Privacy Policy

Last updated: 20 July 2026 · Version: privacy-2026-07-20

This Privacy Policy (“Policy”) governs the collection, processing, use, disclosure, and protection of personal information by NexusAgents (“NexusAgents”, “we”, “us”, or “our”) in connection with the provision of the Service. It also serves as our notice for the purposes of the Protection of Personal Information Act, 2013 (POPIA). By accessing or using the Service, you acknowledge that you have read and understood this Policy.

1. Statutory Disclosures and Corporate Structure

In accordance with applicable South African electronic commerce and data protection requirements:

Full legal name: K2018045519 (SOUTH AFRICA) (Pty) Ltd trading as Nexus Agents
Registration number: 2018/045519/07
Physical address: 27 Grace Crescent, Beacon Bay, East London, South Africa
Website: https://nexusagents.co.za
Email: privacy@nexusagents.co.za

Corporate structure. The Service is developed and maintained by Elthian Labs, a division of Elthian LLC (a Delaware limited liability company), which is the verified business entity for the NexusAgents application on the Meta Business Platform. The Service is operated and provided to Customers by K2018045519 (South Africa) (Pty) Ltd t/a Nexus Agents, which is the contracting party and, for the purposes of POPIA, the Operator in respect of Customer Data. Hosting and primary data storage and processing take place within the Republic of South Africa; limited transient processing by third-party AI providers takes place outside South Africa as described in sections 6 and 7. All production access, support, and administration of Customer Data is performed under the authority and instructions of the South African operating entity; Elthian LLC has no independent access to Customer Data.

2. Scope and Application

This Policy applies to all personal information processed by NexusAgents in connection with the Service, including personal information relating to your customers, employees, and other data subjects that you upload, transmit, or instruct us to process (for example, WhatsApp messages exchanged between your business and its customers through the Service).

3. Information We Collect

We may collect and process the following categories of personal information:

Account and Contact Information: name, business name, email address, WhatsApp number, telephone number, physical address, and related details;
Business Configuration Data: operating hours, pricing, services and products offered, workflows, prompts, agent configurations, escalation and approval settings, and related business rules defined by you;
Customer and Conversation Data: messages (including WhatsApp message content), contacts, leads, bookings, orders, tasks, notes, interaction history, and other customer-related information processed through the Service;
Usage and Technical Data: IP address, device information, browser information, logs, analytics data, and usage patterns;
AI Interaction Data: prompts, inputs, outputs, generated drafts and responses, and related metadata used to operate and deliver the Service.

AI Interaction Data is processed to provide, maintain, secure, and improve the functionality of the Service. NexusAgents does not use identifiable Customer Data or communication content to train NexusAgents’ own models or third-party foundational models unless the Customer expressly opts in. NexusAgents may use aggregated or de-identified operational data to improve and secure the Service.

Collection details. Personal information originates from: you directly (account registration, configuration, and content you submit); the Meta/WhatsApp Business Platform (messages and identifiers delivered via webhook under your connected WhatsApp Business Account); and integrations you connect (for example, calendar providers). Name, business name, and email address are mandatory for account creation; without them we cannot provide the Service. Other information is voluntary, though withholding it may limit functionality. Recipients of personal information are limited to the subprocessor categories listed in section 6. NexusAgents does not receive or store full payment-card details; card payments are processed by our payment provider, which handles card data under its own PCI-compliant systems.

4. Purposes and Legal Bases for Processing

We process personal information only where permitted under POPIA and for the following purposes: to provide, operate, maintain, support, and improve the Service; to enable AI-assisted communication and workflow functionality; to manage accounts, subscriptions, support, and customer communications; to ensure system security and prevent fraud, abuse, or misuse; to comply with legal and regulatory obligations; and, where required, on the basis of consent.

The Service’s default posture is human-in-the-loop: AI-generated replies are reviewed and approved by the Customer’s staff before sending unless the Customer deliberately configures automated behaviour. The Customer remains responsible for the oversight, supervision, and approval of automated communications and business decisions. NexusAgents does not independently use personal information for fully automated decision-making that produces legal effects or similarly significant effects on data subjects without Customer configuration, control, and intervention.

