NexDeliv | Privacy

Who is responsible

NexDeliv is provided by PT NEXDELIV KARYA TEKNOLOGI, a limited liability company (Perseroan Terbatas) in Indonesia, under the name NexDeliv. NexDeliv sends transactional email, and WhatsApp messages for the customers who have switched it on, for its customers’ applications. For the recipients of those messages, the customer decides what is sent and to whom; NexDeliv processes it on the customer’s behalf. For the sign-in and account data below, NexDeliv is responsible.

Email data processing

Recipient email addresses and message content are used to process send requests and are passed to our email delivery provider to deliver the message. NexDeliv never keeps the subject or the content of a message, nor the files attached to it (they are passed on to deliver the message), and does not write addresses to its logs. A message sent from a saved template is not kept either; the templates themselves are described under “What we keep”. When a customer asks for opens and clicks to be tracked for a message, our email provider records them (the time, the link and details of the device), and we pass only the time and the link on to the customer’s webhook, without keeping anything of it. The addresses of the sender and the recipients (to, cc and bcc) are kept in the sending history of the account, as described under “What we keep”.

If a customer has set up a webhook, we tell that customer’s server what happened to each message it sent (delivered, bounced, a complaint, rejected), with the recipient’s address. We do not keep this, except for an event whose call to the customer’s server did not work: that one is kept for 7 days, so that the customer can see it and send it again (see “What we keep”).

We also write to the email address of your sign-in about your account: the sign-in code, the confirmation of a payment, and a reminder when your paid month (or an older free trial) is about to end or has ended, and a notice when you have used 80% and then all of the emails your plan allows in a month. The address is read from the sign-in when we send and is not copied anywhere else.

WhatsApp messages

A customer who has WhatsApp switched on connects its own WhatsApp Business number. When it sends a message, the recipient’s number and the message (the template and the values that fill it, or the text) are passed to WhatsApp, run by Meta, to deliver it. Meta handles them under its own terms and privacy policy. NexDeliv does not keep the content of a message sent through the API or the values of a template, and does not write numbers to its logs. The exceptions are what a customer answers from its inbox and what a broadcast has to send, described below.

To send as the customer’s number we hold an access token that the customer gave us when it connected the number. The token is kept sealed with an encryption key and tied to that customer, it is used only for that customer’s own number and business account, and only to send its messages and read their status, to read the list of its approved templates, to check that the number belongs to its business account, to subscribe NexDeliv to that account’s webhooks and to take it off them again when the number is disconnected, to register the number with Meta (with a PIN that we choose and keep), to send the customer’s message templates to Meta for review, and to renew the token itself, and it is never shown, logged or sent back to anyone. It is deleted when the number is disconnected or the account is closed; the customer can also withdraw the access at Meta.

A customer connects its number from the dashboard with Meta’s own sign-up window. For that, the dashboard page loads a script from Meta and opens a window of Meta, where the customer signs in to Meta and chooses its business account and number; Meta handles that under its own terms and privacy policy, and receives what any page that loads its script receives (such as the address of the page and the customer’s browser). We receive from Meta a one-time code and the ids of the business account and of the number, exchange the code for the access token on our server, and keep the token, and the six-digit PIN with which we register the number with Meta, sealed in the same way (the PIN is only used to register that number again, and is deleted with the number). The token works for 60 days, and once a day we renew the ones that are about to end, with Meta, so that sending does not stop; if Meta no longer accepts one, the dashboard asks the customer to connect the number again, and we write once to the people who sign in for the account (their addresses are read from our sign-in service at that moment and are not kept). A template that a customer makes in the dashboard goes to Meta for review and we keep nothing of its text; when Meta reports that a template was approved or rejected, we pass its name, language, category and reason to the customer’s webhook if it chose that event. Taking a number off also takes our app off the webhooks of its account at Meta. The script is loaded only on the WhatsApp page (nexdeliv.com/whatsapp), for a signed-in customer whose account is switched on.

A customer who has WhatsApp switched on can keep contacts in its dashboard, like an address book: a number, a name, tags, a note and a few fields of its own choosing, and whether the person agreed to be written to. We keep them for the customer, only until the customer deletes them, and delete all of them when the account is closed. They are the customer’s own content and are not used for anything else. They do not contain the messages themselves.

A customer with a WhatsApp plan can send a broadcast: one approved template to the contacts it marked as having agreed to hear from it, now or at a time. For that we keep the name the customer gave the broadcast, the template’s name and the values it fills in, an optional tag, and the counts of how it went (how many Meta took, how many failed and why), until the broadcast ends and then for the days of the plan, and delete them by themselves. While it runs we hold the number of the contact we have reached; nothing about a person is kept in the broadcast once it ends. The messages themselves are kept like any message sent through the API.

