PRIVACY POLICY

1. Who We Are

1.1 The data controller for ThinkChat AI Agent is:

Think AI (M) Sdn Bhd (Registration No. 202601012735 (1674833-V))
ThinkChat AI Agent

Business address: 33-01, 33rd Floor, 203 Jalan Bukit Bintang, 55100 Kuala Lumpur, Malaysia
Registered address: 10-3A, Jalan Puteri 1/5, Bandar Puteri Puchong, 47100 Puchong, Selangor, Malaysia

Website https://thinkchat.tech

1.2 Data Protection Officer: we have appointed a Data Protection Officer to oversee our compliance with the PDPA. You can contact the Data Protection Officer at privacy@thinkchat.tech.

1.3 Privacy inquiries, data subject requests, and account deletion requests should be sent to privacy@thinkchat.tech. For sales questions, contact us on WhatsApp at +60 11-5515 9317.

1.4 Our role. For data about our own Customers (subscribers), website visitors, and people who contact us, ThinkChat is the data controller. For data about our Customers' End Users that is processed through a Customer's account (see Section 2.2), the Customer is the data controller and ThinkChat acts as its data processor.

2. Scope

2.1 This Privacy Policy covers personal data we handle when you:

• Visit thinkchat.tech or related ThinkChat websites.
• Create or use a ThinkChat account.
• Use the ThinkChat web application.
• Connect messaging channels or third-party integrations.
• Submit a demo, support, or contact request.
• Interact with a ThinkChat-powered agent as an end customer of a ThinkChat subscriber.

2.2 ThinkChat is a business service. Our Customers (subscribers) may use ThinkChat to communicate with their own customers, leads, or users ("End Users"). In that case, the Customer is the data controller and is responsible for providing required notices and obtaining any required consents from End Users. As data processor, we process End User data only on the Customer's instructions and to provide the Services to the Customer, we apply the security measures required by the PDPA, we require our sub-processors to protect the data in the same way, and we assist the Customer with data subject requests and personal data breach notifications.

3. Personal Data We Collect

3.1 Depending on how you use the Services, we may access, collect, use, and store the following categories of personal data:

Account and identity data:

• Name
• Email address
• Phone number
• Company or business name
• Account credentials (passwords are stored in hashed form)
• User role and account identifiers

Customer content and communications:

• Messages, chats, and conversation transcripts across connected channels
• Voice notes and images sent in conversations, where AI voice transcription or image description is used
• Uploaded files, knowledge-base documents, training materials, and business information
• Lead details captured through the Services, including lead forms
• Appointment details captured through calendar booking
• Support tickets and demo-request details

Channel and integration data:

• Channel connection identifiers, page or number IDs, and webhook metadata
• Message metadata from WhatsApp, Instagram, Facebook Messenger, Telegram, WeChat, LINE, Viber, Zalo, X (Twitter), website live chat, and other connected channels
• Calendar event details when you connect Google Calendar or similar booking tools

Payment and billing data:

• Billing email, plan, invoices, and transaction status
• Payment is processed by Stripe. We do not store full payment card numbers on ThinkChat servers.

Device and technical data:

• IP address
• Browser type, device type, and operating system
• Date and time of access, pages viewed, and diagnostic or error logs
• Session identifiers and essential cookies, including a demo visitor token where used

3.2 We do not require access to your device phonebook, precise GPS location, microphone, or camera.

4. How We Collect Data

4.1 We collect data:

• Directly from you when you register, subscribe, submit forms, upload content, or contact us.
• Automatically when you use the websites or web application (for example IP address, logs, and essential cookies).
• From connected third-party platforms that you choose to integrate, such as Meta/WhatsApp, Telegram, Google, or payment providers.
• From End Users when they message a channel connected to a Customer account.

5. How We Use Data

5.1 We use personal data only to operate, provide, secure, and improve features that users reasonably expect from ThinkChat, including to:

• Create and manage accounts, authentication, and access control.
• Provide AI-assisted customer service, automated replies, voice note transcription, image description, lead capture, appointment booking, and knowledge-base answers.
• Deliver messages across channels the Customer has connected.
• Process subscriptions, free trials, billing, renewals, and receipts.
• Provide customer support, onboarding, and demo assistance.
• Maintain security, prevent fraud, abuse, spam, and unauthorized access.
• Comply with law, enforce our terms, and protect our rights.
• Send service notices such as billing, security, or product changes.

