Legal - privacy notice

Privacy Notice.

Last updated: 19 October 2026

We are Whizyre. We run managed AI assistants that live inside Telegram as chat bots. This notice explains, in plain English, what personal data we handle, why we handle it, where it goes, and what you can ask us to do about it. It covers our bots, our website and our support desk.

Who we are

Whizyre is a small business run by one person, operated from Malaysia as a sole proprietorship. Our SSM registration is in progress; we will add the registration number here as soon as it is issued. You can reach us at [email protected].

We wrote this notice like a human wrote it because Malaysia's Personal Data Protection Act 2010 (the "PDPA") asks us to be clear, and because clear is better anyway.

What we collect, and why

For everyone:

Your name and contact details (email, Telegram username or ID), so we can set up your assistant, support you and bill you.
Your chat messages with the assistant, so it can answer you and keep context.
A count of the messages we handle, so we can apply the fair-use limits in our Terms.
Payment confirmation you send us, such as a screenshot of your DuitNow QR transfer, so we can check that you paid.
Support emails, so we can fix problems.

If you use a Business plan, your customers' messages arrive through your assistant so it can answer them from your FAQ. For those messages, your business is the "data controller" and Whizyre is the "data processor": we handle them only to run the assistant for your business. Your business is responsible for telling its own customers that it uses an AI assistant; we give business clients a short, ready-made line they can use.

We do not collect more than we need, and we do not use your data for anything we have not told you about.

Why we are allowed to use it

Under the PDPA, we can process personal data with your consent, or where it is needed to perform our agreement with you, or to comply with the law. In practice: you consent when you sign up and accept this notice, and we process what is needed to run and bill the service. You can withdraw your consent at any time; that usually means we can no longer run your assistant (see "Your rights").

Where your data lives

Our servers. The bot engine runs on servers we manage. They may be located outside Malaysia.
Telegram. The bot lives on Telegram, so messages pass through Telegram's cloud under Telegram's own terms.
Our AI model provider. Replies are generated by a third-party cloud AI service that processes your messages to produce the answer. We require our AI providers to meet our data-protection standards, and we are moving to providers with published zero-retention terms; we will update this notice when that changes.
Banks and payment networks. DuitNow QR payments move through the banks. We see the payment confirmation, not your bank credentials.
Email. Support emails are handled through our email service.

When data is transferred outside Malaysia, we handle these transfers as Malaysian law requires.

AI and your data: the honest version

We do not sell your data, and we do not share it for advertising. Ever.
We do not use your messages to train our own models, and we will not do so.
The honest version: your messages are processed by our AI provider to generate replies. Our current provider does not publish public data-handling terms, so we cannot show you written retention terms today. We do not sell your data, and we do not use it to train our own models. Moving to providers with written zero-retention guarantees is a condition of our roadmap, and this notice will say so when it is true.

How long we keep things

Account and contact details: while your plan is active, then deleted within 30 days after it ends.
Your chat messages: while your plan is active. Deleted from our active systems within 30 days after your plan ends, or earlier if you ask us to delete them.
Payment screenshots: deleted once the payment is verified, and in any case within 90 days, unless kept as part of a billing record.
Billing records (payments, invoices): 7 years. Malaysian tax law requires business records to be kept for at least 7 years.
Support emails: up to 24 months after your issue is closed.
Backups: message copies in backups are overwritten within 90 days.

Your rights

You can ask us to:

tell you what personal data we hold about you (access);
fix anything that is wrong (correction);
delete your data, or stop using it (deletion and withdrawal of consent);
send your data to another service where technically possible (portability; this is a newer right under the PDPA);
explain anything in this notice.

Email [email protected]. We aim to respond within 21 days. If you are not happy with our answer, you can also complain to the Personal Data Protection Department (JPDP) at pdp.gov.my.

Keeping your data safe

What we do: access to production systems is limited to the operator; each customer's assistant runs separately; data is encrypted in transit (TLS); bot tokens and secrets are stored securely and kept out of logs; and we delete data on the schedule above. What we cannot promise: no system is perfect, and the internet has bad actors. If something goes wrong, we will be straight with you.

If there is a data breach

If a breach affects your personal data and is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner as the PDPA requires: the Commissioner as soon as practicable and within 72 hours, and you no later than 7 days after that. We will explain what happened, what we have done, and what you can do.

Changes to this notice

If we change this notice, we change the date at the top, and for anything material we tell you before it takes effect (for example in the bot or by email).

Contact

Whizyre (sole proprietorship, Malaysia) | [email protected] | Registration number: to be added when issued.

Related documents: our Terms of Service, and for business clients our Data Processing Addendum.

Last updated: 19 October 2026