Privacy at ChatPilotplainly explained.

What this policy covers.

ChatPilot provides software that unifies a business’s customer conversations from channels such as WhatsApp, Instagram, Facebook Messenger, Telegram, and email into a single AI-assisted inbox. This policy applies to personal data processed in connection with commercial transactions, and covers:

• business subscribers and account holders (“you”);
• end users and team members you authorise; and
• your customers whose data is processed through our platform.

For most messaging data, the business using ChatPilot is the data controller (user) and ChatPilot acts as its processor — we handle that data only to provide the Service and only on the business’s documented instructions. For account and billing information about the business itself, ChatPilot is the controller. This policy describes both roles.

The information we handle.

Under the PDPA, “personal data” means information that relates, directly or indirectly, to an identifiable individual. We collect and process the following categories:

Account and identity data

• name, work email, phone number, and login credentials;
• company name, business registration number, and contact details;
• billing information (processed securely through third-party payment processors — we do not store full card numbers); and
• the messaging platform credentials you connect (WhatsApp Business, Instagram, Facebook Messenger, Telegram, Gmail, etc.).

Message and communication data (Platform Data)

• message content and attachments;
• customer phone numbers, WhatsApp profile names, and handles;
• timestamps, delivery status, and read receipts;
• labels, routing information, and conversation history.

Usage and technical data

• features used, pages visited, and actions taken;
• device and browser information, IP address, and log data (access times, errors, performance metrics).

Sensitive personal data

Under the PDPA, “sensitive personal data” includes information about physical or mental health, political opinions, religious beliefs, or the commission of offences. We do not intentionally collect it. If such data is incidentally present in messages processed through our platform, we handle it with heightened care and seek express consent before processing it for any purpose beyond service delivery.

Why we process your data.

In line with the PDPA’s Notice and Choice Principle, we process data only for legitimate business purposes tied to operating the Service, and we do not use Platform Data received from Meta for any purpose other than those disclosed here and permitted by the Meta Platform Terms. Specifically, we use data to:

• deliver, route, and display messages across connected channels;
• power AI features such as reply suggestions, summaries, and triage — processing message content only to generate results for the workspace that owns the conversation;
• authenticate users, provide support, and secure the Service;
• manage your subscription, process payments, and send invoices;
• measure reliability and improve product performance using aggregated or de-identified data;
• send service notifications and, with your consent, marketing communications; and
• meet legal, tax, and regulatory obligations.

You may choose whether to provide your personal data, though certain data is necessary to operate the Service; where data is optional we indicate this at the point of collection. We do not sell personal information, and we do not use the content of customer messages to build advertising profiles or to train generalized models outside of serving the workspace to which the data belongs.

Our basis for processing.

We process personal data on the following legal bases:

• Consent — where you have given express consent, including for marketing communications and optional features;
• Contractual necessity — where processing is necessary to perform our agreement with you, such as service delivery and billing;
• Legal obligation — where processing is required to comply with applicable law or a court order; and
• Legitimate interests — such as fraud prevention, security, and platform improvements, provided these do not override your rights and interests.

Working with the WhatsApp Business Platform.

When your workspace connects a Meta channel, ChatPilot accesses Platform Data through Meta’s APIs strictly to provide the Service to you. Our use of that data is governed by the Meta Platform Terms, the WhatsApp Business Platform terms, and applicable Developer Policies. In particular:

• Messages sent through the WhatsApp Business Platform are encrypted in transit between the customer and Meta’s Cloud API, and Meta retains message content on the Cloud API for a maximum of 30 days to deliver the service.
• We access, store, and use Platform Data only for the purposes disclosed in this policy, and we do not transfer it to data brokers or use it for unrelated purposes.
• We keep this policy available through an active, publicly available, easily accessible (including to crawlers), and non-geoblocked URL so that end users can understand what data we process and how.

Nothing in this policy supersedes, modifies, or is inconsistent with the Meta Platform Terms or any other terms or policies applicable to Platform Data. Where this policy addresses Platform Data, it operates consistently with, and subject to, those terms.

Messaging happens with consent.

Businesses using ChatPilot are responsible for obtaining valid opt-in from customers before messaging them on WhatsApp and other channels, as required by Meta’s policies and applicable law. Customers can decline to provide personal data beyond what is necessary for a conversation, can stop a business from messaging them at any time, and can withdraw consent through the relevant channel. Where we rely on consent, we provide clear notice and honor withdrawal requests.

Who we share data with.

In line with the PDPA’s Disclosure Principle, we do not sell your personal data or your customers’ personal data. We share data only as needed to run the Service and only under appropriate contractual and security safeguards:

• Platform providers such as Meta (WhatsApp Business, Instagram & Messenger APIs), Telegram, and Google, for message delivery and platform integration;
• Infrastructure and AI sub-processors that host the Service or provide model inference, bound by confidentiality and data-processing terms;
• Payment and analytics providers for billing and product telemetry; and
• Authorities where disclosure is legally required or necessary to protect rights, safety, or the integrity of the Service.

