Legal
Privacy Policy
Last updated 23 August 2026 · Exeli Digital Limited (RC 9669496), Port Harcourt, Rivers State, Nigeria
In short
We hold two different kinds of information, and we are not in the same legal position for each.
Your account — your name, business name, WhatsApp number and email. We decide how that is used, so we are the data controller for it.
Your customers' messages — the conversations Exeli helps you answer. You decide what happens to those. We only handle them on your instructions, so we are a data processor and you are the controller. The Seller Data Processing Terms govern that relationship.
We do not sell personal data. We do not use your customers' conversations to train anyone's AI models.
1. Who we are
Exeli (“Exeli”, “we”, “us”) is a product of Exeli Digital Limited, a company incorporated in Nigeria with registration number RC 9669496, registered at No. 1, Rumuesara Extension Estate, Eneka, Rivers State, Nigeria.
This policy explains how we handle personal data under the Nigeria Data Protection Act 2023 (NDPA) and the directives of the Nigeria Data Protection Commission (NDPC).
2. Two roles, and why the difference matters
Exeli is a WhatsApp assistant for businesses. A customer messages a business; Exeli drafts a reply using AI; the business owner approves, edits or rejects it; the approved reply is sent from the business's own WhatsApp number.
| Data | Our role | Who decides how it is used |
|---|---|---|
| Seller account and billing data | Controller | Exeli |
| Website visitors and waitlist signups | Controller | Exeli |
| Conversations between a seller and their customers | Processor | The seller |
If you are a customer of a business that uses Exeli and you want your data corrected or deleted, the fastest route is to ask that business directly — they control it. You may also write to us and we will pass the request on and support it.
3. What we collect
If you join the waitlist
- WhatsApp number (required), email address (optional)
- Whether you asked to be considered as a pilot seller
- The date you signed up
If you are a seller using Exeli
- Your name, business name, business WhatsApp number, email address and contact details
- Business settings you configure — prices, stock list, opening hours, tone of voice, business context used to draft replies
- Records of your activity in the app: which drafts you approved, edited, or rejected, and when
- Payment records, where you pay for a subscription
Conversations we process on your behalf
- Your customer's WhatsApp phone number and WhatsApp profile name
- Message content — text, images, documents, location pins, reactions
- Voice notes, and the text transcription we generate from them so the AI can draft a reply
- Message timestamps and delivery status
Automatically
- Standard server logs (IP address, browser type, pages requested) kept for security and debugging
- Error diagnostics when something breaks, so we can fix it
We do not use tracking or advertising cookies. We do not run third-party advertising pixels on this site.
4. Why we process it, and our lawful basis
| Purpose | Lawful basis (NDPA s.25) |
|---|---|
| Providing the service you signed up for | Performance of a contract |
| Drafting replies with AI and transcribing voice notes | Performance of a contract |
| Waitlist signup and early-access contact | Consent (withdraw any time) |
| Security, fraud prevention, debugging, service improvement | Legitimate interest |
| Accounting, tax and regulatory records | Legal obligation |
5. Who we share it with
We use a small number of service providers to run Exeli. They may only process data on our instructions, and they are listed in full — with their locations — in the Seller Data Processing Terms.
- Meta Platforms — the WhatsApp Business Cloud API that carries the messages
- Anthropic — the AI model that drafts replies
- Amazon Web Services — voice note transcription
- Supabase — the database where accounts and conversations are stored
- Vercel — application hosting
- Resend — transactional email
We never sell personal data, and we do not share it for anyone else's marketing. We may disclose data where we are legally required to — for example a valid order from a Nigerian court or regulator.
AI and model training
Message content is sent to our AI provider solely to draft a reply for that conversation. We do not permit your data to be used to train third-party AI models, and we do not sell or license it to anyone for that purpose. We do use your approval and edit history internally to improve how well Exeli drafts replies for your own business.
6. Transfers outside Nigeria
Some of our providers store or process data outside Nigeria — our database is hosted in Ireland (EU) and transcription runs in the United States. NDPA Part IX permits such transfers where an adequate level of protection is provided. We rely on the contractual data-protection terms we hold with each provider, and we select providers who commit to recognised security standards. You may ask us for details of the safeguards for any specific provider.
7. How long we keep it
| Data | Retention |
|---|---|
| Waitlist entries | Until you ask us to remove them, or 24 months of no contact |
| Seller account and settings | For as long as your account is open |
| Conversations and leads | Deleted within 30 days of your account closing, unless you ask for them sooner |
| Financial and tax records | 6 years, as Nigerian tax law requires |
| Server and security logs | Up to 90 days |
8. How we protect it
- All traffic runs over HTTPS/TLS; data is encrypted in transit
- Data is encrypted at rest by our database and storage providers
- Database access is restricted to the server. Row Level Security is enabled and there are no public read policies
- Incoming WhatsApp requests are verified with an HMAC-SHA256 signature, so forged messages are rejected
- Access to production credentials is limited to the people who need them, on the principle of least privilege
No system is perfectly secure. If a breach occurs that is likely to result in a risk to you, we will notify the NDPC within 72 hours of becoming aware of it, and tell affected people without undue delay, as the NDPA requires.
9. Your rights
Under the NDPA you have the right to:
- Ask what personal data we hold about you, and get a copy
- Have inaccurate data corrected
- Ask us to delete your data, where no law requires us to keep it
- Object to, or ask us to restrict, certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where consent is the basis we rely on
- Lodge a complaint with the Nigeria Data Protection Commission
To exercise any of these, email hello@exelidigital.com. We will respond within 30 days. We do not charge for this.
You can also contact the NDPC directly at ndpc.gov.ng.
10. Children
Exeli is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
11. Regulatory registration
Registration as a data controller/processor of major importance with the NDPC is required once processing passes the Commission's thresholds. Exeli is registering with the NDPC and will publish its registration reference here once issued. Our appointed contact for data protection questions is reachable at hello@exelidigital.com.
12. Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects how we handle your data, we will tell active sellers directly on WhatsApp or by email before it takes effect.
Questions about this document? Email hello@exelidigital.com. We answer in plain language — if anything here is unclear, that is our problem to fix, not yours to decode.