Privacy Policy

Padiflow is a customer relationship and conversational commerce platform operated by Vexel Labs Limited (“Padiflow”, “we”, “us”), a company registered in Nigeria. Padiflow lets businesses (“vendors”) manage customer conversations across WhatsApp, Instagram, Facebook Messenger, and Telegram, manage their products, accept payments, and run a simple online storefront.

This policy explains what information we collect, how we use it, and the choices available to you. It applies to padiflow.com, the Padiflow application, and vendor storefronts hosted on Padiflow subdomains.

1. Information we collect

Account information. When a vendor creates a Padiflow account we collect a name, business name, email address, phone number, and login credentials.

Business data. Vendors add information about their business to Padiflow, including products, prices, inventory, images, and business policies such as delivery fees.

Messaging data.When a vendor connects a messaging channel (WhatsApp Business, Instagram, Facebook Messenger, or Telegram), we receive and store the messages exchanged between the vendor and their customers on that channel, including message content, media attachments, sender identifiers such as phone numbers or usernames, and delivery status. We receive this data through the official APIs of each platform, with the vendor's authorization.

Payment information. Vendors may connect their own Paystack account by providing an API key, which we store encrypted. Payments made to vendors are processed by Paystack and settle directly to the vendor. Padiflow never receives, holds, or transfers customer funds and never stores card numbers or bank account details. We store transaction references, amounts, and payment status so vendors can track orders. Padiflow subscription and credit purchases are processed by Paystack on our own account.

Technical data. Like most online services, we collect log data such as IP addresses, browser type, device information, and usage activity, used for security and to operate the service.

2. How we use information

• To provide the service: displaying conversations in a unified inbox, sending vendor replies, managing products and orders, and operating storefronts.
• To generate AI reply suggestions: message content may be processed by artificial intelligence systems, including third-party AI service providers, to classify messages and suggest replies. Suggestions are drafts only; a human vendor reviews and approves every message before it is sent. We do not use message content to train AI models without consent.
• To provide sales analytics to vendors about their own business, such as revenue, response times, and product performance.
• To process billing, provide support, keep the service secure, and comply with legal obligations.

We do not sell personal information. We do not use messaging data for advertising.

3. Data from Meta platforms

Padiflow accesses data from WhatsApp, Instagram, and Facebook Messenger through Meta's official APIs, only after a vendor authorizes the connection. We use this data solely to provide Padiflow's services to that vendor. We do not sell Meta platform data, use it to build advertising profiles, or share it with third parties except the service providers described below. When a vendor disconnects a channel or deletes their account, we delete the associated platform data as described in section 7. Our use of Meta platform data complies with Meta's Platform Terms and Developer Policies.

4. Vendors and their customers

If you are a customer of a business that uses Padiflow, that business is responsible for its relationship with you and decides how your conversation and order data is used. Padiflow processes that data on the vendor's behalf to provide the service. Requests about your data can be made to the vendor directly, or to us using the contact details below, and we will assist.

5. When we share information

We share information only with service providers who help us operate Padiflow, under agreements that limit their use of the data:

• Cloud infrastructure and storage providers that host our systems.
• Meta Platforms and Telegram, to deliver and receive messages on connected channels.
• Paystack, to process payments.
• AI service providers, to generate message classifications and reply suggestions.

We may also disclose information if required by law, or to protect the rights, safety, and security of Padiflow, our users, or the public.

6. Data retention

We keep information for as long as a vendor's account is active or as needed to provide the service. Conversation and order history is retained so vendors can serve returning customers. Financial records are kept as required by Nigerian law. When an account is deleted, we delete or anonymize associated personal data within 30 days, except where a longer period is required by law.

7. Data deletion

Vendors can delete products, conversations, or their entire account from within Padiflow, or by emailing us. Disconnecting a messaging channel stops new data collection from that channel, and the vendor may request deletion of previously collected data from it.

If you interacted with Padiflow through a Meta platform and want data about you deleted, email operations@padiflow.com with the phone number or username you used, and we will delete the associated data we hold within 30 days and confirm once complete.

8. Security

We protect information with encryption in transit and at rest, encrypted storage of credentials using managed key infrastructure, access controls, and audit logging. No online service can guarantee absolute security, but we treat the protection of vendor and customer data as a core engineering requirement.

9. Your rights

Under the Nigeria Data Protection Act 2023 and similar laws that may apply to you, you have the right to access the personal data we hold about you, request correction or deletion, object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local data protection authority.

10. European users (GDPR)

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR apply to our processing of your personal data, and this section supplements the rest of this policy.

Legal bases. We process personal data on the following bases: performance of a contract (providing Padiflow to vendors under our terms); legitimate interests (securing the service, preventing fraud and abuse, and understanding how the service is used, balanced against your rights); consent, where we ask for it, which you may withdraw at any time; and compliance with legal obligations.

Controller and processor roles.For vendor account data, Vexel Labs Limited is the data controller. For the conversation and order data of a vendor's customers, the vendor is the controller and Padiflow processes that data on the vendor's behalf and instructions, as described in section 4.

Your GDPR rights. In addition to the rights in section 9, you have the right to data portability (receiving a copy of data you provided in a structured, machine-readable format) and the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Padiflow does not make such decisions: AI-generated reply suggestions are always reviewed and approved by a human before sending. You may also lodge a complaint with the supervisory authority in your country of residence.

International transfers.Where personal data of EEA or UK individuals is transferred outside those regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms offered by our infrastructure providers.

11. International transfers

Our infrastructure providers may store or process data in countries outside Nigeria. Where data is transferred internationally, we take steps to ensure it receives an adequate level of protection consistent with applicable data protection law.

12. Age requirement

Padiflow is a business tool intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date, and for significant changes we will notify vendors through the service or by email.

14. Contact us