Privacy Notice

1. What Personal Data We Collect

Depending on how you interact with us, we may collect:

• Account data: name, email, phone, password hash, role, organization/workspace details
• Billing data: billing contact details, invoices, payment references (payment card data is handled by payment providers)
• Support data: messages sent to support, attachments, logs you provide
• Website usage data: IP address, device/browser info, pages viewed, cookies (if used)
• Marketing data: newsletter subscriptions, event registrations, preferences

2. How We Use Personal Data (Purposes)

We use personal data to:

• create and manage accounts and provide the Service
• authenticate users and prevent fraud/abuse
• provide customer support and respond to inquiries
• process payments and administer subscriptions
• send service notices (e.g., security updates, billing notices)
• improve reliability and user experience (analytics and troubleshooting)
• comply with legal obligations and enforce our terms

3. Disclosure to Third Parties

We may disclose personal data to:

• Service providers (sub-processors) for hosting, email delivery, analytics, monitoring, customer support tools, and payments
• WhatsApp/Meta where applicable for messaging platform operations
• Authorities where required by law or to protect rights and safety
• Professional advisers (auditors, lawyers, accountants) under confidentiality

Where possible, we limit the data shared and require service providers to protect it.

4. Cross-Border Transfers

Some service providers may process/store data outside Malaysia. Where this occurs, we take reasonable steps to ensure appropriate safeguards are in place.

5. Security

We maintain reasonable technical and organizational measures to protect personal data, including access controls and encryption where appropriate. No system is completely secure; please use strong passwords and protect your devices.

6. Retention

We keep personal data only as long as it is needed for the purposes above. Our periods are:

• Conversations, messages and contacts: 24 months from the last activity on the conversation. Where a business using Wharm sets a shorter period for its own customers, that shorter period applies.
• AI-derived data (summaries, analyses, scores, search embeddings): deleted with the message or conversation it came from.
• Operational and diagnostic records: 90 days.
• Billing and accounting records: 7 years, as required by Malaysian tax law.
• Records of a deletion request: the minimum needed to honour it and not re-add you.

Encrypted backups rotate on a fixed cycle; data already written to a backup is removed when that backup expires. You may request deletion at any time — see Data Deletion.

7. Your Rights (PDPA)

Subject to PDPA and applicable exceptions, you may request:

• Access — a copy of the personal data we hold about you
• Correction — rectification of inaccurate or incomplete personal data
• Deletion — erasure of personal data we no longer have a lawful basis to keep. See how to request deletion.
• Withdrawal of consent — where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.
• Data portability — transmission of your personal data to another data controller, where technically feasible and the formats are compatible
• Limit processing — to prevent processing likely to cause you damage or distress, and to stop processing for direct marketing

Requests can be made to the contact below. We may need to verify your identity before we act. We aim to respond within 21 days.

If your data reached us through a business that uses Wharm to handle its WhatsApp conversations, that business is the data controller and we act as its processor. We will pass your request to them and support them in answering it.

8. Cookies (if applicable)

We may use cookies or similar technologies for essential site functionality and analytics.

9. Changes to This Notice

We may update this Privacy Notice. Updates will be posted on this page with a new "Last Updated" date.

10. Contact

For privacy requests or questions: