Privacy Policy

Chatz is a shared inbox for businesses. It brings WhatsApp, Instagram, Messenger, email and voice into one place, and it necessarily holds the conversations that happen there. This page says what we hold, why, who else sees it, and how to get it back or removed.

Two kinds of people, two different roles

If you use Chatz for your business, we hold your account so the service can work: we decide what is kept and for how long, and this policy is our promise to you.

If you are a customer messaging a business that uses Chatz, that business decides what to do with your details, and we hold them on its behalf. Ask the business you wrote to first. If you cannot reach them, write to us and we will pass the request on.

What we hold

• Your account. Name, email address, profile photo, your role and which workspaces you belong to, and either a hashed password or, when you sign in with Google or Apple, the name, email and account identifier that provider gives us. We never receive your password from them.
• The work itself. The messages, photos, documents, voice notes and locations exchanged with your customers, plus the contacts, tags, notes, orders, invoices, appointments and call records your team creates around them.
• Technical records. Sign-in tokens, the push notification token for each device you install the app on, and security and audit records of who did what in a workspace.

We do not build advertising profiles, we do not track you across other companies’ apps or sites, and we do not sell anything we hold to anybody.

Why we hold it

• To run the service you asked for: delivering and receiving messages, and keeping the history your team works from.
• To tell you what needs attention, by push notification and by email.
• To bill for the plan and for AI usage, and to collect payment for orders you raise.
• To keep accounts secure, investigate abuse, and meet obligations we are under by law.

Who else sees it

Only the services the product genuinely runs on, each seeing the minimum its job needs:

• Meta Platforms for WhatsApp, Instagram and Messenger. Messages travel through Meta because that is where your customers are; Meta’s own terms apply to that leg of the journey.
• Expo, Apple and Google to deliver push notifications to your phone. A notification carries the sender’s name and a short preview.
• Anthropic and OpenAI, and only when somebody uses an AI feature. What goes is the text and any images that request needs. No AI provider is given a copy of your workspace to train on.
• CHIP to take payment when you send a customer a payment link. Card details are entered on their page and never reach us.
• Our email sender and our hosting and storage providers, which run the servers, the database and the file storage the product sits on.

We also hand data over when the law requires it, and we would tell you unless we are forbidden to.

Where it lives, and for how long

Data is held on servers we operate, with files in object storage alongside them. Messages, contacts and everything else in a workspace stay until you delete them or close the account, because a shared inbox that forgets is not one. Audit records are pruned automatically after 180 days. Backups roll off on their own schedule, so a deletion can take up to 30 days to disappear from every copy.

How it is protected

Everything travels over HTTPS. Passwords are hashed and never stored in a readable form, and the keys and tokens that connect your channels are encrypted at rest. Each workspace is isolated from every other one in the database itself rather than by application code remembering to filter, and inside a workspace an owner decides who may see which channels.

What the mobile app touches

The Chatz app asks for the camera, your photo library, the microphone and your location. Each one is asked for at the moment you use the feature it belongs to, and nothing is read in the background: a photo is taken because you tapped the camera, a location is sent because you chose to share it. The app also registers a push token so notifications can reach the device. It contains no advertising or analytics software, and no tracking across other companies’ apps.

Your rights

Under the Malaysian Personal Data Protection Act 2010 you may ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you gave. Write to hello@chatz.my and we will answer within 21 days. Deleting an account also removes the workspaces it alone owns, so we will confirm with you first.

Children

Chatz is a tool for businesses and is not intended for anyone under 18. We do not knowingly hold data about children.

Changes

When this policy changes materially we will say so by email to workspace owners before it takes effect. The date at the top is always the date of the current version.

Contact

hello@chatz.my, or through the contact page. Our terms of service are here.