Privacy Policy
Last updated: 15 Sept 2025

1. Introduction
This Privacy Policy explains how ABC Salesbot Sdn Bhd. (“Company”, “we”, “our”, “us”) collects, uses, stores, and protects personal data in connection with our services, including the ABC Salesbot platform (the “Services”).
We believe trust comes from transparency. This Policy sets out how we actually handle your data — including customer contacts, uploaded media, chat transcripts, and integration credentials — and what we will never do with it.
We comply with applicable data protection laws, including:

the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR;
the Personal Data Protection Act 2012 (Singapore PDPA); and
the Personal Data Protection Act 2010 (Malaysia PDPA).

By using the Services, you acknowledge and agree to the practices described in this Privacy Policy.

2. Data Controller Contact
The data controller for personal data processed in connection with the Services is:
ABC Salesbot Sdn Bhd.
Suite 23.01, Level 23, Menara Exchange 106, Lingkaran TRX, Tun Razak Exchange, 55188 Kuala Lumpur, Malaysia.
Email: privacy@abcsalesbot.com

3. Personal Data We Collect
We process the following categories of data, depending on how you use the Services:

Account Information: names, business contact details, login credentials, billing information.
Lead and Contact Data: customer and prospect contact lists, lead databases, and contact information collected through chatbot interactions.
Integration Credentials: API keys, tokens, or authentication credentials provided by Clients to enable integrations with third-party systems (e.g. CRM, calendars, messaging platforms).
Service Data: chatbot scripts, knowledge base entries, configurations, and other data you provide to set up your bot.
End-User Data: chat interactions between your End-Users and the bot.
Media Data: audio recordings (including voice recordings for “clone your voice”), images, videos, documents, and other media uploaded by Clients or End-Users.
Technical Data: IP addresses, device/browser type, usage logs, cookies, and analytics data.

We do not intentionally collect sensitive categories of personal data unless specifically provided by the Client.

4. Purposes and Lawful Basis for Processing
We process personal data only where permitted by law.

Contract (GDPR Art. 6(1)(b)): to provide and support the Services.
Legitimate Interests (GDPR Art. 6(1)(f)): to improve the Services, provide proactive support, ensure security, and suggest optimization opportunities.
Consent (GDPR Art. 6(1)(a), PDPA Singapore & Malaysia): for marketing or where otherwise required.
Legal Obligation (GDPR Art. 6(1)(c)): to comply with law.

Under the Singapore and Malaysia PDPA, we collect, use, and disclose personal data only with the consent of the individual, deemed or express, and only for the purposes notified at the time of collection or as permitted by law.

5. How We Use Personal Data
We use data solely to:

Operate, maintain, and improve the Services.
Enable chatbot interactions between Clients and their End-Users.
Provide customer support and account management.
Deliver proactive support, which may involve reviewing Client usage and selected End-User chat transcripts to recommend optimizations, training, and feature adoption.
Process Lead and Contact Data solely for chatbot interactions, lead management, and reporting back to the Client.
Use Integration Credentials only to enable integrations authorized by the Client.
Use Media Data, including voice recordings, solely for the requested feature (e.g. voice cloning, chatbot training).
Develop general insights and best practices based on our work across industries — while never reusing Client-specific content or confidential business data.
Comply with legal and regulatory obligations.

We do not sell data. We do not use Client or End-User data to train AI models. We do not disclose data to competitors. We will never use Client Data (including chat transcripts, results, or media) for marketing purposes without the Client’s explicit consent.

6. Confidentiality and General Know-How

Confidential Information includes: client scripts, uploaded contacts, API credentials, chat transcripts, media, voice recordings, and internal workflows that are unique to a Client. We will never disclose or reuse these.
General Know-How means: concepts, techniques, and patterns we learn while delivering services that can be applied across industries. For example, discovering that shorter chatbot templates improve engagement, or that escalation flows triggered by keywords improve customer satisfaction.

Examples:


❌ Confidential (cannot reuse): “Mention our partner [Company X] and apply discount code ‘GROWTH2025’.”


❌ Confidential (cannot reuse): “When the bot detects keyword Y, escalate directly to team lead via WhatsApp number 12345.”


✅ General Know-How (may reuse): Using discount codes in chats can increase conversion (Client B would use their own discount code).


✅ General Know-How (may reuse): Escalating based on keyword triggers improves service (Client B would provide their own keywords and contacts).


We may publish case studies, testimonials, or success stories only with the Client’s explicit consent, and only after censoring or anonymizing any personal or sensitive information



7. Disclosure of Personal Data
We may share personal data only:

With service providers (AWS for hosting, OpenAI for natural language processing, payment processors, etc.) under agreements requiring equivalent protections.
Where required by law, regulation, or valid legal process.
In connection with a merger, acquisition, or sale of assets, subject to safeguards.

We do not rent, sell, or disclose personal data for marketing.

8. Proactive Support and Access to Data

Authorized staff may access Client accounts and selected chat transcripts to deliver proactive support.
Access is logged, restricted, and used solely for support or improvement.
Clients may opt out of proactive support at any time by emailing privacy@abcsalesbot.com.
We do not use data accessed for proactive support for unrelated purposes, resale, or AI training.


9. Data Retention

We retain data only as long as necessary for the purposes described, or as required by law.
Lead and Contact Data, Media Data, and Integration Credentials are retained only for the duration of the Client relationship or until deleted by the Client.
Upon termination of an account, we will delete or anonymize data within 90 days, unless retention is legally required.


10. Data Security

Hosting: Services are hosted on Amazon Web Services (AWS) Singapore, certified under ISO 27001, SOC 2, and compliant with Singapore PDPA.
In Transit: All data is encrypted in transit using TLS.
At Rest: Data is stored in plain text at rest within our systems, with strict access controls, monitoring, and organizational safeguards.
Processing: Data must be transmitted in plain text to OpenAI for language processing; it remains encrypted in transit, is not retained beyond processing, and is not used to train OpenAI models.


11. International Transfers
We primarily host all Client Data on AWS Singapore, meaning your data is stored within Singapore. For EU/UK Clients, this constitutes an international transfer outside the EEA/UK. We rely on the European Commission’s Standard Contractual Clauses (SCCs) and equivalent safeguards to protect such transfers. For Clients in Malaysia, use of the Services constitutes consent to the transfer of data to Singapore. Where we engage sub-processors outside Singapore (such as OpenAI), we ensure appropriate safeguards and contractual protections are in place. By using the Services, you consent to the transfer of your personal data to Singapore for hosting and processing.

12. Individual Rights
Under GDPR, individuals may request access, rectification, erasure, restriction, portability, objection, consent withdrawal, and lodge a complaint.
Under Singapore & Malaysia PDPA, individuals may access and correct their personal data and withdraw consent (subject to legal or contractual restrictions).
Requests may be sent to privacy@abcsalesbot.com

13. Cookies and Tracking
We use cookies and similar technologies for functionality, analytics, and improvement. Clients and End-Users may manage preferences via browser settings or our cookie banner.

14. Children’s Data
Our Services are not directed at children under 16, and we do not knowingly collect data from them. If discovered, such data will be deleted.

15. Changes to this Policy
We may update this Privacy Policy from time to time. The “last updated” date will appear at the top. Material changes will be communicated in advance where legally required.