Nexus Privacy Policy

Updated 13 November 2026

Nexus is run by PT IZAAJA SOLUSI DIGITAL, Jl. Marelan Raya 7 Pasar 1 Tengah, Medan Marelan, Sumatera Utara 20255, Indonesia. This policy explains what data we process, why, and your rights — as a business owner using Nexus, and the rights of people who have messaged your business. It covers the site nexus.izaaja.com, the Nexus web app and the Nexus Android app (com.izaaja.nexus).

1. Our two roles

For your data as a business owner and agent (account, team, subscription) we are the data controller.

For the customer contact data you store and message in Nexus, you are the controller and we are the processor. We process it only to run Nexus for you; we do not sell it, use it for advertising, or contact your contacts for ourselves.

2. Business owner and agent data

Account: name, email, phone number if you add one, password (stored as a one-way hash), profile photo if you set one, language, country and time zone — the same as your Izaaja account. If you sign in with Google, we receive your name and email from Google.
Business and team: business name, country, working hours, the agents you invite with their roles and permissions, and chat assignment settings.
Subscription: plan, dates, amount, invoice number and payment status from Midtrans or Google Play. Card numbers never reach us.
Connection data: WhatsApp Business account ID, business number, display name, number quality and sending limit, and the access token Meta issues, and, if you connect them, Instagram and Facebook account IDs and tokens. Tokens are stored encrypted.
Technical records: IP address, device type, app version, device notification token and error logs, for security and fixing problems.

3. Customer contact data and messages

Contacts: phone number, profile name, labels, notes, pipeline stage, where the contact came from, and the consent status to receive messages with its source. Customers who use a WhatsApp username may not send their phone number; the contact is still saved under the identifier Meta provides.
Messages: content, time and delivery status of messages sent and received through the channels you connect, including images, documents, voice notes and other attachments customers send.
Message templates you create and their approval status, broadcast recipient lists and send results.
AI chatbot answers and the shop data you allow it to use.
Records of agent actions, such as who replied, handed over or changed a label.

4. What we do not store

Your WhatsApp password, WhatsApp verification codes, or the content of conversations on your phone that do not go through Nexus.
The card number for Meta message fees: you attach that card yourself at Meta, and Meta bills you directly.
Your phone contacts and photo gallery. The app only reads files you choose yourself to attach.

5. How the data is used

Running Nexus: delivering and showing messages, saving contacts, running the pipeline, sending broadcasts you start, and showing number and template status.
Drafting AI chatbot answers if you turn it on.
Handling subscriptions and counting plan allowances.
Sending new-chat notifications to agents’ phones, verification and account emails, and subscription reminders.
Security: preventing unauthorised access and recording important actions.
Answering your questions and help requests, and meeting legal duties, including bookkeeping.

We do not sell personal data and do not use your messages or customers’ contacts for advertising. Nexus does not use your messages to train our own AI models and does not allow the AI provider to use them to train its models, as far as we can arrange through our agreement with that provider.

Nexus makes no decision made only by automated means that has legal or similarly significant effects on you or your contacts. The AI chatbot only drafts answers from the data you allow; you choose suggestion or automatic mode, and you can ask our staff to review any matter at nexus@izaaja.com.

6. Legal basis

We process data because it is necessary to perform our agreement with you, because of a legal duty (bookkeeping and tax), because of our legitimate interest in keeping the service secure, and — for customer contact data — on the lawful basis and consent you collect and your instructions as controller.

7. Retention and deletion

Account and contact data are kept while your account is active. When you ask for the account to be deleted, it is scheduled for deletion 14 days later; if you sign in again within those 14 days, the request is cancelled. After that, account, team, contact, message and channel-token data is deleted or anonymised. Billing records (date, amount, invoice number) are kept for as long as Indonesian law requires bookkeeping.

Disconnecting a WhatsApp number in Nexus stops new messages and deletes the connection token; to also delete the chats and contacts already saved, follow Delete data. Meta keeps message content for at most 30 days to run its service, so the chat history you see in Nexus is kept by Nexus for your business. The free plan keeps chat history for a limited period within its plan limits; plans and limits are shown in the app.

