Privacy Policy

Last updated: 2 November 2026. Effective date: 2 November 2026. This notice is available in Malay, English and Chinese; if they differ, the English version prevails.

1. Who we are

KaunterAI is operated by KAUNTER AI STUDIO (SSM Reg. No.: AS0524213-W), Johor Bahru, Johor, Malaysia. KaunterAI is a brand of KAUNTER AI STUDIO (AS0524213-W). Contact: [email protected]. This policy is written under Malaysia's Personal Data Protection Act 2010 (PDPA), as amended in 2024.

2. Our role

KaunterAI provides an AI front desk to merchants. Messages customers send to a merchant via WhatsApp, Facebook Messenger, Instagram or website chat are processed by us on the merchant's behalf. For this data the merchant is the data user, decides how it is used, and its privacy notice applies to its customers; we are a data processor, act only on the merchant's instructions, and comply with the PDPA Security Principle.

For merchant account and billing data, visitors to this website and people who contact us directly, we are the data user and responsible in our own right.

3. Data we collect

• Customer message content: text, images, voice, video and attachments;
• Channel data: name or display name, phone number, Meta platform user IDs (PSID/IGSID), profile photo where provided;
• Conversation history, labels and staff notes;
• Merchant account data: contacts, company details, billing details;
• Technical data: IP address, browser type and logs (for security and troubleshooting).

We do not ask for or intentionally collect sensitive personal data (such as health data); please do not share it in chat.

4. Data from Meta platforms

We receive data through the WhatsApp Business Platform (Cloud API), the Messenger Platform and the Instagram messaging API, and use it only to reply to and manage conversations for the relevant merchant, in line with Meta's Platform Terms, Developer Policies and the WhatsApp Business Policy. We do not sell this data, use it for advertising, or use it to train or improve any AI model.

Meta permissions we use and why:

• whatsapp_business_messaging: send and receive WhatsApp messages for the merchant;
• whatsapp_business_management: manage the merchant's WhatsApp Business account, phone numbers and message templates;
• pages_messaging, pages_manage_metadata, pages_show_list: list the merchant's Pages and send and receive Messenger messages and notifications for them;
• instagram_basic, instagram_manage_messages: read the merchant's Instagram professional account basics and send and receive DMs for it;
• business_management: read the merchant's business assets when it connects its account.

5. How we use data

• Replying to customers on the merchant's behalf, using approved replies first and handing off to staff when needed;
• Providing, maintaining and securing the service;
• Metering merchants' AI usage and billing;
• Meeting legal obligations.

The AI only answers questions about the merchant's own business (products, prices, opening hours, bookings and similar); it is not a general-purpose chatbot. Customer service replies may be assisted by AI. You can type "human" or "staff" (Chinese 人工 / 客服, Malay manusia / khidmat pelanggan) at any time to reach the merchant's staff, and the AI will stop replying. Conversations are also passed to staff when the AI is not confident, is unavailable or has reached its monthly limit, or when you send only images, voice or video.

6. AI model providers (sub-processors)

When approved replies cannot answer, the text of the customer's message may be sent to a third-party AI provider to draft a reply. Images, voice and video are not sent to AI providers. Currently:

• OpenAI, L.L.C. (USA), OpenAI API: drafting replies and, where enabled, matching messages to approved replies. Under OpenAI's API data controls, data sent to the API is not used to train its models by default and is kept in abuse-monitoring logs for up to 30 days, unless longer retention is required by law or reasonably necessary to protect its services or others from harm.

These providers process data under contract and may not use it for their own purposes. We will update this page when the list changes.

7. Other sharing and transfers abroad

We use the following service providers (sub-processors): Meta (messaging channels; USA and elsewhere), OpenAI (AI replies; USA), DigitalOcean (servers, database and backups; Singapore, SGP1) and Cloudflare (DNS, CDN, security and hosting of this website; global network). Your data may therefore be stored or processed outside Malaysia (for example in the United States and Singapore). Under section 129 of the PDPA (as amended), we protect this data through data processing terms with these providers that include security and confidentiality requirements. Apart from this and where required by law, we do not disclose personal data to other third parties.

8. Retention

• Conversations: deleted when the merchant deletes them, and within 90 days after service ends (merchants may set a shorter period);
• System logs: up to 30 days;
• Billing records: 7 years under the Income Tax Act 1967;
• Backups: kept for at most 35 days and then automatically overwritten.

9. Your rights

Under the PDPA you may request access to or correction of your personal data, withdraw consent, limit processing and, where applicable, request data portability. We respond within 21 days of receiving a request.

If you are a merchant's customer, please contact that merchant first; you may also contact us and we will pass your request to the merchant within 5 working days and help it respond within the legal time limit. For deletion, see the Data Deletion page.

10. Security

We protect data with encryption in transit (HTTPS/TLS), access controls and least-privilege access. If a personal data breach occurs, we will notify affected merchants within 24 hours of discovery and help them notify the Personal Data Protection Commissioner; for data where we are the data user, we will notify under section 12B of the PDPA.

11. Minors

The service is for merchants. Where a customer is under 18, the merchant is responsible for obtaining any consent required by law.

12. Data protection officer

We do not currently meet the threshold to appoint a data protection officer; if we do, we will publish their contact details here.

13. Contact

[email protected]

KAUNTER AI STUDIO (SSM Reg. No.: AS0524213-W), Johor Bahru, Johor, Malaysia. Changes to this policy will be posted here with an updated date.