Skip to content
Start free

Privacy Notice

Personal Data Protection Act 2010 · Last updated: 8 September 2026 · English, then Bahasa Malaysia

This notice is given under section 7 of the Personal Data Protection Act 2010 (“PDPA”). It explains what personal data is collected when you use iChatUp on ichatup.my, why, who it is shared with, where it is kept, and your rights. Versi Bahasa Malaysia di bawah.

1. Who is responsible

Mozac Agency (202401002458), Wangsa 9 Residency, No. 6 Jalan Wangsa Perdana 1, Wangsa Maju, KL 53300, is the data user for your account, billing and support data in Malaysia. iChatUp, which owns and operates the platform, processes data on our behalf and on yours to run the Service. Contact for anything in this notice: basit@mozac.my or WhatsApp +91 79970 01700.

2. What we collect

  • Account data: your name, e-mail address, mobile number, business name, password (hashed) and, if you sign in with Google, your Google profile name, e-mail and ID.
  • Billing data: plan, invoices and payment status. Card and bank details are entered directly with our payment gateway; we never see or store them.
  • Business information you give the assistant: menus, price lists, documents, website content, FAQs, opening hours and similar.
  • WhatsApp data processed for your business: messages, phone numbers and names of the people who message your number, bookings, leads and payment confirmations they send, and — for the official Cloud API — your Meta phone number ID, WhatsApp Business Account ID and access token.
  • Technical data: log records, IP address, browser type and usage of the dashboard.

3. Why we use it

  • to provide the Service: generate AI replies from your business information, take bookings, capture leads and show everything in your dashboard;
  • to run your account: sign-in, verification codes, invoices, trial and renewal reminders, and reaching you on WhatsApp about your account;
  • to support you and improve the Service, including anonymised usage statistics;
  • to meet legal obligations, for example tax records.

Your customers’ conversations are used only to answer them on your behalf and to build the memory of your own workspace. They are not used to train anyone’s AI models.

4. Who it is shared with

  • iChatUp (platform operator) — hosting and processing of all Service data.
  • AI model providers — message text is sent to OpenAI and Google to generate replies, under their business terms which prohibit training on it.
  • Meta Platforms — when you use the official WhatsApp Cloud API, under Meta’s own terms.
  • Our payment gateway (Curlec by Razorpay) — to process subscriptions.
  • Google — if you connect Google Sheets or sign in with Google.
  • authorities where the law requires it.

We do not sell personal data.

5. Transfer outside Malaysia

The Service is hosted on cloud servers located outside Malaysia, operated by iChatUp, and the AI providers named above process message text in their own regions. By creating an account and using the Service you consent to this transfer of your personal data — and the personal data of the people who message your business — to places outside Malaysia, as permitted by section 129 of the PDPA. The same technical and contractual safeguards apply wherever the data is: encryption in transit, workspace isolation, access limited to what is needed to run the Service.

6. Security and retention

Data is encrypted in transit, stored in a database where every record is scoped to your workspace, and access tokens are stored encrypted. We keep account and conversation data for as long as your workspace exists; operational logs are pruned on a rolling schedule. When you delete your workspace, its conversations, contacts, leads, business information and API tokens are purged within 24 hours; invoices are kept for as long as Malaysian tax law requires.

7. Your rights

Under the PDPA you may ask for access to the personal data we hold about you, ask us to correct it, withdraw consent for processing (which may mean we cannot provide the Service), and ask us to stop using it for marketing. You can export or delete your whole workspace from the dashboard, or write to basit@mozac.my. See also data deletion instructions. We reply within 21 days.

8. Your customers’ data

You are the data user for the people who message your business, and you are responsible for telling them how you use their data. iChatUp processes it on your instructions and does not contact them for its own purposes.

9. Cookies

The dashboard uses strictly necessary cookies for sign-in. The public site may use analytics cookies only if configured; we honour the Global Privacy Control signal.

10. Changes

We will post any material change here and tell you in your dashboard or by e-mail.

Notis Privasi (Bahasa Malaysia)

Notis ini diberikan menurut seksyen 7 Akta Perlindungan Data Peribadi 2010 (“APDP”). Sekiranya terdapat perbezaan, versi Bahasa Inggeris di atas adalah muktamad.

1. Siapa yang bertanggungjawab

Mozac Agency (202401002458) ialah pengguna data bagi data akaun, pengebilan dan sokongan anda di Malaysia. iChatUp, pemilik dan pengendali platform, memproses data bagi pihak kami dan pihak anda untuk menjalankan Perkhidmatan. Hubungi: basit@mozac.my atau WhatsApp +91 79970 01700.

