Privacy policy

Last updated: [PRIVACY_POLICY_LAST_UPDATED not set]

1. About this policy

This policy explains how [BUSINESS_LEGAL_NAME not set] (UEN [BUSINESS_UEN not set]), "we" or "us", handles personal data when you use our website, our client portal and our services: AI agents (including agents that answer on WhatsApp) and AI training. We follow Singapore's Personal Data Protection Act 2012 (PDPA).

We have two roles:

• For our own records, such as the accounts of our clients' staff and our business contacts, we decide how the data is used and are responsible for it.
• For our clients' customers, such as people who message a client's business on WhatsApp, we process data on behalf of that client as a data intermediary, under a data processing agreement. The client decides how that data is used. Questions about it are best sent to the business you contacted. We will help them answer.

2. Personal data we collect

Accounts of client staff and our administrators

• Name, work email address, the organisation you belong to and your role.
• The identifier your sign-in provider (Google or Microsoft) gives us when you sign in. We do not use or store passwords.
• Security information: sign-in times, IP address, browser details, and multi-factor authentication details (for example, the public part of a passkey). We use these to protect accounts and keep an audit trail.
• Records of your acceptance of our data processing agreement, and any data requests you raise.

WhatsApp Business account information

• Details of the WhatsApp Business account and number a client connects, such as account and number identifiers, the display name and number, connection status, quality rating and messaging limits.
• Account health notifications Meta sends us about these accounts.
• An access credential Meta issues so our platform can operate the connected account. It is stored encrypted and never displayed.

Message content

When a client uses our AI features, the content of WhatsApp messages (text, and any details people choose to share, such as their name or work history) is processed to understand each message and write a reply. Our client portal does not store message content.

Confirm where the AI agents run (our infrastructure or the client's own system), whether conversation history is kept to give the agent context, and for how long. Update this section and the retention section to match.

If the portal starts showing project status or usage figures, or holds training participants' details, add those categories here and in the retention section.

When you contact us

If you email us, we keep your message and contact details to reply and to keep a record of the request.

Cookies

We use only the cookies needed to keep you signed in and to protect forms against misuse. We do not use advertising or analytics cookies.

3. How we use personal data

• To provide our services: connect clients' WhatsApp Business accounts, run the AI agents they ask for, and show connection status in the client portal.
• To keep the service secure: authenticate users, prevent misuse and investigate security incidents.
• To manage our relationship with clients, including our agreements and support requests.
• To meet legal and regulatory obligations and respond to lawful requests.

We do not sell personal data. We do not use it for advertising. We do not allow our AI provider to use it to train their models.

Confirm the "no training" statement against the AI provider's current commercial terms for API use.

4. Consent and our clients' responsibilities

We collect, use and disclose personal data with consent, where consent is deemed under the PDPA (for example, when it is needed to provide a service you asked for), or where an exception in the PDPA applies. Our clients are responsible for having the consent and opt-ins needed to message their customers on WhatsApp, and for telling their customers how their data is used.

5. Service providers we use

We share personal data only with service providers that help us run our services, under contracts that require them to protect it.

6. Transfers outside Singapore

Some of our service providers process data outside Singapore. For example, our AI provider may process message content in other countries to generate replies. When we transfer personal data overseas, we take steps required by the PDPA to make sure it receives a standard of protection comparable to the PDPA, including binding contractual commitments from the recipient.

7. Where WhatsApp data is stored

When we connect a WhatsApp number, we turn on Meta's local storage option for the WhatsApp Business Platform with the storage region set to SG (Singapore). Meta then stores message data at rest in that region. Messages may still pass through Meta's infrastructure in other countries while they are being delivered. Our own servers are in Singapore.

Check this description against Meta's current Local Storage documentation before publishing.

8. How long we keep data

• User accounts: while the account is active, and deleted within 90 days after it is closed or the client's agreement ends.
• WhatsApp account information: while the number is connected, and deleted within 90 days after it is disconnected.
• Meta access credentials: deleted when a number is disconnected or when the client asks us to remove them.
• Message content: not stored in our client portal.
• Security and audit logs: 24 months, to investigate incidents and show what happened.
• Agreement acceptance records: for the length of the client's agreement and 6 years after it ends, in case of legal claims.
• Data requests and related emails: 2 years after the request is closed.
• Backups: overwritten on a rolling basis within 30 days.

These retention periods are proposals. Confirm each one, especially audit logs (24 months) and agreement records (6 years, in line with the limitation period for contract claims).

9. How we protect data

We protect personal data with access controls, encryption of credentials and sensitive fields, multi-factor authentication for staff with administrative access, an audit log of administrative actions, and security updates on our systems. No system is perfectly secure. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commission and affected people as the PDPA requires. Where we act as a data intermediary, we will tell the affected client without undue delay.

10. Your rights

Under the PDPA, you can:

• ask for access to your personal data and how it has been used or disclosed in the past year;
• ask us to correct personal data that is wrong or incomplete;
• withdraw your consent to our collecting, using or disclosing your personal data. If you do, we may no longer be able to provide some services, and we will tell you what that means before acting on it.

To make a request, email our Data Protection Officer at [DPO_EMAIL not set]. Client staff can also raise a request from the client portal. We may need to confirm your identity first. We aim to respond within 30 days. If we need longer, we will tell you when to expect a reply. We may charge a reasonable fee for access requests and will tell you the amount first.

If you messaged a business that uses our services, that business controls your data. Contact them first. If you contact us instead, we will pass your request to them and help them respond.

11. Deleting your data

See how to ask us to delete your data.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. We will tell clients about significant changes before they take effect.

13. Contact our Data Protection Officer

Email: [DPO_EMAIL not set]
Post: Data Protection Officer, [BUSINESS_LEGAL_NAME not set], [BUSINESS_ADDRESS not set]