Nexagrowthhub to send or receive WhatsApp messages, we process the following categories of WhatsApp Business Platform data on behalf of your business:

Customer phone numbers — WhatsApp IDs and numbers of people you message or who message you, stored on Contact, conversation, campaign recipient, and API delivery records
Customer names — names you enter, import, or that arrive from WhatsApp profile/contact metadata
WhatsApp messages — inbound and outbound message text, template snapshots, form replies, interactive replies, and media references stored in the shared inbox
Conversation data — conversation threads, timestamps, assignment, unread counts, delivery/read/failed status, and last-message previews
Message templates — Meta template names, languages, categories, statuses, components, and local draft templates used for broadcasts and automations
Business account information — your company name, billing profile, and dashboard account identifiers
WhatsApp Business Account information — WhatsApp Business Account (WABA) ID, business phone number ID, Meta business portfolio ID, display/sender configuration, and connection status
API and webhook data — Cloud API requests and responses we make for you, inbound webhook payloads from Meta (messages, statuses, catalog orders, form replies), and webhook verification tokens
Customer configuration data — provider choice (Meta Cloud API or Twilio), access tokens, App Secret, webhook verify token, default test numbers, automation settings, AI knowledge sources, storefront/catalog settings, and campaign configuration

3.4 CRM, campaigns, commerce, and automation data

Contact lists you create or import (name, phone, email, notes, tags, custom attributes, source, status)
Broadcast campaigns, API campaigns, recipients, and delivery reports
Automations, fixed auto-replies, human-mode settings, and WhatsApp Flow / form definitions and responses
WhatsApp Store Front catalog, products, collections, and inbound catalog order snapshots
AI knowledge sources (FAQs, website crawl text, uploaded content) used to generate assisted replies

3.5 Usage and technical information

IP address, browser type, device type, operating system, and referring URLs
Pages viewed, features used, clicks, and approximate interaction patterns on our website and dashboard
Log files, error reports, and security events

3.6 Communications

Content of emails we send (for example password reset, team invites, billing notices) and your replies to support requests
Help-desk tickets and messages you submit in the dashboard
Records of marketing communications where you have opted in

3.7 Payment and tax information

Paid plans are collected through Razorpay. Card, UPI, and similar payment credentials are processed by Razorpay. We receive billing metadata such as payment ID, subscription status, plan, GST details you enter, and invoice identifiers. We sync invoices to Zoho Books where configured. We do not store full card numbers on our servers.

4. Why We Process WhatsApp Data

Nexagrowthhub processes WhatsApp Business Platform data on behalf of businesses using the Nexagrowthhub platform to provide messaging, customer communication, automation, and CRM services.

We process this data only to operate the features you enable, including:

Connecting your WhatsApp Business Account (currently by saving the Cloud API credentials you provide in Settings; later also through Meta Embedded Signup if you onboard through our Meta app)
Sending and receiving WhatsApp messages in the shared inbox and My Chats
Creating, syncing, and submitting message templates to Meta
Running broadcast and API campaigns to opted-in contacts
Automations, AI-assisted replies, and WhatsApp Forms / Flows
WhatsApp Store Front catalog sync and inbound catalog orders
Delivery analytics, quality/limit status, and support troubleshooting
Verifying inbound Meta webhooks (hub.verify_token challenge and X-Hub-Signature-256) so only genuine events are stored

What we do not do with your customers' WhatsApp data

We do not sell end-customer phone numbers or conversation content
We do not use your customers' WhatsApp messages to advertise our own products to those individuals
We do not use inbox content to train public AI models for unrelated purposes
Google Analytics on our marketing site does not capture WhatsApp message bodies from your inbox

5. Google Analytics and Advertising Tags

We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC / Google Ireland Limited, to understand how visitors use our marketing website (e.g. traffic sources, page views, and aggregated usage trends).

GA4 may set cookies or use similar technologies and collect information such as your IP address (which may be anonymised depending on configuration), device identifiers, browser information, pages visited, time on site, and general geographic region.

Google may process this data on servers located outside India. Google's use of information is governed by Google's Privacy Policy: https://policies.google.com/privacy. You can learn how Google uses data from sites that use its services: https://policies.google.com/technologies/partner-sites.

You may opt out of GA4 on our site by disabling non-essential cookies through our cookie controls (where available), using the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout, or adjusting your browser settings to block analytics cookies. Essential cookies required for security and login are not disabled by this choice.