8. Location and recipients

Data is stored on Contabo GmbH servers in Germany. Other recipients get only what they need:

Meta Platforms: sending and receiving WhatsApp messages through the WhatsApp Business Platform (Cloud API), and Instagram and Facebook if you connect them. Meta acts on behalf of your business for those messages, and holds your business account data under Meta’s own terms.
DeepSeek (AI model provider): only if you turn the AI chatbot on; it receives message text and allowed shop data, as much as needed to draft one answer. The AI provider’s servers may be outside your country.
Cloudflare: network, attack protection, and Turnstile on the contact form.
Midtrans and Google Play: subscription payments. Google Sign-In if you sign in with Google.
Email and notification services: sending account emails and notifications to your phone.
Authorities, only where the law requires it.

The full list of providers shared with other Izaaja products is in the Izaaja Privacy Policy.

9. Android app permissions

The Nexus Android app (com.izaaja.nexus) asks only for permissions its features use:

Notifications: to tell agents when a new WhatsApp chat arrives. You can turn them off in the Nexus notification settings or in Android settings.
Camera and files: only when you choose to take a photo or attach an image, document or video to a message. The app does not read your gallery or other files, and does not use the camera in the background.
Internet: to send and receive messages. Nexus does not ask for location, phone contacts, SMS or microphone permission beyond what you choose yourself when attaching a voice message, where that feature is available.

10. Summary for the Google Play data safety form

This summary matches the rest of this policy:

Data collected: name and email (account), user and device identifiers (session and notifications), messages (the chat content you connect), customer contacts (phone number and profile name), photos, videos and files you attach, and purchase information (subscription status).
Purpose: app functionality, account management, security and support. Not for advertising, and not sold.
Shared: only with the providers in section 8 that are needed to run the service.
Encryption: data is sent over HTTPS; connection tokens are stored encrypted.
Deletion: you can ask for deletion of your account and data inside the app or on the web, as on the Delete data page.

11. Security

All connections use HTTPS. Data is kept separate per business account, access tokens for connected accounts are stored encrypted, passwords are stored as a one-way hash, and agent access is limited by the roles and permissions you set. No system is perfectly safe; write to nexus@izaaja.com if you suspect a problem.

12. If there is a breach

For your account data, we tell you and the competent authority within 3×24 hours as Indonesia’s data protection law (UU PDP) requires, or within 72 hours elsewhere where the law asks for faster. For customer contact data, we tell you without undue delay, so you can meet your duties as controller.

13. Cookies

The site nexus.izaaja.com uses no advertising or tracking cookies. Only what is needed is used: Cloudflare Turnstile on the contact form to screen out robots, and the sign-in session in the web app.

14. Your rights and your contacts’ rights

You have the right to see, correct, export and delete your data, and to withdraw consent. Send requests to dpo@izaaja.com or nexus@izaaja.com from your account email; we answer within 14 days.

People who have messaged a business that uses Nexus and want to see or delete their data should contact that business. If the request reaches us, we pass it to the business and delete their data from Nexus as set out in Delete data. Contacts who ask to stop are removed from broadcasts.

If you are not satisfied with our answer, you may complain to the data protection authority in your country: Indonesia — Ministry of Communication and Digital Affairs (komdigi.go.id); Malaysia — Personal Data Protection Department (pdp.gov.my); Philippines — National Privacy Commission (privacy.gov.ph); Singapore — Personal Data Protection Commission (pdpc.gov.sg); Thailand — Personal Data Protection Committee (pdpc.or.th); Vietnam — A05, Ministry of Public Security (bocongan.gov.vn). If you use Nexus from elsewhere — for example the European Union or the United Kingdom, where the GDPR applies — you have the rights that law gives you and we honour them through the same addresses.

15. Children

Nexus is only for people 18 and over. Do not store or contact children’s data without the consent of a parent or guardian.

16. Changes

We announce important changes at least 30 days before they apply, by email or in the app.

17. Contact

Data protection officer: dpo@izaaja.com
Nexus help: nexus@izaaja.com
Company: info@izaaja.com · Billing: billing@izaaja.com