Privacy Policy

Exniv ("Exniv", "we", "us") provides a modular, multi-tenant operations platform (ERP) including projects, HR, finance, CRM, files, and WhatsApp business messaging via Meta's WhatsApp Cloud API.

This policy covers:

• the marketing website at exniv.com (including demo / access request forms)
• the Exniv product at erp.exniv.com
• WhatsApp / Comms Hub processing we perform for customer businesses

Website and sales

• Name, work email, company, team size, modules of interest, and optional message (demo / request-access forms)
• Technical logs: IP address, browser type, pages viewed, approximate time (to run and secure the site)

Product accounts

• Account identity: name, email, role, company/tenant membership
• Business data customers choose to store: employees, projects, finance records, files, CRM, and similar module data
• Usage and security logs (sign-in, permission changes, admin actions)

WhatsApp Business Communications

Our platform integrates with Meta Platforms, Inc. (WhatsApp Cloud API) to enable business-to-customer communications.

Plain-language glossary

1. Temporary Staged Attachments (7 Days): Files (such as PDFs or images) uploaded in the chat composer that were cancelled or never sent. These are automatically removed to save storage.
2. Diagnostic Webhook Logs (30 Days): Technical delivery records sent between Meta and our servers, used by engineers to troubleshoot message delivery issues and network errors.
3. Customer Conversation Messages (365 Days): The actual chat messages and sent media exchanged between a customer and the business, retained for customer service history.
4. Proof of Consent and Opt-Out Records (3 Years): Time-stamped records showing when a customer opted in or texted STOP to opt out. These are maintained to comply with anti-spam laws (such as TCPA and GDPR).
5. Administrative Audit Logs (7 Years): Internal security logs recording administrative actions (such as when a manager connects/disconnects a phone number or updates channel settings). These do not contain message contents or passwords and are kept for corporate accounting and compliance audits.

• Provide and secure the website and product
• Respond to demo and access requests
• Host and process tenant business data on their instructions
• Send and receive WhatsApp messages for connected business numbers
• Troubleshoot delivery, prevent abuse, and meet legal duties
• Improve the product using aggregated or non-identifying information where possible

We do not sell personal data.

• Contract — to provide the service a customer signed up for
• Legitimate interests — security, product improvement, responding to sales inquiries
• Consent — WhatsApp marketing/opt-in where the tenant collected it; website cookies if we add non-essential cookies later
• Legal obligation — tax, accounting, responding to lawful requests

We share data only with:

• The customer's own users inside their Exniv tenant (RBAC)
• Processors we use to host, email, or operate the service (cloud, email delivery)
• Meta Platforms, Inc. when a tenant connects WhatsApp (Cloud API, Embedded Signup, message delivery)
• Authorities if required by law

We do not share WhatsApp message contents with other tenants.

Data may be processed on servers outside the visitor's country (including where our hosting and Meta process WhatsApp). We take reasonable contractual and technical steps to protect it.

• Demo/access leads: kept while we handle the inquiry, then deleted or archived on a reasonable sales cycle unless you ask us to delete sooner
• Account data: for the life of the customer contract, then deleted or anonymized except where we must keep records
• Security logs: limited period needed for security and abuse investigation
• WhatsApp: the schedule in section 2

Access is limited by tenant isolation and role-based permissions. We use encryption in transit (HTTPS), access controls, and operational logging. No method is 100% secure.

Depending on your location, you may request access, correction, deletion, restriction, or a copy of personal data Exniv controls, and you may object to certain processing.

• Marketing / account data we control: email privacy@exniv.com
• WhatsApp end-user data: use the WhatsApp Data Deletion Page or reply STOP to stop messages. The tenant business usually controls that data, so we may need their confirmation before we delete.
• Meta-held WhatsApp account data: use Meta / WhatsApp's own account tools; Exniv cannot delete data stored only by Meta.

We may need to verify the requester. We aim to respond within 30 days.

Exniv is a business product. We do not knowingly collect data from children under 16.

The marketing site uses cookies or similar storage that are necessary to run the site (for example session or security). If we later add analytics or advertising cookies, we will update this policy and, where required, ask for consent.

We may update this policy. The "Last updated" date will change. Material WhatsApp retention or deletion changes will stay consistent with what we tell Meta.

Exniv — privacy@exniv.com

WhatsApp data deletion: exniv.com/privacy/data-deletion