Privacy Policy

Padiflow is a customer relationship and conversational commerce platform operated by Vexel Labs Limited (“Padiflow”, “we”, “us”), a company registered in Nigeria. Padiflow lets businesses (“vendors”) manage customer conversations across WhatsApp, Instagram, Facebook Messenger, and Telegram, manage their products, accept payments, and run a simple online storefront.

This policy explains what information we collect, how we use it, and the choices available to you. It applies to padiflow.com, the Padiflow application, and vendor storefronts hosted on Padiflow subdomains.

1. Information we collect

Account information. When a vendor creates a Padiflow account we collect a name, business name, email address, phone number, and login credentials.

Business data. Vendors add information about their business to Padiflow, including products, prices, inventory, images, and business policies such as delivery fees.

Messaging data.When a vendor connects a messaging channel (WhatsApp Business, Instagram, Facebook Messenger, or Telegram), we receive and store the messages exchanged between the vendor and their customers on that channel, including message content, media attachments, sender identifiers such as phone numbers or usernames, and delivery status. We receive this data through the official APIs of each platform, with the vendor's authorization.

Payment information. Vendors may connect their own Paystack account by providing an API key, which we store encrypted. Payments made to vendors are processed by Paystack and settle directly to the vendor. Padiflow never receives, holds, or transfers customer funds and never stores card numbers or bank account details. We store transaction references, amounts, and payment status so vendors can track orders. Padiflow subscription and credit purchases are processed by Paystack on our own account.

Technical data. Like most online services, we collect log data such as IP addresses, browser type, device information, and usage activity, used for security and to operate the service.

2. How we use information

• To provide the service: displaying conversations in a unified inbox, sending vendor replies, managing products and orders, and operating storefronts.
• To draft and, where a vendor turns it on, send AI replies:message content, voice notes, and photos are processed by third-party AI service providers (currently Google Gemini, with OpenRouter as a backup route to other AI models) to classify messages, draft reply suggestions, and, in the optional sales assistant mode, send replies. By default, AI replies are drafts that a person on the vendor's team reviews before sending. A vendor's account owner can switch on the sales assistant for their business and for specific tasks, such as answering questions, quoting delivery, collecting a delivery address, raising an order, or sending a payment link at the vendor's list price. In that mode, replies are sent to customers without a person approving each one, within limits the vendor sets. Prices, stock, delivery estimates, and order status come from the vendor's own records, not from the AI, and the assistant does not negotiate or give discounts. On Facebook Messenger and Instagram the assistant identifies itself as an assistant in its first reply; on WhatsApp and Telegram it does so when the vendor turns that setting on. Any person on the vendor's team can take over a conversation at any time. When a person replies, the assistant pauses in that conversation and only answers a later customer message if the team has not replied to it within a set time (15 minutes by default); it never contradicts the team. The account owner can switch the assistant off for any conversation, and it stays off there until they switch it back on. Matters the assistant hands to the team, such as a request for a discount, a refund, a payment the customer says they made, or a complaint, are left for the team to decide. We do not use message content or photos to train AI models.
• To provide sales analytics to vendors about their own business, such as revenue, response times, and product performance.
• To process billing, provide support, keep the service secure, and comply with legal obligations.

We do not sell personal information. We do not use messaging data for advertising.

3. Data from Meta platforms

Padiflow accesses data from WhatsApp, Instagram, and Facebook Messenger through Meta's official APIs, only after a vendor authorizes the connection. We use this data solely to provide Padiflow's services to that vendor. We do not sell Meta platform data, use it to build advertising profiles, or share it with third parties except the service providers described below. When a vendor disconnects a channel or deletes their account, we delete the associated platform data as described in section 7. Our use of Meta platform data complies with Meta's Platform Terms and Developer Policies.

4. Vendors and their customers

If you are a customer of a business that uses Padiflow, that business is responsible for its relationship with you and decides how your conversation and order data is used. Padiflow processes that data on the vendor's behalf to provide the service. Requests about your data can be made to the vendor directly, or to us using the contact details below, and we will assist.

