Privacy Policy

1 Introduction

Quantum Bot ("the Service", "the bot", "we", "our", or "us") is an automated WhatsApp Business messaging assistant operated by Quantum Web Studio (Kelantan, Malaysia) over the official WhatsApp Business Platform (Cloud API) provided by Meta Platforms, Inc. The bot lets a business reply to customer enquiries, share product and pricing information, take bookings, and provide order or repair status updates through WhatsApp.

This Privacy Policy explains what information we receive when you message our WhatsApp business number, how we use it, who we share it with, and the rights you have over your data. By starting or continuing a conversation with our WhatsApp number, you agree to the practices described in this policy.

2 Information We Collect

2.1 Information you send us on WhatsApp

• WhatsApp phone number — the number you message us from, used to identify your conversation and reply to you.
• WhatsApp profile name — the public display name on your WhatsApp account.
• Message content — the text, questions, addresses, and details you type in the chat.
• Media you choose to send — photos (e.g., a picture of a device fault), documents, voice notes, location, and contact cards.

2.2 Information generated by the conversation

• Message metadata — timestamps, message and delivery status (sent, delivered, read), and the WhatsApp business line you contacted.
• Conversation records — a history of the chat so the business and the bot can continue helping you and keep a record of bookings or requests.
• Derived text — where you send a voice note or a photo, we may transcribe the audio or analyse the image automatically so the bot can understand and respond.

2.3 What we do NOT collect

• We do not read your other WhatsApp chats, contacts, or messages you send to anyone else. We only receive the messages you send to our business number.
• WhatsApp end-to-end encryption secures messages in transit; we receive only the messages addressed to our business number through Meta's Cloud API.

3 How We Use Your Information

• To read your message and send you a relevant reply, automatically and/or with staff assistance.
• To answer questions about products, services, pricing, availability, and store information.
• To take and manage bookings, orders, repair jobs, and to send status updates, invoices, or receipts you request.
• To transcribe voice notes and analyse photos you send so the bot can understand your request.
• To improve the accuracy and quality of automated replies.
• To prevent spam, abuse, and fraudulent use of the service.
• To comply with applicable Malaysian laws and lawful requests from authorities.

We do not sell your personal data or chat history to third parties, and we do not use your messages to build advertising profiles. We only send you WhatsApp messages that are replies to you, that you have opted in to receive, or that are permitted by WhatsApp's Business Messaging Policy.

4 Service Providers We Share Data With

To operate the bot we use a small number of trusted processors. They process your data only to perform the service we contract them for:

• Meta Platforms (WhatsApp Business Platform / Cloud API) — delivers messages between you and our business number. Your use of WhatsApp is also governed by Meta's own privacy policy.
• Supabase — secure cloud database and functions that store conversation records and run the bot logic.
• AI processing providers — to understand messages and draft replies, transcribe voice notes, and read photos, we may send the content of your message to AI service providers (such as Anthropic, OpenAI, Google, or Groq). They process the content to return a response and do not use it to train their models on our behalf.

These providers are bound by their own privacy, security, and confidentiality commitments.

5 Data Retention

• Conversation records and the media you send are retained for as long as needed to provide the service and to keep a record of your bookings, orders, or repair jobs.
• Transaction-related records (e.g., bookings, invoices) may be retained for up to 7 years to comply with Malaysian record-keeping and tax obligations.
• Voice-note transcriptions and temporary AI processing data are kept only as long as needed to generate a reply.
• You may request deletion of your conversation data at any time — see Section 7.

6 Your Rights (PDPA 2010)

Under the Personal Data Protection Act 2010 of Malaysia, you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or out of date.
• Withdraw consent and stop messaging — you can simply stop chatting, or send "STOP" to opt out of further messages.
• Request deletion of your conversation data and personal information.
• Limit the processing of your data in certain circumstances.

To exercise any of these rights, contact us at the email below or follow the deletion steps in our Data Deletion page.

7 Data Deletion

You can ask us to delete the personal data and conversation history associated with your WhatsApp number at any time. Send a WhatsApp message containing the word "DELETE" to our business number, or email [email protected] from or referencing your WhatsApp number. We will delete your personal data within 30 days, except records we are legally required to keep (such as transaction records for tax purposes). Full instructions are on our Data Deletion page.

8 Security

We use industry-standard safeguards to protect your data, including encrypted transport (HTTPS/TLS 1.2+), webhook signature verification, access controls on our database, and tenant isolation so each business's conversations are kept separate. No system is perfectly secure, but we work continuously to protect your information.

9 Children's Privacy

The Service is intended for general customer enquiries and is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10 Google Account Data (Business Profile)

If you are a business owner who connects your Google Business Profile to our service ("Sambung Google Bisnes"), we ask for your permission through Google's standard sign-in screen. This section explains exactly what we do with that access.

• What we request: the business.manage scope, plus your email address and basic profile identity, only for the Google account you choose to connect.
• What we access: the business locations you manage, their business information (name, address, phone, opening hours, categories, photos), performance insights, and the reviews and questions customers leave on those locations.
• What we do with it: show your profile, ratings and reviews inside your dashboard; publish replies to reviews on your behalf (automatically if you switch auto-reply on, or manually when you press Reply); update your business information, opening hours and photos when you ask us to; and publish posts you create.
• What we store: an encrypted Google refresh token so the connection keeps working, your connected email address, your location identifiers, and a log of the replies we sent (so the same review is never answered twice). We never store your Google password.
• Who it is shared with: nobody. Google account data is never sold, never used for advertising, never used to train AI models, and never shown to other businesses on the platform. The text of a review is sent to our AI providers (Anthropic or Google Gemini) solely to draft the reply to that review.
• How to revoke: press "Putuskan Sambungan" in the app, or remove access at myaccount.google.com/permissions. We delete the stored token immediately and stop all access.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11 Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective" date at the top of the page reflects the latest revision. Material changes will be reflected on this page before they take effect.