5.2 We do not use personal data for third-party advertising. We do not sell personal data.

5.3 We limit collection and use to what is needed for the Services and related legitimate business purposes described in this Privacy Policy.

5.4 AI replies generated through ThinkChat are used to answer and route customer conversations. ThinkChat does not use them to make decisions that have legal or similarly significant effects on individuals.

6. How We Share Data

6.1 We share personal data only as needed to provide the Services, with service providers who assist us, or where required by law. Categories of parties include:

• AI processing providers (including OpenAI, Anthropic, and Google) to generate replies and operate AI features.
• Messaging and social platforms you connect, including Meta Platforms (WhatsApp Business Platform, Instagram, Facebook Messenger), Telegram, WeChat, LINE, Viber, Zalo, X (Twitter), and other channel providers.
• Payment processors, including Stripe, to collect subscription fees.
• Google, when you connect Google Calendar or other Google services you enable.
• SMS, telephony, email, and infrastructure providers that store or transmit Service data.
• Professional advisers or authorities where required for legal, security, or regulatory reasons.
• A successor organization if we are involved in a merger, acquisition, or sale of assets, with notice where legally required.

6.2 Service providers are permitted to process data only to perform services for us or the Customer, and not to sell that data.

6.3 We do not sell personal data, including data obtained from End Users or from Google APIs.

7. Google User Data And Limited Use

7.1 If you connect a Google account (for example Google Calendar for appointment booking), ThinkChat may access Google user data that you authorize, such as calendar availability and event details needed to create or update bookings.

7.2 ThinkChat's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7.3 Google user data is used only to provide or improve user-facing features that are prominent in ThinkChat, such as appointment booking. We do not:

• Sell Google user data.
• Use Google user data for serving advertisements.
• Use Google user data for creditworthiness or lending decisions.
• Allow humans to read Google user data unless you give us explicit permission for a specific support case, the data is aggregated and anonymized for internal operations, it is necessary for security or abuse investigation, or it is required to comply with law.

7.4 We do not use Google user data to train generalized artificial intelligence or machine-learning models.

8. AI Processing

8.1 To generate replies and operate the agent, conversation content (including voice notes and images where those features are used), knowledge-base content, and related instructions may be processed by third-party AI providers.

8.2 That processing is performed only to provide the Service feature you are using. We do not sell this content and we do not use it for third-party advertising. We use AI providers' business or API services, under terms that do not allow them to use Customer content to train their models.

8.3 AI outputs can be inaccurate. Customers remain responsible for reviewing AI-generated responses before relying on them, as described in our Terms.

9. Cookies And Similar Technologies

9.1 We use essential cookies and similar technologies to operate the Services, keep you signed in where applicable, remember a demo-chat visitor session, and apply basic rate limiting or security controls.

9.2 We do not use advertising cookies. You can control cookies in your browser. Disabling essential cookies may prevent parts of the Services from working. If we introduce analytics or advertising cookies, we will update this section and ask for consent where required.

10. Data Security And Breach Notification

10.1 We protect personal data using reasonable administrative, technical, and organizational measures appropriate to the nature of the data, as required by the PDPA. These measures include:

• Transmitting data over the internet using modern cryptography (HTTPS/TLS).
• Access controls and authentication for account and administrative access.
• Restricting staff access to data needed to operate and support the Services.
• Monitoring for abuse, fraud, and unauthorized access where practicable.

10.2 No method of transmission or storage is completely secure. You are responsible for keeping your account credentials confidential.

10.3 If we become aware of a personal data breach involving data for which we are the data controller, we will notify the Personal Data Protection Commissioner as soon as practicable, and within the time required by the PDPA and the Commissioner's guidelines, where the breach causes or is likely to cause significant harm. Where the breach is likely to cause significant harm to you, we will also notify you without unnecessary delay.

10.4 If a personal data breach affects End User data we process for a Customer, we will inform that Customer without unnecessary delay and give it the information it reasonably needs to meet its own notification obligations.

11. Data Retention

11.1 We retain personal data only as long as needed to provide the Services, maintain your account, meet legal, tax, security, or accounting requirements, and resolve disputes.

11.2 Typical retention:

• Active account and Service data: for the life of the account and a reasonable period after.
• Conversation, knowledge-base, and channel data: while the account is active and until deleted by the Customer or following account deletion.
• Billing and invoice records: as required for tax and accounting compliance.
• Security logs: for a limited period needed for fraud prevention and security.
• Backups: for a limited backup cycle after deletion, after which they are overwritten.

11.3 When data is no longer needed, we delete or anonymize it, except where a longer period is required by law.

12. Account And Data Deletion

12.1 If you have a ThinkChat account, you may request deletion of your account and associated personal data. Account freezing, deactivation, or suspension is not treated as deletion.

12.2 To request deletion, email privacy@thinkchat.tech from your registered account email with the subject line "Account Deletion Request". Include:

• The email address of the account to delete.
• Confirmation that you want the account and associated data deleted, not merely deactivated.

We will acknowledge the request and complete deletion of the account and associated personal data within thirty (30) days, unless a shorter period is required by law.

12.3 When we delete an account at your request, we delete associated personal data, including profile data, conversation records, uploaded knowledge-base content, and channel connection data held in ThinkChat for that account.

12.4 We may retain limited information after deletion only where we have a legitimate reason, including:

• Invoices and transaction records required for tax, accounting, or audit.
• Records needed for security, fraud prevention, or to demonstrate compliance with law.
• Information we are legally required to keep.

Any such retained data will be limited to what is necessary for that purpose and will not be used to provide the Service to you.

12.5 End User messages stored for a Customer are deleted with that Customer's account, subject to the backup and legal-retention limits above. End Users who want a specific business to stop using their data should contact that business directly.

13. Your Privacy Rights

13.1 Subject to the PDPA and other applicable law, you may request to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Delete personal data or your account, as described in Section 12.
• Withdraw consent where processing is based on consent.
• Limit or object to certain processing, including direct marketing.
• Ask us to transmit your personal data directly to another data controller of your choice, where technically feasible and the data format is compatible (data portability).
• Ask how your data is used and with whom it is shared.

13.2 To make a request, email privacy@thinkchat.tech. We may need to verify your identity. We will respond within the time required by the PDPA.

13.3 If you are an End User of a ThinkChat Customer, please contact that business first, as it is the data controller for your conversation data. We may redirect your request to the Customer and will help the Customer respond.

14. Children's Privacy

14.1 ThinkChat is a business product. It is not directed to children, and we do not knowingly collect personal data from anyone under 18.

14.2 Do not create an account or submit personal data to the Services if you are under 18. If we learn that we have collected personal data from a child, we will delete it.

15. International Data Transfers

15.1 We are based in Malaysia. Your personal data may be processed outside Malaysia by our service providers, such as AI, messaging, and payment providers.

15.2 We transfer personal data outside Malaysia only as permitted under section 129 of the PDPA, with appropriate safeguards in place, such as contractual protections requiring the recipient to protect the data to a standard equivalent to the PDPA.

16. We Do Not Sell Personal Data

16.1 We do not sell personal data.

16.2 "Sale" means the exchange or transfer of personal data to a third party for monetary consideration. Sending data to a service provider so we can operate a feature you requested (for example delivering a WhatsApp message or generating an AI reply) is not a sale.

17. Changes To This Privacy Policy

17.1 We may update this Privacy Policy from time to time. The "Effective Date" at the top shows when it was last updated.

17.2 Material changes will be posted on this page and may also be notified by email or in-product notice. Continued use of the Services after an update means you acknowledge the updated Privacy Policy.

17.3 If we start using Google user data in a new way not described here, we will update this Privacy Policy and obtain any consent required before doing so.

18. Contact

Think AI (M) Sdn Bhd (Registration No. 202601012735 (1674833-V))
ThinkChat AI Agent

Business address: 33-01, 33rd Floor, 203 Jalan Bukit Bintang, 55100 Kuala Lumpur, Malaysia
Registered address: 10-3A, Jalan Puteri 1/5, Bandar Puteri Puchong, 47100 Puchong, Selangor, Malaysia

Data Protection Officer: privacy@thinkchat.tech

Privacy and deletion requests privacy@thinkchat.tech

Sales (WhatsApp): +60 11-5515 9317

Website https://thinkchat.tech

Privacy Policy https://thinkchat.tech/privacy

Terms & Conditions https://thinkchat.tech/terms