We also use the Google Ads tag (gtag.js) to measure advertising performance and conversions from our ads. Google Ads may set cookies such as _gcl_au. Google's use of this data is governed by Google's Privacy Policy: https://policies.google.com/privacy.

6. How We Use Your Information

We use personal data for the following purposes:

To create, authenticate, and manage your account and team workspace
To provide, maintain, and improve WhatsApp messaging, campaigns, inbox, templates, automations, forms, storefront, integrations, and related features
To send transactional emails (password reset, invites, and billing notices) via Resend
To process subscriptions and GST invoices via Razorpay and Zoho Books
To generate AI-assisted WhatsApp replies when you enable that feature, using conversation context and the knowledge sources you add
To provide customer support and respond to enquiries
To analyse website usage via Google Analytics and improve our marketing site and product
To measure advertising performance and conversions via Google Ads
To detect, prevent, and address fraud, abuse, security incidents, and technical issues
To comply with legal obligations, enforce our Terms of Service, and protect our rights and users
With your consent, to send product updates or marketing communications (you may withdraw consent at any time)

7. Lawful Grounds for Processing (India)

Under the DPDP Act and applicable rules, we process personal data based on one or more of the following: your consent; performance of a contract with you (providing the Service you signed up for); compliance with legal obligations; and legitimate uses permitted by law (such as preventing fraud or ensuring network security), where consent is not required.

For WhatsApp end-customer data that you upload, import, or generate through the platform, you are responsible for obtaining valid consent or another lawful basis from those individuals under applicable law, Meta WhatsApp policies, and (where relevant) TRAI / DLT rules for commercial communications in India.

8. Data Storage

Application data — including accounts, contacts, conversations, templates, campaigns, automations, storefront records, and WhatsApp connection settings — is stored in our PostgreSQL database used by the Nexagrowthhub application.

The web application is served over HTTPS. Hosting, database, and object storage may run on cloud infrastructure in India and in other regions used by our providers. We do not operate a separate consumer WhatsApp client; message content that appears in your inbox is stored in our database so your team can reply, search, and report on conversations.

WhatsApp message transport between Meta and the end user is handled by Meta on the WhatsApp Business Platform. Nexagrowthhub stores copies of message content and metadata that Meta delivers to our webhook or that we send through the Cloud API so we can provide inbox, campaign, and analytics features.

Files you upload for knowledge sources, product images, or template media may be stored with our application infrastructure or sent to Meta when required for Cloud API delivery.

9. Security Measures

We implement reasonable security practices and procedures aligned with industry standards and applicable Indian law, including:

Encryption in transit (HTTPS/TLS) for the website, dashboard, and API
Hashed password storage; we never store plain-text passwords
Workspace API keys stored as hashes
Access controls so WhatsApp settings, contacts, and conversations are scoped to the account owner and invited team members
Masked display of WhatsApp access tokens, App Secrets, and webhook verify tokens in the dashboard
Verification of Meta webhook signatures (X-Hub-Signature-256) when an App Secret is configured, so forged webhook traffic is rejected
Secure development practices, server logs for troubleshooting, and admin-only tools to close or delete accounts when requested

Credentials and residual risk

WhatsApp credentials you paste in Settings (access token, App Secret, verify token) are stored in our database so the platform can call Meta and receive webhooks on your behalf. Treat those values as secrets. You can disconnect WhatsApp in Settings, which deletes the stored integration for your account.

No method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your login credentials and for activity under your account.

10. Data Retention and Deletion

We retain personal data only for as long as necessary for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

10.1 How long we keep data

Account and workspace data — while the account is active
WhatsApp contacts, conversations, messages, templates, campaigns, automations, forms, and storefront data — while the account is active and you have not deleted those records in the dashboard
WhatsApp integration credentials — until you disconnect WhatsApp in Settings or the account is deleted
Billing, GST, Razorpay, and Zoho Books records — for the period required by Indian tax and accounting law (typically several years)
Support tickets and operational logs — for a reasonable period needed to support you and secure the Service
After an account deletion request is completed, remaining personal data is generally removed within 90 days, unless a longer period is required by law or for billing, dispute, or security records
Analytics data in Google Analytics is retained according to our GA4 property settings

10.2 How to request deletion

Business customers (account owners) can delete individual contacts, campaigns, templates, knowledge sources, storefront items, and the WhatsApp integration from the dashboard. To delete an entire Nexagrowthhub account and the WhatsApp, CRM, and configuration data stored for that workspace, email contact@nexagrowthhub.com from the registered account email and ask for account deletion. We will verify the request and delete or anonymise the account data, subject to legal exceptions (for example outstanding invoices, chargebacks, or lawful preservation).

