Privacy Policy: Geopbyte

Last updated: [to confirm: date of publication]

Geopbyte App Sdn. Bhd. (Company No. 1189038-K, incorporated in Malaysia on 25 May 2016), of c/o ED Zone Management Sdn. Bhd., 149A, Jalan Aminuddin Baki, Taman Tun Dr. Ismail, 60000 Kuala Lumpur, Malaysia ("Geopbyte", "we", "us"), provides managed WhatsApp automation services to businesses ("Clients"). These services include WhatsApp chatbots, message templates, staff hand-off, quotation and lead-capture bots, and AI voice agents for WhatsApp calls. This policy explains how we handle personal data when we provide those services, run our website geopbyteapp.com and client portal, and use Meta platform features. It is issued in line with Malaysia's Personal Data Protection Act 2010 (PDPA), as amended, and Meta's Platform Terms.

1. Our role

• For our Clients' customers (people who message or call a Client's WhatsApp number), the Client is the data user/controller, and Geopbyte processes the data on the Client's behalf and on its instructions, only to deliver that Client's messaging.
• For Client staff accounts, website visitors and business contacts, Geopbyte is the data user/controller.

2. Data we collect

a) From WhatsApp Business Platform (via Meta's Cloud API), for each connected Client account:

• WhatsApp phone numbers and profile names of people who message or call the Client;
• message content (text, images, documents, voice notes, locations, button replies) and message metadata (timestamps, message IDs, delivery/read status);
• call metadata (caller number, time, duration) and, where the Client enables the voice agent, call audio processed in real time and call transcripts;
• the Client's WhatsApp Business Account details (account and phone number IDs, display name, quality rating, message templates).

b) From Meta when a Client connects through Embedded Signup / Facebook Login for Business: the Client's business portfolio ID, WhatsApp Business Account ID, phone number ID, and an access token limited to the permissions the Client grants (whatsapp_business_management, whatsapp_business_messaging). We do not receive the Client's Facebook password.

c) From Clients directly: contact names, emails, phone numbers, billing details, and business information (for example price lists used by quotation bots).

d) Automatically on our website/portal: IP address, browser type, access times, and security logs.

3. How we use it (purposes)

Personal data is used only to:

1. receive, route and reply to WhatsApp messages and calls for the Client that the person contacted (chatbot replies, quotations, FAQs, lead capture, ticket/status updates, hand-off to the Client's staff);
2. send WhatsApp template messages the Client has approved, to people who have agreed to hear from that Client;
3. operate the AI voice agent for Clients who enable it;
4. set up and maintain the Client's WhatsApp account (onboarding, templates, phone number settings, webhooks);
5. secure, troubleshoot and support the service, and keep records required by law;
6. bill and communicate with Clients.

We do not sell personal data, use it for advertising or profiling, or use one Client's data for another Client. We do not use WhatsApp message content to train general-purpose AI models.

4. Disclosure and sub-processors

We share data only as needed to run the service:

We may also disclose data where required by Malaysian law or a court order, or to the Client that owns the conversation.

Where we store data: our servers, databases and logs are hosted on servers operated by Hostinger in Kuala Lumpur, Malaysia.

Transfers outside Malaysia: some sub-processors process data outside Malaysia. We transfer data only as permitted under section 129 of the PDPA, with contractual safeguards.

5. Retention

• WhatsApp messages and call records, contacts and account data: kept for 12 months after the Client ends the service, then deleted, unless the Client instructs a shorter period.
• Media files (images, documents, voice notes): [to confirm: 30/90] days.
• Voice call audio: not stored after the call unless the Client enables recording. Transcripts follow the message retention period.
• Access tokens for connected WhatsApp accounts: deleted within 7 days after a Client disconnects or the contract ends.
• Billing records: 7 years (Malaysian tax and company law).
• System and security logs: 90 days.

6. Your rights under the PDPA

You may request access to, or correction of, your personal data, withdraw consent, or limit processing (including opting out of messages). If you messaged a Geopbyte Client, you can also reply STOP in the chat, or contact the Client directly. We will help the Client respond. We respond to requests within 21 days. A fee may apply to data access requests as allowed by the PDPA.

7. Data deletion

Step-by-step instructions are also on our Data deletion page.

• Clients: disconnect Geopbyte in your Meta Business Settings (Business integrations / Partners), or email us. We delete your account data and tokens as set out in section 5.
• Individuals: email datadeletion@geopbyteapp.com with the subject "Data Deletion Request" and include the WhatsApp number concerned. We verify the request, delete the data (or forward it to the relevant Client where they are the controller), and confirm within 30 days. We may keep data the law requires us to keep.
• Facebook / Meta login users: removing the Geopbyte app in your Facebook settings also triggers deletion as above. [to confirm: If a data-deletion callback URL is implemented, describe the status-check URL here.]

8. Security

We protect data with encrypted connections (HTTPS/TLS), access tokens and secrets that stay on our servers and are never exposed in browsers, verification of Meta webhook signatures, access limited to authorised staff, and regular backups. No system is completely secure. We will notify affected Clients and the authorities as required by law if a breach occurs.

9. Children

Our services are for businesses. We do not knowingly collect data from children under 13 (or under 18 for consent purposes under Malaysian law) except as incidental message content sent to a Client.

10. Changes

We will update the "Last updated" date and notify Clients of material changes by email.

11. Contact

Geopbyte App Sdn. Bhd. (Company No. 1189038-K). Data protection contact: [to confirm: name], support@geopbyteapp.com, [to confirm: phone], c/o ED Zone Management Sdn. Bhd., 149A, Jalan Aminuddin Baki, Taman Tun Dr. Ismail, 60000 Kuala Lumpur, Malaysia.

If there is any inconsistency between the English and Bahasa Malaysia versions of this notice, the [to confirm: English] version prevails. (The PDPA requires the notice in both national and English languages. [to confirm: Bahasa Malaysia translation to be added.])