Privacy Policy

1. Who is responsible for your data

If you visit necx.cloud, contact us, or are a NECX client, Circ Technologies (Private) Limited is responsible for your data.

If you message or call a business that uses NECX, that business decides how your conversation is used. The business is the data controller, and NECX processes the conversation on its behalf and on its instructions. Questions about your conversation should go to that business first. We will help it respond.

2. What we collect on this website

• Contact and demo requests. The name, work email, company, phone number and message you type into a form.
• Usage and device data. Pages visited, links clicked, approximate location derived from your IP address, browser and device type, collected through cookies and similar technologies (see section 5).
• Server logs. Your IP address and the requests your browser makes, kept for security and to limit abuse.

3. What we collect in the NECX platform

Conversation data, on behalf of our business clients

• Messages sent and received on the business's connected channels: text, images, documents, voice notes and other media.
• The sender's phone number or channel ID, and the profile name the channel provides.
• Delivery and read statuses, timestamps, and the notes, tags and outcomes staff record against a conversation.
• For voice calls: call metadata (numbers, times, duration), transcripts and, where the business has turned it on, call recordings.

Client account data

• Name, work email, phone number, role and organisation of each staff user.
• Sign-in and usage activity, including an audit log of security-relevant actions.
• Device information and push-notification tokens if you use the NECX mobile app.
• Billing contact details and payment records. Card payments are handled by our payment processors, and we do not see or store your full card number.

Data we receive from Meta (WhatsApp, Facebook and Instagram)

When a business connects its WhatsApp number, Facebook Page or Instagram account to NECX, Meta gives NECX access to that business's accounts, including account identifiers, an access token, incoming messages with the sender's number or ID and profile name, delivery statuses, and message template details. Access tokens are encrypted at rest and never shown in the NECX interface.

We use this data only to provide NECX to the business that connected the account. We do not sell Meta data, use it for advertising, or combine it with data from other clients.

4. How we use data

• To reply to your enquiry, arrange a demo and follow up with you about NECX.
• To deliver and receive messages and calls for our business clients.
• To generate AI replies, summaries, translations and search results over a client's own knowledge base, when the client turns those features on.
• To route conversations to the right staff member, and to measure response times and service quality for the client.
• To process payments, issue invoices, handle refunds and contact clients about their account.
• To understand how this website is used and to measure our advertising.
• To secure the website and platform, investigate abuse, and keep audit records.

5. Cookies and analytics

This website uses cookies and similar technologies from two providers:

• Google Analytics, to count visits and see which pages and features are used. We never send the details you type or say to Google Analytics, only that an action happened.
• Meta Pixel, to measure the visits that come from our adverts on Facebook and Instagram.

You can block or delete cookies in your browser settings. The website still works without them. You can also opt out of Google Analytics with Google's browser add-on, and control ad measurement in your Facebook and Instagram ad settings.

6. AI features

When a business enables AI agents, the relevant conversation content is sent to an AI model provider to produce a reply. Staff can take over any conversation at any time. We use AI providers through their business APIs. NECX does not train AI models on conversation data.

7. Who we share data with

We do not sell personal data. We share it only with:

• The business you are talking to, and the staff it authorises in NECX.
• Service providers that run parts of NECX for us and process data only to provide their service:

• Authorities, where the law requires it.

Every provider is bound by a contract that limits its use of the data to providing its service to us. Business clients can ask us for the current list of providers under their agreement.

8. Where data is stored and how it is protected

The NECX platform runs on secure cloud infrastructure. Data in transit is encrypted with TLS. Channel access tokens and other client secrets are encrypted at rest. Each client's data is kept separate from every other client's. Staff passwords are hashed, and access within a client's workspace is controlled by roles.

No method of transmitting or storing data is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will tell you and the authorities as the law requires.

9. How long we keep data

• Enquiries and demo requests are kept while we are in touch with you, and for up to two years after our last contact.
• Conversation data is kept while the business has a NECX account. Businesses on eligible plans can set a shorter retention period, after which messages and transcripts are deleted automatically.
• When a business closes its account or disconnects a channel, we delete or return its data as set out in its agreement with us.
• When a staff user deletes their account, their profile is anonymised straight away. A record that the deletion happened is kept in the security audit log.
• Invoices and payment records are kept for as long as tax and accounting law requires.

10. Your rights

Depending on where you live, including under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you can ask to access, correct or delete your personal data, or object to how it is used. Email hello@necx.cloud. We respond within 30 days. If your data is in a conversation with a business that uses NECX, we will pass your request to that business and act on its instructions.

11. Children

NECX is a business tool and is not directed at children.

12. Changes to this policy

We will update the date at the top of this page when this policy changes, and tell clients directly about material changes.

13. Contact

Circ Technologies (Private) Limited, 10/4, 14th Lane, Colombo 13, Sri Lanka. Email hello@necx.cloud or call 011 734 1900.