When a person writes to a customer’s number, Meta tells us. For a customer without an inbox we do not keep what they wrote: we note only that they wrote and when (under a hash of their number, for about a day), because free text may be sent only within 24 hours of their last message. A customer with a WhatsApp plan has an inbox: there we also keep the text of the message, the name of the person’s WhatsApp profile and the person’s number (or, when the person uses a username and Meta did not share the number, the identifier Meta gives us for them), together with the answers the customer sends from the inbox. The text is sealed for that customer, kept for the days of the plan (7, 30 or 90) and then deleted by itself, and the customer can delete a conversation at any time. We keep only text: for any other kind of message we keep only its kind. If the customer set up a webhook and chose this event, we tell it the person’s number, the kind of message (text, image and so on) and the time, never the content. We also tell the webhook what became of each message the customer sent (accepted, delivered, read, failed, with Meta’s error code).

What we keep

Account: the email address you sign in with and, if you turn on two-step sign-in, the secret of your authenticator app (both kept by our sign-in provider), the name of your sending account, its plan and limits, your sending domains, your webhook address and its signing secret if you set one, and a hash of your API key (never the key itself).
Sign-up check: the sign-up page runs a bot check to tell people from automated sign-ups. Its provider reads details of your browser to do it, under its own privacy policy, and gives the page a token; our sign-in provider passes the token to us and we send it, with our secret key, to that provider to check it. We also look at the domain of the email address you sign up with (the part after the @), in public DNS, to turn away temporary-mail services and addresses that cannot receive email, so that the code we send does not bounce. We keep nothing of any of it. When you create an account, we keep a one-way fingerprint of your mailbox (a hash of your email address with the dots and the part after a plus sign taken out for Gmail, Outlook, iCloud and a few others), never the address itself, so that one mailbox opens one account. The fingerprint is kept after an account is closed, because that is the point of it.
Domain checker: the page that checks a domain looks up the domain you type in public DNS (its SPF, DKIM and DMARC records) and shows what it finds. We do not store the domain or the result and do not write them to our logs; the answer is kept for one minute, so that the same check asked again costs nothing, and is then gone. The page runs the same bot check as the sign-up page, under its provider’s own privacy policy, and sends us its token, which we check with that provider and do not keep.
Payments: when you pay for a plan or a top-up of emails we keep a payment request with its reference, the plan or top-up, the amount and the date, until what date the plan is paid, and how many emails of top-ups count for the current month; for prepaid emails, how many are left and until what date they are valid. Online payments are processed by Mayar (mayar.id), which makes the payment page and collects the payment details (e-wallet or bank account) under its own privacy policy. When you ask to pay, we send Mayar the email address of your sign-in, the amount and our reference, and Mayar uses the address to send you the proof of payment and to tell requests apart; we receive only the result and the reference, never a card number. For the accounts of the business we also keep, without a time limit, one record of each payment that was applied: the month, what was paid for, the amount and a one-way code of the account name (so that the same account paying twice can be counted once); never a name or an email address.
Usage: how many emails each account sent today and this month, and how many WhatsApp messages this month, to apply its limits. The WhatsApp count of a month is kept for about two months and then deleted by itself.
Sending history: for each message you send we keep the time, the sender address, the addresses it went to (to, cc and bcc), the message id and what became of each recipient (accepted, delivered, bounced, a complaint, rejected) and, for a failure, a few fixed words about why (the type of the bounce, the status code of the other server such as 5.1.1, the type of a complaint; never the text of the other server’s answer) and, for a message sent with tracking, whether and when it was first opened and a link of it first followed (never the link or the device), so that you can see them in your dashboard. We do not keep the subject, the body or the headers (a message sent from a template is not kept either). An entry is deleted by itself after 7 days on Starter, 14 days on Basic and 30 days on Pro, and the dashboard shows only those days. It is visible only to the signed-in users of that account and to us when we must fix a problem.
Support tickets: the subject and the messages that you and we write to a support ticket (a paid plan can open one), the account and the plan it was opened from, and the times, and the files you attach (png, jpg, gif, webp, pdf, txt, log, csv or json; up to 3 MB each and three to a message), which are kept in private, encrypted storage in Singapore and downloaded only through a link that works for ten minutes. No email address is kept with a ticket: your address is read from your sign-in when we email you about it. Each message and its files are deleted by itself 400 days after they were written, the ticket with its last message, and all of it with the account. An email you send to the reply address of a ticket passes through our email-forwarding provider and is added to the ticket; our support mailbox also receives a copy of the notices of new tickets and replies.
Failed webhook calls: when your server does not accept a call of your webhook after our tries, we keep that event for 7 days so that you can see it in the dashboard and send it again: its type, the message id, the times and the answers, and the event as it was sent, which holds the address (or the WhatsApp number) of the person it is about. It is deleted by itself after 7 days, and with the account. A call that worked leaves nothing.
Templates: the email templates you save in the dashboard (name, subject, text and html). They are your own content: we keep them until you delete them or close the account, and we never read, log or use them for anything else. A message sent from a template is not kept.
WhatsApp numbers: for each number a customer connects: its id and the id of its business account at Meta, the number as people see it, whether it may send, and the sealed access token described under “WhatsApp messages”. They are deleted when the number is disconnected or the account is closed.
WhatsApp history: for each WhatsApp message you send we keep the time, the number it was sent from, the recipient’s number, the name of the template (not its values), its status, the id Meta gave the message and, if it failed, Meta’s error code, so that you can ask for the status of a message through the API. We do not keep the text or the values of a template. An entry is deleted by itself after the same 7, 14 or 30 days as the sending history of the plan. An Idempotency-Key you send with a message is kept for 24 hours so that the same message is not sent twice. The entries are visible only to the holders of the account’s API key and to us when we must fix a problem.
The assistant (Basic and Pro): when you ask the assistant in the dashboard about your sending, your question and the earlier turns of that conversation (kept only in your browser while the page is open) are sent to an AI service run by a third party, together with numbers read from your own account: how many recipients were delivered, bounced, complained or rejected each day, the type, subtype and status code of bounces (such as 5.1.1), the type of complaints, and the domains (the part after the @) of recipients that failed. No email address of a recipient, and no subject, text or html of any message, is ever sent. An email address that you type into a question is replaced by a placeholder before it is sent. We do not store your questions or its answers: we keep only how many questions your account asked this month and how much of the service it used. The provider states that it does not use inputs or outputs to train its models and does not share them with the maker of the model, and that for some models it keeps inputs and outputs for up to 30 days to detect abuse. The request may be processed in a country other than Singapore, while what we store stays in Singapore. The assistant only reads: it cannot send, change or delete anything.
Recovery codes: if you turn on two-step sign-in we keep a one-way hash of each of your recovery codes, never the codes themselves, until they are used or replaced.
Suppression: when a message to an address bounces or draws a complaint, the address is put on that account’s suppression list so it is not mailed again. On Starter, NexDeliv keeps only a one-way hash of the address and the reason. On the plans that let you manage the list (Basic and Pro) it keeps the address itself, the reason and the time, so that you can see, search and delete it; it is removed when you delete it, when its days on the list (30 to 365, or 90 by default) pass, or when the account is closed. Our email delivery provider keeps the address itself in its suppression list for the account.

