Privacy Policy
This policy explains how SFT Legacy Sdn. Bhd. (Company No. 202101020127, "we", "us") collects and uses personal data through Office-B, our AI back-office service, its apps and its WhatsApp integration. We follow Malaysia's Personal Data Protection Act 2010 (PDPA).
1. Who this applies to
Our clients (business owners and their staff who use Office-B) and people who contact our clients' businesses through channels connected to Office-B, such as WhatsApp. For our clients' customers, the client business is the data user; we process the data on its behalf.
2. Data we collect
- Account data: name, email, phone number and a securely hashed password for each Office-B user.
- Business content: business information, chats with the AI assistants, documents and images uploaded, bookings and notes.
- Messaging data: WhatsApp messages, media and voice notes sent to a business number connected to Office-B, and the sender's phone number and profile name, received through the WhatsApp Business Platform (Meta).
- Technical data: basic logs (time, IP address, request) used for security and troubleshooting.
3. How we use it
- To provide Office-B: generate drafts, answers, reports and document summaries, file documents, manage bookings and send replies that the business approves.
- To send service notifications (for example, a report is ready or a deadline is near).
- To keep the service secure, fix problems and support our clients.
We do not sell personal data and we do not use it for advertising.
4. Service providers
We use carefully selected providers to run Office-B: xAI (AI models that generate responses and transcribe voice notes), Meta Platforms (WhatsApp Business Platform), Fly.io (hosting in Singapore), and where a client chooses it, Google Drive for document storage. Data is shared with them only as needed to provide the service, and some processing may happen outside Malaysia.
5. Storage and retention
Each client's data is kept in a separate, encrypted storage volume. We keep data for as long as the client uses Office-B and delete it within 90 days after the client ends the service, unless the law requires us to keep it longer.
6. Your rights
Under the PDPA you may request access to, or correction of, your personal data, and withdraw consent to processing. If you contacted a business that uses Office-B, please contact that business first; you can also contact us directly. To ask for your data to be deleted, email us with the phone number or email address it relates to.
7. Security
We use HTTPS, encrypted storage, hashed passwords, role-based access (staff cannot see the owner's private data) and signed webhooks. No system is perfectly secure, but we work to protect your data and will notify affected clients of any serious incident.
8. Contact
SFT Legacy Sdn. Bhd., LOT L8-22 (Eighth Floor), Brem Mall, Jalan Kepong, 52000 Kuala Lumpur, Malaysia · admin@sftlegacy.co · +60 13-393 8153