Nxlayr – Privacy Policy

Effective Date: 14 June 2026 Last Updated: 14 June 2026

This Privacy Policy explains how Nxlayr ("we," "us," or "our"), operated by Jelu. LLC, a limited liability company registered in the State of Wyoming, United States of America, collects, uses, stores, and protects personal information when you access or use our Services.

We are committed to processing personal information responsibly and in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable privacy laws.

By using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Who This Policy Applies To

This Policy applies to:

  • Clients — businesses and individuals who subscribe to and use the Nxlayr platform

  • End Users — individuals whose personal information is processed through the platform by our clients (such as their leads, contacts, and customers)

  • Website Visitors — individuals who visit our website or landing pages

Note for Clients: If you are a Nxlayr client, this Policy covers how we handle your personal information as a subscriber. How you handle the personal information of your contacts and leads through our platform is governed by our Terms & Conditions and your own privacy obligations as a Responsible Party under POPIA.

2. Our Role Under POPIA

Under POPIA:

  • Nxlayr acts as an Operator when processing personal information on behalf of our clients (i.e., processing the data of their contacts, leads, and customers as instructed)

  • Nxlayr acts as a Responsible Party when processing personal information about our own clients and website visitors for our own business purposes (e.g., account management, billing, support)

This Policy primarily addresses our obligations as a Responsible Party. Our obligations as an Operator are set out in our Terms & Conditions.

3. Information We Collect

3.1 Information You Provide Directly

  • Full name and job title

  • Business name and registration details

  • Email address and phone number

  • Billing and payment information (processed via our third-party payment processor; we do not store full card details)

  • Support and correspondence records

3.2 Account & Usage Data

  • Login credentials (passwords are stored in encrypted form only)

  • Platform activity logs and feature usage data

  • Campaign and automation configuration data

  • Communication histories and message delivery records

3.3 Technical Data

  • IP address and approximate location (country/city level)

  • Browser type and version

  • Device type and operating system

  • Session duration and page interaction data

  • Referring URLs

3.4 Messaging & Consent Data

  • SMS and WhatsApp opt-in status and consent records

  • Message delivery, open, and response data

  • Opt-out requests and timestamps

3.5 Information Collected About End Users (on behalf of Clients)

Where clients use the platform to manage contacts, leads, and customers, personal information about those individuals is processed by Nxlayr as an Operator on the client's instruction. We do not use end user data for our own purposes.

4. How We Use Your Information

We use personal information for the following purposes:

Purpose Lawful Basis (POPIA) Creating and managing your account Contractual necessity Processing subscription payments Contractual necessity Providing platform features and technical support Contractual necessity Sending service-related communications (invoices, updates, downtime notices) Contractual necessity Sending product updates and marketing communications (with opt-out available) Legitimate interest / Consent Improving and developing platform features Legitimate interest Detecting fraud, abuse, and security threats Legitimate interest / Legal obligation Complying with legal obligations (e.g., tax records, regulatory requests) Legal obligation

We do not use your personal information for automated decision-making that produces legal or similarly significant effects without human review.

5. SMS & Messaging Data Protection

We take the following commitments regarding messaging data:

  • No mobile opt-in data, consent records, or messaging data is sold, shared, or transferred to any third party for marketing or promotional purposes — ever

  • Consent records are retained securely and are available to clients for compliance purposes

  • Opt-out requests are processed immediately and honoured permanently unless the individual re-opts in

  • Message delivery data (sent, delivered, failed, opened) is retained to support platform functionality and client reporting

  • Messaging data processed on behalf of clients remains the client's data; we do not use it for our own purposes

6. Cookies & Tracking Technologies

We use cookies and similar technologies on our website and platform to:

  • Maintain your session and authentication state

  • Remember your preferences and settings

  • Analyze platform usage and performance

  • Detect and prevent security threats

Types of cookies we use:

  • Strictly necessary cookies — required for the platform to function; cannot be disabled

  • Analytics cookies — help us understand how the platform is used (aggregated, anonymized data)

  • Preference cookies — remember your settings and display preferences

You may control non-essential cookies through your browser settings. Disabling cookies may affect platform functionality.

We do not use advertising or retargeting cookies on the Nxlayr platform.

