Skip to Content

Privacy Policy

Effective date: 2 September 2026

1. Who we are

NexaFlow is a licensed accounting office based in Erbil, Iraq, providing bookkeeping and accounting services to Iraqi small and medium businesses ("Clients"). This policy describes how we handle personal data in the course of that service.

2. What data we process

In the course of accounting services delivered over WhatsApp and our client systems, we may process:

  • Documents our Clients send us: invoice and receipt images, vendor bills, payment proofs, cheque photos, bank statements, and inventory counts.
  • Contact details: phone numbers (a WhatsApp number dedicated to each Client's engagement, and, where a Client has separately authorized it, the numbers of their own customers).
  • Names of individuals named on those documents (a Client's staff, and, where authorized, a Client's own customers).
  • Transaction details appearing on those documents: amounts, currency, invoice or document numbers.

3. WhatsApp Business Platform

We communicate with Clients, and in limited authorized cases with a Client's own customers, using the WhatsApp Business Platform operated by Meta Platforms, Inc. Meta acts as a transport provider for these messages: it carries messages between our systems and the recipient's WhatsApp application. Meta's own privacy terms govern its handling of message transport; our own handling of the content is described in this policy.

4. Who else processes this data (subprocessors)

  • Odoo S.A. (Belgium) — our Clients' own accounting databases and, in some cases, our internal systems run on Odoo's hosting infrastructure.
  • Meta Platforms, Inc. — WhatsApp Business Platform, as described in section 3.
  • Providers of intelligent software processing systems — we use category-level software tools that assist in transcribing, reading, extracting and drafting from documents our Clients send us. Every document these tools touch is reviewed by a responsible accountant before any output is used, sent, or relied upon. We do not identify individual providers of these tools publicly.

5. Purpose

We process this data solely to deliver the bookkeeping, accounting, and related communication services our Clients have engaged us to provide, and, where separately authorized, to deliver a Client's own invoice to their own named customer.

6. Human review

No document, message, or figure produced with the assistance of the software tools described in section 4 is sent, filed, or relied upon without review by a responsible accountant.

7. Retention

  • Export: we provide our Clients a full export of their ledgers, documents, and reports, in open formats, quarterly by default and on request at any time.
  • Deletion on termination: on termination of our engagement with a Client, we complete handover within 15 days, followed by a certified deletion of data we hold outside the Client's own database.
  • Message-log retention: retention of WhatsApp message logs is as stated in the engagement letter for each Client's specific engagement.

8. Your rights

You may request access to, export of, or deletion of personal data we hold about you by contacting us using the details in section 10. We will respond within a reasonable time and confirm the action taken.

9. Data deletion instructions

To request deletion of your data: send a written request by email to info@nexaflowiq.com with your name, the Client company you are associated with (if applicable), and the WhatsApp number the data relates to. We will confirm receipt and the outcome of your request in writing.

10. Contact

NexaFlow, Ainkawa, Erbil, Iraq. Email: info@nexaflowiq.com

11. Governing law

This policy and our handling of personal data are governed by the laws of Iraq.