5. POPIA Notice — Roles and Responsibilities

Where NexusAgents processes personal information on behalf of a Customer, the Customer is the Responsible Party and NexusAgents is an Operator under POPIA. As an Operator, we process personal information solely on the instructions of the Responsible Party, as configured through the Service.

If you are an individual whose personal information has been processed through our Service by one of our Customers — for example, you exchanged WhatsApp messages with a business that uses NexusAgents — that business is the Responsible Party for your information. Please direct requests relating to access, correction, or deletion of your information to that business. NexusAgents cannot act on such requests without the Responsible Party’s instruction, except where required by law. If you are unsure how to reach the business, contact privacy@nexusagents.co.za and we will assist in identifying the correct Responsible Party where we are able to do so.

6. Subprocessors and Third-Party Services

We engage the following categories of service providers, and providers within them, to deliver the Service:

Hosting and infrastructure: RackZar (South Africa) — server hosting and primary data storage;
AI model providers: OpenAI, Anthropic, Google, and xAI (United States) — transient processing of message content, prompts, and related inputs to generate AI-assisted outputs. NexusAgents selects among approved providers at its discretion having regard to task suitability, quality, availability, and cost;
Messaging platform: Meta Platforms (WhatsApp Business Platform) — delivery and receipt of WhatsApp messages under the Customer’s own WhatsApp Business Account;
Payments: PayGate (DPO Group) — payment processing for subscriptions and top-ups;
Supporting services: analytics, logging, email, and infrastructure vendors engaged from time to time.

The authoritative, current Subprocessor list — including each provider’s legal entity, service, data processed, processing location, engagement status, and safeguards — is published at https://nexusagents.co.za/subprocessors/ and is updated when material changes occur. Subprocessors are engaged under written terms imposing data protection obligations consistent with our Data Processing Addendum (https://nexusagents.co.za/data-processing-addendum/).

7. Cross-Border Transfers

Hosting and primary storage of personal information take place in the Republic of South Africa. Limited categories of personal information — principally message content and AI interaction data — are transmitted to and transiently processed by the AI providers named in section 6 in their own processing regions, which may include the United States. Payment and messaging-platform providers may likewise process data outside South Africa.

Where such transfers occur, NexusAgents ensures they are carried out in accordance with section 72 of POPIA, including through contractual safeguards with the recipient requiring protection substantially similar to POPIA’s conditions for lawful processing.

8. Security

We implement appropriate, reasonable technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access — including encryption in transit and at rest where appropriate, role-based access control, authentication controls, logging and monitoring, and regular patching. No system is completely secure, and we do not guarantee absolute security.

9. Retention and Deletion

Personal information is retained for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, and support legitimate operational requirements, including backup and archival processes. Customers are responsible for configuring and managing their own retention practices within the Service where such functionality is made available.

For details of how to request deletion, what deletion covers, our response timeframes, and retention exceptions, see our Data Deletion Instructions: https://nexusagents.co.za/data-deletion-instructions/

10. Data Subject Rights

Subject to applicable law, data subjects have the right to request access to, correction of, deletion of, or objection to the processing of their personal information, and to lodge a complaint with the Information Regulator (South Africa) — https://inforegulator.org.za.

Where NexusAgents acts as an Operator, such requests must be directed to the relevant Customer as the Responsible Party (see section 5). Where NexusAgents is itself the Responsible Party (for example, in respect of Customer account and billing information), requests may be directed to privacy@nexusagents.co.za and will be handled within the timeframes described in our Data Deletion Instructions.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to operate, secure, and improve the Service. Where required by law, we will obtain consent for non-essential cookies or similar tracking technologies.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal obligations. Where changes are material, we will provide notice by email, dashboard notice, or other reasonable means. Continued use of the Service after the effective date of the revised Policy constitutes acceptance of the updated Policy.

13. Contact and Information Officer

The Information Officer of K2018045519 (South Africa) (Pty) Ltd t/a Nexus Agents may be contacted at privacy@nexusagents.co.za for all matters relating to this Policy, POPIA, and the exercise of data subject rights.

Email: privacy@nexusagents.co.za
K2018045519 (South Africa) (Pty) Ltd t/a Nexus Agents
27 Grace Crescent, Beacon Bay, East London, South Africa