Privacy Policy

1. About this notice

This notice describes personal information handled through the AI Commerce Lab website, enquiries, customer services and WhatsApp CRM. It is written with Malaysia’s Personal Data Protection Act 2010 (PDPA), as amended, in mind; it is not a certification or a statement that every legal requirement has been independently verified.

Questions about this notice or your information can be sent to the contact below. Please avoid sharing passwords, payment-card details, identity documents or unnecessary sensitive information in messages or business submissions.

2. Information involved

Information you provide may include your name, email, WhatsApp number, company, business context, assessment answers, website brief, images and other submitted materials. Customer accounts and purchases also involve account identifiers, order records, payment status and service access records.

WhatsApp Cloud API deliveries from Meta can include sender phone numbers and contact names, message identifiers, timestamps, message text or media references, message types, receiving-account identifiers and delivery or status events. Received webhook payloads are stored alongside message records; a media reference does not necessarily mean a file has been downloaded.

The CRM can associate a message with an existing enquiry using its phone number. Internal records can include conversation labels, status, assignment, staff notes, follow-up tasks, automation results, draft approvals and audit history.

Website activity records may include page paths, browser/session identifiers, form progress, test completion and checkout or purchase events. Meta Pixel and browser storage are used on the site for measurement and advertising attribution. These records are not described as completely anonymous merely because a name is absent.

3. Why information is used

Information is used to respond to enquiries, deliver purchased services and assessment results, maintain customer access, organise conversations and follow-up work, understand website performance, measure advertising conversions and investigate misuse or service problems.

Internal WhatsApp rules can classify topics and leads, organise conversations and create follow-up tasks. Administrators may request an AI-assisted reply draft and review or edit it. The current WhatsApp integration does not automatically send replies; internal automation and AI drafts are not the same as customer messaging.

4. AI-assisted drafts

When an administrator requests an AI draft, selected recent message text and approved service information may be submitted through Lovable AI to a model provider. The draft workflow attempts to remove email addresses and long number sequences before submission. This is limited filtering, not a guarantee that all personal or sensitive information is removed; message text can still contain names or identifying context.

AI-generated drafts can be inaccurate and require human review. Rule-based drafts may be used when AI is unavailable. This notice does not promise that providers never retain data or use it for other purposes; their applicable terms and processing arrangements must be reviewed by the owner.

5. Service providers and cross-border processing

Relevant services include Meta for WhatsApp Cloud API and Meta Pixel, Lovable Cloud for application hosting and customer records/files, Lovable AI and its model providers for requested reply drafts, and Stripe for payment processing. Payment-card details entered into Stripe’s payment form are handled through Stripe rather than the enquiry form or WhatsApp CRM.

An optional ClickUp connection can copy enquiry contact details, business context and test progress/results into internal follow-up tasks when configured. The owner must confirm whether that connection is active and its applicable processing arrangements; its presence in the application does not establish that every enquiry has been transferred.

Each provider receives information relevant to the feature being used and may also act under its own privacy terms. Service providers can process information outside Malaysia. The owner must confirm applicable provider contracts, processing locations and any transfer requirements; this notice does not claim that information stays exclusively in Malaysia or that a particular transfer safeguard has been verified.

6. Retention

Retention depends on the record and its purpose: enquiry follow-up, ongoing service access, accounting obligations, dispute handling and operational troubleshooting may require different treatment. No fixed WhatsApp or CRM deletion period is promised in this notice.

Automatic deletion, a scheduled purge and a self-service export/deletion process are not established by this notice. The owner must approve and operate retention and deletion procedures. A request can be reviewed manually; some payment or accounting records may need to be retained where applicable law requires it.

7. Access and security

The service uses account access controls, with WhatsApp CRM access restricted to administrators. These measures reduce risk but do not guarantee that unauthorised access, data loss or service interruption can never occur. No security certification, audit result or absolute protection is claimed.

8. Your choices and requests

Contact us to request access to or correction of your information, request deletion, withdraw consent where applicable, or raise a privacy concern. Requests are reviewed in light of the PDPA and any applicable record-keeping obligations. Identity and the relevant account or phone number may need to be verified before information is disclosed or changed.

You may stop messaging the business or ask us to stop an optional use of your information. This does not by itself erase existing records. Browser controls can restrict cookies, tracking and stored site data, although some functions may be affected. See Data Deletion Instructions for the request process; no automatic deletion or fixed completion time is promised.

9. Updates and contact

This notice may be updated when services or approved practices change. The last-updated date identifies this version. For privacy matters, use the email below with the subject ‘Privacy request — AI Commerce Lab’.