Privacy policy

Scope and contact

This policy covers Nexdrale, operated by Spreadle, including this marketing website and the connected provider workspace. For privacy questions, access, correction or deletion requests, contact spreadlellc@gmail.com. For customer conversations with a business using Nexdrale, that business determines its customer-service purpose and is your first contact for its records. Spreadle processes those records to provide the business’s configured service and handles its own account, security and support administration.

Information involved

The workspace processes owner account and business details, connected business-account and phone identifiers, authorization status, encrypted access credentials, configured profiles, automation templates and activity records. Captured messaging data can include a sender’s name and phone number, message text, selected choices, submitted form fields, timestamps, delivery information and attachment metadata such as file names and media identifiers. Original incoming attachment files are not stored by the captured-message inbox. Authorized profile-photo uploads and other expressly requested Meta operations are separate processing activities.

How we use information

We use information to authenticate authorized owners, connect approved business assets, run selected automation, display captured messages, maintain profiles, diagnose errors, provide support and protect account boundaries. Data belonging to one business is not made available to another business through the workspace. We do not sell customer or Meta Platform Data, use it for advertising, or use it to build unrelated profiles.

Website storage and sample conversations

This marketing website stores only your selected light or dark appearance in localStorage. It does not include advertising cookies or an analytics tracker. The sample conversation uses fictional information and runs in browser memory; it does not send messages to WhatsApp or save a conversation on our servers. Hosting providers necessarily receive network request details such as IP addresses, requested URLs and user-agent information to deliver and secure the site. Contact links open your email or phone application; an email draft is sent only when you send it.

The workspace and service providers

The workspace uses managed authentication and database hosting from Neon and application hosting from Vercel. This public site is delivered through Cloudflare. Meta/WhatsApp processes authorized business connections and messages under its own applicable terms. Provider services may process data in countries other than yours; the workspace’s current database and application deployment are configured for Singapore. We use providers only as needed to deliver the service and may disclose information when required by law or to protect legitimate security interests. A business-specific processing agreement or transfer arrangement can be agreed where required.

Optional AI drafting

When an authorized owner asks the optional draft assistant to generate a flow, the supplied description and optional current template text are sent to Groq. The assistant does not automatically attach business records or credentials. Do not include personal or sensitive customer data in a drafting request. Live customer replies use the saved flow rather than sending every customer message to Groq. API keys are held on the server; generated draft results can be cached for one hour, with expiry cleanup during subsequent provider requests. A draft applied by the owner becomes ordinary template content.

Retention and security

Captured messages are visible for 30 days. Expired records are pruned during later webhook or inbox operations; this is not a promise of physical deletion exactly at the 30-day boundary. Temporary live-conversation state has a shorter reply-window lifetime and is cleaned up during subsequent runtime work. Business settings, saved templates and necessary operational records are retained for the service or until an applicable deletion request is completed, subject to legal or security retention needs.

Credentials, captured message identity/content and runtime state use encryption at rest within the application. Server-side access controls separate businesses and restrict the owner workspace. Encryption and access controls reduce risk but cannot eliminate all security risks. Backups and third-party systems may have separate retention cycles; we explain any applicable limitation when responding to a deletion request.

Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, request portability or complain to the relevant authority. Contact spreadlellc@gmail.com or the business you messaged, identifying the relevant business and phone number with country code. We may need proportionate information to verify the request without exposing another person’s data. Follow our deletion instructions to remove a business connection or request removal of retained records.

Children, sensitive data and changes

Nexdrale is a business service, not a service directed to children. Businesses must meet applicable age and consent rules. Ordinary enquiry automation is not designed to hold medical records, financial identifiers or other sensitive records. We update this policy when processing changes and publish the effective date here, with additional notice where required.