Everything is stored with our cloud infrastructure provider, in Singapore. We use a separate provider for DNS. We do not sell data or use it for advertising.

Closing an account

When an account is closed we switch it off, delete its sending domains, its separate sending space at our email delivery provider, its WhatsApp numbers with their sealed tokens and its records (limits, usage, webhook, suppression list, saved templates). Its sending history, WhatsApp history included, disappears by itself within the days of its plan (at most 30). Sign-in accounts are deleted when you ask. Suppression entries held by the email delivery provider follow that provider’s own retention.

Your rights

You can ask what we hold about you, and ask us to correct or delete it, by writing to the address below. If a message was sent to you through NexDeliv and you want it to stop, ask the sender (our customer) first; if that does not work, write to us and we will help.

Counting visits

To learn how many people use this site and hifzuna.com, each page you open (by loading it or by moving to it from another page of the site) sends one anonymous report: which section was opened, whether the visitor is signed in, and a random code this browser keeps for about 13 months so a returning visitor is counted once. No cookie is used, and no name, email address, or IP address is stored. Visitors in the EEA, the United Kingdom, or Switzerland, or whose country is not known, get no code: their visit is counted for that day only. Browsers that send Do Not Track or Global Privacy Control are not counted. The language of the page is not counted.

Cookies and privacy questions

This site does not use advertising trackers or cookies.

Your sign-in is kept in your browser's storage, not in a cookie: by default only in the tab you signed in on, so it is gone when you close it. If you tick “Keep me signed in on this device” when you sign in, it is kept on the device until you sign out or it runs out, in every tab. Do not tick it on a computer that other people use.

If you choose a light or dark theme with the button in the header, the choice is kept in this browser only. It is never sent to us.

For privacy questions, contact [email protected].