Privacy policy

Last updated: 06 Nov 2026

Introduction

This Privacy Policy explains how Sapiens Technologies Sdn. Bhd. (Company Registration No. 201701043393), the company that operates WaaPY (“WaaPY”, “we”, “us”, “our”), collects, uses, stores and protects personal data when you visit https://waapy.co, sign up for or use the WaaPY platform at https://waapy.chat, or contact us.

We process personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (“PDPA”), as amended.

1. Who we are

Sapiens Technologies Sdn. Bhd.
Unit 1009, Lobby 3, 10th Floor, Block A,
Jalan SS20/27, Damansara Intan,
47400 Petaling Jaya, Selangor
Malaysia

Email: [email protected]
Phone: + 601120209588

2. Our two roles

For our own customers’ account and billing data, and for visitors to our website, we decide how the data is used. We are the data user (controller) under the PDPA.
For the conversations our customers manage in WaaPY, we process messages and contact details on behalf of our customer, the business that connected its messaging channels. That business is the data user. We process that data only to provide the WaaPY service and only on our customer’s instructions. If you messaged a business that uses WaaPY, please contact that business first about your data. We will help them respond.

3. Data we collect

From customers (businesses using WaaPY):
Account details: name, business name, email, phone number, job title, login credentials
Billing details: billing address and payment records (card details are handled by our payment provider and are not stored by us)
Usage data: log-ins, features used, settings, support tickets
From website visitors and demo requests:
Name, email, phone and company details you submit in our forms
Device and browser data, IP address, pages visited and cookies (see section 9)
- From connected messaging channels (processed on behalf of our customers):
  - When a customer connects a messaging channel to WaaPY, we receive data through that platform’s official API, only after the customer authorises the connection.
  - Supported channels include WhatsApp, Instagram, Facebook Messenger, Telegram, LINE and TikTok. Depending on the channel, this may include:
The customer’s business account ID, account name and profile details
The contact’s platform user ID, display name, username and profile picture
Message content, attachments (images, video, audio, files), timestamps and delivery or read status
Labels, notes, assignments and replies added by the customer’s team inside WaaPY
From integrations a customer enables (e.g. e-commerce, CRM or n8n workflows): order, product and customer records the customer chooses to sync.

4. TikTok data

If a customer connects a TikTok Business account through TikTok’s Business Messaging API:

We access only the scopes the customer authorises in TikTok’s consent screen, and only for that customer’s own TikTok Business account.
We use TikTok data only to show the customer’s TikTok direct messages in their WaaPY inbox, let their team reply, and run automations the customer sets up.
We do not sell TikTok data, use it for advertising or profiling, share it with data brokers, or use it to train AI models.
We handle TikTok data in line with TikTok’s developer terms and policies.
The customer can disconnect TikTok at any time in WaaPY settings or in their TikTok account. When they do, we stop receiving new data and delete stored TikTok data as described in section 7.

The same principles apply to data we receive from every other connected channel.

5. How we use data

To provide, operate and maintain WaaPY, including delivering and syncing messages
To create and manage accounts, process payments and send invoices
To provide customer support and respond to enquiries
To send service notices, such as security alerts, billing reminders and changes to these terms
To send marketing messages, only where you have agreed; you can opt out at any time
To monitor, secure and improve the platform, using aggregated or de-identified data where possible
To comply with legal obligations and enforce our Terms of Service

We do not sell personal data.

6. Sharing and sub-processors

We share personal data only as follows:

Messaging platforms (Meta, Telegram, LINE, TikTok): to send the replies our customers write
Service providers who process data for us under contract: hosting and infrastructure providers, payment processing, email delivery, customer support tools and AI providers used for features the customer turns on
Integrations a customer chooses to connect, on that customer’s instruction
Authorities, where required by law or to protect our rights, users or the public
A buyer or successor if our business is merged, sold or restructured, under the same protections

We will give a list of current sub-processors on request.

7. Retention and deletion

Account and conversation data is kept while the customer’s subscription is active.
When a customer disconnects a channel, we stop receiving data from it immediately.
Conversation data from that channel is deleted within 30 days unless the customer asks us to keep it for export.
When a customer closes their account, we delete their data within 30 days, except records we must keep by law (such as invoices, kept for 7 years under Malaysian tax law).
Backup copies are overwritten within 90 days.
Website enquiry data is kept for up to 24 months after our last contact with you.

Customers can ask for deletion at any time by emailing [email protected]. End users of a channel (e.g. someone who messaged a business on TikTok) can also email us, and we will pass the request to the business concerned and act on its instruction.

8. Security

We protect data with encryption in transit (HTTPS/TLS), access controls limited to staff who need them, role-based permissions inside WaaPY, logging and monitoring, and regular backups. API access tokens for connected channels are stored encrypted. No system is completely secure; if a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected customers as the PDPA requires.

10. International transfers

Our servers and some service providers may be located outside Malaysia. When data is transferred abroad, we make sure the recipient protects it to a standard comparable to the PDPA, as the PDPA requires.

11. Your rights

Under the PDPA you may:

Request access to and a copy of your personal data
Request correction of inaccurate data
Withdraw consent or limit how we process your data
Ask us to stop direct marketing
Request that we transfer your data to another provider, where technically feasible
Request deletion where we no longer need the data

Email [email protected]. We will reply within 21 days. We may need to verify your identity first. If you are not satisfied, you may complain to the Department of Personal Data Protection Malaysia (https://www.pdp.gov.my).

12. Changes

We may update this policy. We will change the “Last updated” date above and, for significant changes, notify customers by email or in the WaaPY dashboard.