Deleting data in Nexagrowthhub does not automatically delete the same data from Meta. Your WhatsApp Business Account, phone number, templates, and conversation history in WhatsApp Manager remain under your Meta business portfolio unless you delete or manage them there.

End customers of our business users should contact that business to request deletion. Nexagrowthhub does not respond to end-user deletion requests as a Data Fiduciary for that data, except where we are legally required to assist the business customer.

12. Meta / WhatsApp Integration

Nexagrowthhub integrates with the official WhatsApp Business Platform (Cloud API) so you can message customers from our dashboard. Today, you connect by providing your Meta access token, phone number ID, WABA ID, webhook verify token, and App Secret in Settings. Those credentials are used only to call Meta Graph APIs and to verify webhooks for your account.

Inbound events are received at our Meta webhook endpoint. We store message and status data needed for inbox, campaigns, storefront orders, and delivery reporting. We do not use Meta login on the public website today. If we add Meta Embedded Signup so businesses can grant our app access to their WhatsApp assets, that flow will use Facebook Login for Business, and we will receive a WABA ID, phone number ID, and an exchangeable code that we convert into a customer-scoped business token.

Meta processes WhatsApp data under Meta's own terms and privacy policies. You must also comply with WhatsApp Business Terms, Commerce Policy, and Messaging Guidelines. Conversation charges for WhatsApp are billed by Meta to the WhatsApp Business Account holder and are separate from the Nexagrowthhub subscription.

Meta privacy policy: https://www.facebook.com/privacy/policy. WhatsApp Business terms: https://www.whatsapp.com/legal/business-terms.

13. International Data Transfers

Your data may be stored or processed in India and, where we or our subprocessors use infrastructure abroad (including Meta, OpenAI, Google, Resend, Razorpay, and cloud hosts), in other countries. When personal data is transferred outside India, we take steps reasonably required under applicable law, such as contractual safeguards, standard contractual clauses, or ensuring the recipient country is approved or offers adequate protection, as the law may require from time to time.

14. Your Rights

Subject to the DPDP Act and other applicable laws, you may have the right to:

Confirm whether we process your personal data and access a summary of such data
Correct inaccurate or incomplete personal data
Erase personal data when no longer necessary or when you withdraw consent (where processing was consent-based), subject to legal exceptions
Withdraw consent for processing that relies on consent (without affecting prior lawful processing)
Nominate another individual to exercise your rights in the event of death or incapacity, as permitted under the DPDP Act
Grievance redressal through our Grievance Officer (see Section 17)

How to exercise your rights

To exercise these rights, email us at contact@nexagrowthhub.com from your registered email with sufficient detail to verify your identity. Say whether you want access, correction, or deletion of your Nexagrowthhub account and/or WhatsApp workspace data. We will respond within timelines prescribed under applicable law (including the DPDP Act, when fully in force for your request type).

15. Additional Disclosures (EEA / UK Visitors)

If you access our website from the European Economic Area or United Kingdom, you may have additional rights under GDPR or UK GDPR (access, rectification, erasure, restriction, portability, objection). Our primary establishment for Indian users is India; for cross-border requests we will assess applicable law. Contact contact@nexagrowthhub.com for such requests.

16. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, contact us at contact@nexagrowthhub.com and we will take steps to delete it.

17. Grievance Officer

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDP Act requirements for grievance redressal, we have designated a Grievance Officer:

Name / Designation: Grievance Officer, Nexagrowthhub

Email: contact@nexagrowthhub.com

Address: Door no- 22, Desk no - 88G, Vijaya Bank Colony, 6th Cross road, Palm Heights, Banaswadi, Bangalore, Karnataka - 560043

Phone: +91 9090031523

We will acknowledge complaints within 24 hours and endeavour to resolve them within 15 days, or within such period as applicable law may prescribe from time to time.

18. Third-Party Websites & Services

Our Service may link to or integrate with third-party websites, APIs (including Meta/WhatsApp, Twilio, OpenAI, Razorpay, Zoho, Resend, and Google), and tools. Their privacy practices are governed by their own policies. We encourage you to review those policies before providing personal data to them.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated "Last updated" date. Material changes may be notified via email or in-app notice where appropriate. Continued use after changes constitutes acceptance where permitted by law.

20. Contact Us

For privacy-related questions, requests, or complaints: