This policy explains how Chatlah collects, uses, shares, retains and protects personal data. It covers our website, our product, and in particular the data we receive from Meta Platforms through the WhatsApp Business Platform.
1. Who we are
Chatlah is a customer communication platform operated by Z Talent Solutions Sdn. Bhd., a company registered in Malaysia ("Chatlah", "we", "us"). We are the entity responsible for the Platform Data that Meta makes available to us.
For privacy questions, including any request about your data, contact privacy@chatlah.ai.
2. Our two roles
Chatlah handles personal data in two distinct capacities, and your rights differ depending on which applies.
| Capacity | Whose data | What this means |
|---|---|---|
| Controller | Website visitors, waitlist subscribers, and the staff of businesses that hold a Chatlah account | We decide why and how this data is processed. Requests come to us directly. |
| Processor | The end customers of a business using Chatlah, including everyone who messages that business on WhatsApp | The business is the controller. We process this data on its instructions. If you are an end customer, contact the business you were messaging; we will assist them in responding. |
3. Data we collect
3.1 Website and waitlist
- The email address you submit to join the waitlist.
- Standard server request data, including IP address, user agent, referring page and timestamp, generated when your browser requests a page.
We do not use advertising trackers or third-party analytics cookies on this website.
3.2 Account data
- Business name, registration details and billing contact.
- Name, work email and role of each user your business invites.
- Authentication data, product configuration, and audit records of actions taken in the product.
3.3 Data received from Meta
See section 4, which describes this in detail because it is the category most people want to understand.
4. WhatsApp Business Platform data
When a business connects its WhatsApp Business Account to Chatlah, we access that account through the Meta Graph API on the business's authorisation. We use two permissions, and we use them only for the purposes described here.
| Permission | Data we receive or send | Purpose |
|---|---|---|
whatsapp_business_messaging |
Message content sent to and from the business, the phone number of the person messaging, message identifiers, timestamps, delivery and read status, and any media attached to a message. Also the business phone numbers being registered and the business profile of the connected account. | To display the conversation in the business's inbox, to deliver the business's replies to its customer, and to show whether a message was delivered. |
whatsapp_business_management |
The connected WhatsApp Business Account and its identifiers, its registered phone numbers, message templates and their content and approval status, phone number quality ratings, messaging limits, template performance metrics, and webhook subscription settings. | To let the business read, create and manage its message templates inside Chatlah, and to display the health and performance of its WhatsApp channel. |
4.1 What we do not do with this data
- We do not sell it, rent it, or share it with data brokers.
- We do not use it for advertising or to build advertising profiles.
- We do not use one business's conversation content for the benefit of another business.
- We do not use Meta Platform Data for any purpose other than providing the Chatlah service to the business it came from.
5. How we use data
- To provide the service: deliver messages, display conversations, manage templates, and show channel health.
- To operate agent workflows: where a business configures automated or AI-assisted handling, we process the conversation for that business, on its instructions, to draft or route responses. Actions the business designates as commercially sensitive require human approval before they are sent.
- To secure and maintain the service: detect abuse, debug failures, and keep audit records.
- To communicate with account holders: service notices, security notices and support.
- To meet legal obligations.
6. Legal bases
Where the GDPR, the UK GDPR or Malaysia's Personal Data Protection Act applies, we rely on: contract, to provide the service a business has signed up for; legitimate interests, to secure the service and prevent abuse; consent, for the waitlist, which you may withdraw at any time; and legal obligation, where we must retain or disclose data by law.
7. Sharing and sub-processors
We share personal data only with service providers who process it on our behalf, under contract, for the purposes below. We do not sell personal data.
This table is the authoritative list of our sub-processors and is kept current. As Chatlah moves into general availability we will add the providers used for application hosting, data storage and AI model inference, and will update this page before those providers begin processing any data.
| Provider | Purpose | Data location |
|---|---|---|
| Meta Platforms | WhatsApp Business Platform, the source of the data in section 4 | Per Meta's own terms |
| Lark Technologies | Business email for the contact addresses published in this policy | Per Lark's terms |
8. Retention
| Data | Retained for |
|---|---|
| Waitlist email addresses | Until you ask us to delete them, or 24 months after the waitlist closes |
| Website server logs | 30 days |
| Conversation content and WhatsApp Platform Data | For as long as the business's account is active. Deleted within 30 days of the business closing its account or disconnecting its WhatsApp Business Account, unless the business asks us to delete it sooner |
| Account and billing records | As required by Malaysian tax and company law |
| Security and audit logs | 12 months |
9. Your rights and deletion
Subject to applicable law, you may request access to your personal data, correction, deletion, a portable copy, restriction of processing, or object to processing. You may also withdraw consent where we rely on it.
To make a request, email privacy@chatlah.ai. We respond within 30 days. We may ask you to verify your identity before acting.
If you are an end customer of a business using Chatlah — for example you messaged a business on WhatsApp — that business is the controller of your conversation. Contact them directly. If you contact us, we will pass the request to them and help them act on it.
Deleting data received from Meta. A business can disconnect its WhatsApp Business Account from Chatlah at any time, which immediately ends our access. To have the associated data erased, email us and we will delete it within 30 days and confirm when done.
10. International transfers
We are based in Malaysia and our providers may process data in other countries, including the United States and Singapore. Where data protected by the GDPR or UK GDPR leaves its home jurisdiction, we rely on European Commission Standard Contractual Clauses or an equivalent lawful transfer mechanism.
11. Security
- Data is encrypted in transit using TLS, and at rest by our infrastructure providers.
- Access to production systems is restricted to staff who need it, and is logged.
- Access tokens issued by Meta are held server-side only. They are never exposed to a browser or included in client-side code.
- We keep audit records of actions taken against connected WhatsApp Business Accounts.
To report a security vulnerability, email security@chatlah.ai. We will acknowledge within three business days and will not pursue action against good-faith research.
12. Requests from public authorities
If a government body or law enforcement agency asks us for personal data, we review the legality of the request before responding, challenge requests we consider unlawful or overbroad, disclose only the minimum information legally required, and document each request, our response, the legal reasoning and who decided. Where we are lawfully able to, we notify the affected business.
13. Children
Chatlah is a business product and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.
14. Changes and contact
If we make a material change to this policy we will update the date above and, where we hold your contact details, notify you before the change takes effect.
Z Talent Solutions Sdn. Bhd., Malaysia
General: hello@chatlah.ai
Privacy: privacy@chatlah.ai
Security: security@chatlah.ai