7. How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances:

7.1 Service Providers (Sub-Operators) We engage trusted third-party service providers to help us deliver the Services, including:

  • Cloud hosting and infrastructure providers

  • Payment processors

  • Communication infrastructure providers (SMS, email delivery)

  • AI and automation service providers

  • Customer support tooling

All sub-operators are contractually required to process personal information only as instructed, maintain appropriate security measures, and comply with applicable data protection law.

7.2 Legal Requirements We may disclose personal information where required by law, court order, or a lawful request from a government authority or regulator, including the Information Regulator of South Africa.

7.3 Business Transfers If Jelu. LLC is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected users before personal information is transferred and becomes subject to a different privacy policy.

7.4 With Your Consent We may share information in other circumstances with your explicit prior consent.

8. Cross-Border Transfer of Personal Information

Nxlayr is operated from the United States and our infrastructure may be hosted on servers located outside the Republic of South Africa. Where personal information of South African data subjects is transferred outside South Africa, we comply with section 72 of POPIA by ensuring that:

  • The recipient country or organization provides a level of protection substantially similar to POPIA, or

  • We have put in place appropriate contractual safeguards (such as data processing agreements) with the recipient

A list of the countries in which our primary sub-operators are located is available on request at [email protected].

9. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law.

Data Type Retention Period Account and billing information Duration of subscription + 5 years (for tax and legal compliance) Platform usage and activity logs 12 months rolling Support correspondence 3 years from last interaction Messaging and consent records Duration of subscription + 3 years End user data (processed as Operator) Deleted or returned upon client request or within 30 days of contract termination

When personal information is no longer required, we securely delete or anonymize it.

10. Data Security

We implement appropriate technical and organizational security measures to protect personal information against loss, damage, unauthorized access, disclosure, or unlawful processing. These include:

  • Encryption of data in transit (TLS) and at rest

  • Access controls and role-based permissions

  • Regular security assessments

  • Secure credential storage (passwords are hashed and salted)

  • Monitoring for unauthorized access and anomalous activity

No system is completely secure. In the event of a security compromise involving personal information, we will notify affected parties and the Information Regulator in accordance with section 22 of POPIA.

11. Your Rights Under POPIA

As a data subject, you have the following rights under POPIA:

Right What It Means Right of access Request confirmation of whether we hold your personal information and obtain a copy Right to correction Request that we correct inaccurate or incomplete personal information Right to deletion Request deletion of personal information we are no longer lawfully entitled to retain Right to object Object to processing based on legitimate interests or for direct marketing purposes Right to withdraw consent Withdraw consent at any time where processing is based on consent (without affecting prior processing) Right to lodge a complaint Lodge a complaint with the Information Regulator if you believe we have violated POPIA

To exercise any of these rights, contact our Information Officer at: 📧 [email protected]

We will respond to requests within a reasonable time and in any event within the timeframe required by POPIA. We may need to verify your identity before processing your request.

Complaints to the Information Regulator: If you are not satisfied with our response, you may lodge a complaint with: Information Regulator of South Africa 🌐 www.inforegulator.org.za 📧 [email protected]

12. Direct Marketing

We may send you product updates, feature announcements, and promotional communications. You may opt out of marketing communications at any time by:

  • Clicking the unsubscribe link in any marketing email

  • Replying STOP to any marketing SMS

  • Contacting us at [email protected]

Opting out of marketing communications does not affect service-related communications (such as invoices, security alerts, and platform notices), which we may continue to send as necessary.

13. Children's Privacy

The Services are not directed at or intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a minor, we will delete it promptly.

14. Applicable Law

This Privacy Policy is governed by the laws of the State of Wyoming, United States of America. Where the mandatory provisions of South African law apply to the processing of personal information of South African data subjects and cannot be excluded by choice of law — including POPIA — those provisions apply to the extent required.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you via email or a prominent notice within the platform at least 30 days before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

16. Contact & Information Officer

For any questions, concerns, or data requests relating to this Privacy Policy:

Nxlayr Support 📧 [email protected]

Information Officer (POPIA) Our designated Information Officer handles all personal information compliance matters. For confidentiality reasons, the officer's name is not publicly disclosed. All enquiries, access requests, and complaints may be directed to: 📧 [email protected]

Information Regulator of South Africa 🌐 www.inforegulator.org.za 📧 [email protected]