2. Data yang dikumpul

  • Data akaun: nama, alamat e-mel, nombor telefon bimbit, nama perniagaan, kata laluan (disulitkan) dan, jika anda log masuk dengan Google, nama, e-mel dan ID profil Google anda.
  • Data pengebilan: pelan, invois dan status pembayaran. Butiran kad dan bank dimasukkan terus kepada gerbang pembayaran kami; kami tidak melihat atau menyimpannya.
  • Maklumat perniagaan yang anda berikan kepada pembantu AI: menu, senarai harga, dokumen, kandungan laman web, soalan lazim, waktu operasi dan seumpamanya.
  • Data WhatsApp yang diproses untuk perniagaan anda: mesej, nombor telefon dan nama orang yang menghubungi nombor anda, tempahan, prospek dan pengesahan pembayaran yang mereka hantar, dan — bagi Cloud API rasmi — ID nombor telefon Meta, ID Akaun Perniagaan WhatsApp dan token akses anda.
  • Data teknikal: rekod log, alamat IP, jenis pelayar dan penggunaan papan pemuka.

3. Tujuan penggunaan

  • menyediakan Perkhidmatan: menjana balasan AI daripada maklumat perniagaan anda, mengambil tempahan, merekod prospek dan memaparkannya di papan pemuka anda;
  • menguruskan akaun anda: log masuk, kod pengesahan, invois, peringatan percubaan dan pembaharuan, serta menghubungi anda melalui WhatsApp mengenai akaun anda;
  • memberi sokongan dan menambah baik Perkhidmatan, termasuk statistik penggunaan tanpa nama;
  • memenuhi kewajipan undang-undang, contohnya rekod cukai.

Perbualan pelanggan anda digunakan hanya untuk membalas mereka bagi pihak anda dan membina memori ruang kerja anda sendiri. Ia tidak digunakan untuk melatih mana-mana model AI.

4. Pendedahan kepada pihak ketiga

  • iChatUp (pengendali platform) — pengehosan dan pemprosesan semua data Perkhidmatan.
  • Penyedia model AI — teks mesej dihantar kepada OpenAI dan Google untuk menjana balasan, di bawah terma perniagaan mereka yang melarang latihan model.
  • Meta Platforms — apabila anda menggunakan WhatsApp Cloud API rasmi, di bawah terma Meta.
  • Gerbang pembayaran kami (Curlec by Razorpay) — untuk memproses langganan.
  • Google — jika anda menyambungkan Google Sheets atau log masuk dengan Google.
  • pihak berkuasa apabila dikehendaki oleh undang-undang.

Kami tidak menjual data peribadi.

5. Pemindahan ke luar Malaysia

Perkhidmatan ini dihoskan pada pelayan awan yang terletak di luar Malaysia, dikendalikan oleh iChatUp, dan penyedia AI yang dinamakan di atas memproses teks mesej di wilayah mereka sendiri. Dengan membuka akaun dan menggunakan Perkhidmatan, anda bersetuju dengan pemindahan data peribadi anda — dan data peribadi orang yang menghubungi perniagaan anda — ke luar Malaysia, sebagaimana dibenarkan oleh seksyen 129 APDP. Perlindungan teknikal dan kontrak yang sama terpakai di mana-mana data berada: penyulitan semasa penghantaran, pengasingan ruang kerja, dan akses terhad kepada apa yang diperlukan untuk menjalankan Perkhidmatan.

6. Keselamatan dan penyimpanan

Data disulitkan semasa penghantaran, disimpan dalam pangkalan data di mana setiap rekod diasingkan mengikut ruang kerja anda, dan token akses disimpan dalam bentuk tersulit. Kami menyimpan data akaun dan perbualan selagi ruang kerja anda wujud; log operasi dipadam mengikut jadual bergilir. Apabila anda memadam ruang kerja, perbualan, kenalan, prospek, maklumat perniagaan dan token API dipadam dalam masa 24 jam; invois disimpan selama tempoh yang dikehendaki oleh undang-undang cukai Malaysia.

7. Hak anda

Di bawah APDP anda boleh meminta akses kepada data peribadi anda yang kami simpan, meminta pembetulan, menarik balik persetujuan pemprosesan (yang mungkin bermakna kami tidak dapat menyediakan Perkhidmatan), dan meminta kami berhenti menggunakannya untuk pemasaran. Anda boleh mengeksport atau memadam keseluruhan ruang kerja anda dari papan pemuka, atau menulis kepada basit@mozac.my. Kami membalas dalam masa 21 hari.

8. Data pelanggan anda

Anda ialah pengguna data bagi orang yang menghubungi perniagaan anda, dan anda bertanggungjawab memaklumkan kepada mereka bagaimana data mereka digunakan. iChatUp memprosesnya atas arahan anda dan tidak menghubungi mereka untuk tujuannya sendiri.

9. Perubahan

Sebarang perubahan penting akan disiarkan di sini dan dimaklumkan di papan pemuka anda atau melalui e-mel.