5. When we share information

We share information only with service providers who help us operate Padiflow, under agreements that limit their use of the data:

• Cloud infrastructure and storage providers that host our systems.
• Meta Platforms and Telegram, to deliver and receive messages on connected channels.
• Paystack, to process payments.
• AI service providers (currently Google Gemini, with OpenRouter as a backup route), to classify messages, draft reply suggestions, and send replies in the optional sales assistant mode.

We may also disclose information if required by law, or to protect the rights, safety, and security of Padiflow, our users, or the public.

6. Data retention

We keep information for as long as a vendor's account is active or as needed to provide the service. Conversation and order history is retained so vendors can serve returning customers. When a vendor deletes their account, the shop and its contents are deleted after 30 days, as described on our account deletion page. Two kinds of record outlast that deadline. Completed identity verification records are kept for five years afterwards, as anti-money-laundering rules require; they are masked and visible only to the business owner. Payment, order-amount and invoice records are kept for as long as Nigerian tax and company law requires, with personal details removed and the business name kept on invoices, because an invoice is not valid without it.

7. Data deletion

Vendors can delete products, conversations, or their entire account from within Padiflow, or by emailing us. Deleting an owner account schedules the whole shop for deletion after 30 days, and signing in during those 30 days cancels it; deleting a staff account removes that person at once. What is deleted, and the payment records the law requires us to keep, are set out on our account deletion page, where you can also ask for a deletion without signing in. Disconnecting a messaging channel stops new data collection from that channel, and the vendor may request deletion of previously collected data from it.

If you interacted with Padiflow through a Meta platform and want data about you deleted, email operations@padiflow.com with the phone number or username you used, and we will delete the associated data we hold within 30 days and confirm once complete.

8. Security

We protect information with encryption in transit and at rest, credentials encrypted at the application level before they are stored, with the keys kept separate from the database, access controls, and audit logging. No online service can guarantee absolute security, but we treat the protection of vendor and customer data as a core engineering requirement.

9. Your rights

Under the Nigeria Data Protection Act 2023 and similar laws that may apply to you, you have the right to access the personal data we hold about you, request correction or deletion, object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local data protection authority.

10. European users (GDPR)

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR apply to our processing of your personal data, and this section supplements the rest of this policy.

Legal bases. We process personal data on the following bases: performance of a contract (providing Padiflow to vendors under our terms); legitimate interests (securing the service, preventing fraud and abuse, and understanding how the service is used, balanced against your rights); consent, where we ask for it, which you may withdraw at any time; and compliance with legal obligations.

Controller and processor roles.For vendor account data, Vexel Labs Limited is the data controller. For the conversation and order data of a vendor's customers, the vendor is the controller and Padiflow processes that data on the vendor's behalf and instructions, as described in section 4.

Your GDPR rights.In addition to the rights in section 9, you have the right to data portability (receiving a copy of data you provided in a structured, machine-readable format) and the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Padiflow does not make such decisions. Where a vendor has switched on the sales assistant, it may answer and send replies without a person approving each one, but it makes no decision with legal or similarly significant effect: it does not make credit decisions, offer prices below the vendor's list price, or refuse service. You can ask for a person at any time: the assistant passes that request to the vendor's team and does not decide it itself. You may also lodge a complaint with the supervisory authority in your country of residence.

International transfers.Where personal data of EEA or UK individuals is transferred outside those regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms offered by our infrastructure providers.

11. International transfers

Our infrastructure providers may store or process data in countries outside Nigeria. Where data is transferred internationally, we take steps to ensure it receives an adequate level of protection consistent with applicable data protection law.

12. Age requirement

Padiflow is a business tool intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date, and for significant changes we will notify vendors through the service or by email.

14. Contact us

Changes in this version (5 October 2026): section 2 now describes the optional sales assistant mode, in which AI replies can be sent without a person approving each one, names our current AI providers, and states that the assistant identifies itself on Messenger and Instagram and, when the vendor turns it on, on WhatsApp and Telegram; section 5 lists what AI providers are used for; section 10 explains why the sales assistant does not make decisions with legal or similarly significant effect; section 8 describes how credentials are encrypted. Previous version effective 13 July 2026.