In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction; we will notify affected parties and ensure the receiving party maintains equivalent protection. We do not disclose Platform Data except at your direction or as permitted under the Meta Platform Terms.

We keep data only as long as needed.

In line with the PDPA’s Retention Principle, we retain data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law, and then delete or de-identify it. Indicatively:

• Account data — for the duration of your active subscription and up to 7 years thereafter for legal and tax compliance;
• Message data — according to your account settings and applicable legal requirements;
• Usage and log data — up to 12 months for security and analytics; and
• Billing records — 7 years, as required by Malaysian law.

We delete Platform Data when it is no longer needed for the purpose it was collected, when a workspace stops using the Service, when Meta directs us to, when a user requests deletion, or when we receive it in error — unless it has been aggregated or de-identified so it can no longer be associated with a particular person, browser, or device. Message content handled through Meta’s Cloud API is subject to Meta’s 30-day retention limit described above.

Access, correction, and deletion.

As a data subject under the PDPA — and, depending on your location, under laws such as the GDPR and CCPA — you have rights to:

• access the personal data we hold about you and how it is processed (PDPA s.30);
• correct data that is inaccurate, incomplete, misleading, or out of date (PDPA s.34);
• prevent processing likely to cause unwarranted damage or distress (PDPA s.42);
• opt out of processing for direct marketing (PDPA s.43); and
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Everyone who can access ChatPilot has the right to request deletion of their data. You can request deletion in either of these ways, and we do not require you to have a paid account to do so:

• Email us at hello@runchatpilot.com with the phone number, email, or account associated with your data and we will delete the Platform Data we hold about you.
• In-product, business customers can export or delete workspace data from account settings, or contact us to delete an entire workspace and its data.

When a user requests deletion, no longer has an account with the relevant business, or when we are otherwise required to, we delete their Platform Data — unless it has been aggregated or de-identified. We respond to verified requests within the timeframes required by applicable law (and within 21 days for PDPA access and correction requests), and we will assist businesses in responding to privacy-rights requests they receive, including any that require Meta’s cooperation. We may decline requests where permitted by law and will explain any such refusal.

Accuracy and data integrity.

In line with the PDPA’s Data Integrity Principle, we take reasonable steps to ensure the personal data we process is accurate, complete, not misleading, and kept up to date. You are responsible for the accuracy of the data you provide, and we encourage you to update your account information promptly when it changes.

How we protect your data.

In line with the PDPA’s Security Principle, we take practical steps to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction, including:

• encryption of data in transit (TLS/HTTPS) and at rest;
• role-based access controls, least-privilege practices, and multi-factor authentication;
• regular security reviews and vulnerability assessments; and
• staff training and incident-response procedures.

No method of transmission over the Internet is completely secure, so we cannot guarantee absolute security. If we become aware of a data incident affecting personal or Platform Data, we will begin remediation without undue delay, notify affected parties and regulators where required by law, and — for incidents involving Meta Platform Data — notify Meta and reasonably cooperate with them as required by the Platform Terms.

Moving data across borders.

Consistent with s.129 of the PDPA, we will not transfer your personal data outside Malaysia unless the destination provides a substantially similar level of protection, or a prescribed exception applies (such as your consent or contractual necessity). Our services may involve transfers to countries including the United States (cloud infrastructure and AI processing), Singapore, and the European Union. Where required, we implement appropriate safeguards — such as standard contractual clauses — to protect your data in those jurisdictions.

Cookies and similar technologies.

We use cookies and similar technologies to operate the Service, analyse usage, and remember your preferences:

• Essential cookies — required for the platform to function (authentication, session management);
• Analytics cookies — to understand how the platform is used and improve it; and
• Preference cookies — to remember settings such as theme.

You can control cookies through your browser settings; disabling essential cookies may prevent the Service from functioning correctly. For non-essential cookies, we obtain consent where required.

Not intended for minors.

ChatPilot is a business-to-business service not intended for individuals under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently done so, contact us at hello@runchatpilot.com and we will take prompt steps to delete it.

Links to other services.

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to review their policies before providing any personal data.

Updates to this policy.

We may update this Privacy Policy to reflect changes to the Service, our practices, or legal and platform requirements. When we make material changes, we will update the “Last updated” date above and, where required, provide additional notice. Your continued use of ChatPilot after the effective date constitutes acceptance of the updated policy.

Questions? Reach us.

We have designated a Personal Data Officer responsible for our compliance with the PDPA. For any questions, requests, or concerns about this policy or our data practices, contact:

• Personal Data OfficerChatPilot
• Emailhello@runchatpilot.com
• WhatsApp+60 11-7383 8321

If you are not satisfied with how we handle your personal data or your request, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.