Privacy Notice — Jawabkan

1. Who we are

SENTUAH JAYA WORKS (SSM No. 202603205142 (NS0326104-P)), a sole proprietorship registered in Malaysia, of 9-10, Avenue Crest, Jalan Jubli Perak 22/1, Seksyen 22, 40300 Shah Alam, Selangor, Malaysia, trading as Jawabkan, is the data controller responsible for the personal data described in this notice.

2. What this notice covers

This notice applies to the Jawabkan website, to enquiries you send us through it, and to conversations you have with our own WhatsApp number, +60 19-391 3891. In all three we are the data controller.

It does not cover the assistant we operate on behalf of a business that has engaged us — if you are messaging a shop, a clinic or a tuition centre that uses Jawabkan, that business is the data controller for its own customers' data, and we act as a data processor on its instructions under a separate agreement. Ask them for their privacy notice, not this one.

3. What personal data we collect

Only what you choose to send us, through one of three routes. They behave differently, so each is described separately below.

The demo request on the home page — your name and WhatsApp number (required, so we can arrange a demo), and your business name (optional).
The contact form — your name and WhatsApp number (required), plus business name, email address, industry, and a description of what you would like the assistant to handle (all optional).
Messaging our WhatsApp number — your WhatsApp number, the display name WhatsApp shows us, and what you write. Section 3.2.

We do not collect sensitive personal data as defined in section 4 of the Act, and we ask that you do not include any in your message.

What the website does not do

This is unusual enough to state plainly:

No cookies. The site sets none — not for analytics, not for advertising, not for remembering you. The one cookie that previously existed belonged to the live demo described below and went with it.
No analytics or tracking. No third-party measurement of any kind, and no profiling: we do not build a picture of you across visits or across sites.
No third-party requests. Fonts are served from our own domain, so no external provider sees your visit.
The demo on the home page is a recording, not a conversation. It is a fixed script that plays out in your browser. There is nothing to type into it, nothing is sent anywhere when it runs, and it is not an AI answering you. Until 5 August 2026 that demo did send what you typed to our server to be answered; it no longer exists, and any messages sent to it have been deleted.
The site stores nothing in your browser's local storage.

3.1 What happens when you send a form

The demo request on the home page is sent to our server. When you press "Request a demo", your name, WhatsApp number and business name are transmitted to this website and written to a file on the same Malaysian server that hosts the site, and a copy is emailed to us. That is the whole journey — it is not passed to any marketing platform, advertising network or CRM. Until you press that button nothing is sent, and closing the page before then leaves no record of you.

If our server cannot be reached, the page instead offers to hand your details to WhatsApp with the message already written, for you to send yourself. In that case nothing is stored on this website at all, and the enquiry reaches us only if you choose to press send in WhatsApp.

The contact form is not sent to our server. It has two steps, and neither transmits anything: your details are checked in your browser and used to prepare a message for you to send yourself, by WhatsApp or by email, with the fields already filled in. Choosing one of those is what delivers the enquiry to us; until you do, we hold no record of it.

Both forms contain a field that is hidden from view. It exists only to catch automated spam — a submission that fills it in is discarded and never reaches us — and it is never shown to you or asked of you. If you reach it with assistive technology, leave it empty.

To stop the demo request form being used to send bulk mail, our server counts how many requests come from an internet connection each hour and each day. That count is kept against a one-way scrambled form of the IP address, never the address itself, and it is deleted automatically within 48 hours.

How long we keep what you send is in section 8.

3.2 If you message our WhatsApp number

When you message +60 19-391 3891, we receive your WhatsApp number, the display name WhatsApp shows for you, what you write, and when you sent it.

An AI assistant writes the replies, and we will not pretend otherwise. It says so if you ask. A person can join the same conversation at any time and does so for anything the assistant should not decide alone — pricing outside our published plans, complaints, or anything it is unsure of. When a person is handling your conversation, the assistant stops replying.

To write a reply, the text of your message and the last few messages in the conversation are sent to OpenAI, the provider of the AI model, which processes them on servers outside Malaysia and returns the reply. They process it on our instructions in order to answer you. OpenAI's API terms state that content submitted this way is not used to train their models.

We keep two things, for different reasons and for different lengths of time:

A short working memory — the last few messages, so that "and to Penang?" still makes sense. Held for 24 hours and deleted within 48.
A record of the conversation — kept for 12 months, then deleted automatically.

We also use these conversations to improve the assistant. We read them to find questions it answers badly, facts missing from the information it works from, and mistakes worth correcting — and we use them to improve how it is built and trained. This is a separate purpose from answering your message, which is why it is stated here rather than assumed. We do not sell them, share them, or publish them.

WhatsApp itself is operated by Meta Platforms, on infrastructure outside Malaysia, under their own terms and privacy policy. Messages are encrypted in transit by WhatsApp; once delivered to us they are handled as described above.

Please do not send sensitive personal data through WhatsApp — identity-card details, payment card numbers, health information or anything of that kind. We do not ask for them and do not need them to answer an enquiry.

You can ask us to delete your conversation at any time — section 9.

Server logs

Our hosting provider, [HOSTING PROVIDER], automatically records standard technical information when a page is requested — IP address, browser type, page requested, and timestamp. This is generated by the hosting infrastructure rather than collected by us, is used only for security and reliability, and is retained for 30 days.

4. Why we process it, and our lawful basis

We process the data you send us to respond to your enquiry, arrange and run a demonstration, prepare a quotation, and — if you become a customer — to set up and support your account.

Our basis is your consent, given when you choose to send us your details. You are not obliged to provide anything. If you do not provide a name and a contactable number, we cannot arrange a demo, since we would have no way to reach you.

We will not use your details for unrelated marketing without asking you separately, and we do not sell or rent personal data to anyone.

5. Who we disclose it to

We may disclose your personal data to:

The messaging channel you chose. If you send your enquiry by WhatsApp, it is transmitted through WhatsApp, operated by Meta Platforms, and is subject to their terms and privacy policy. If you send it by email, it passes through your own email provider and ours.
Our hosting provider, [HOSTING PROVIDER], on whose Malaysian server this website runs and on which a demo request is stored. They process data on our instructions and are bound to keep it confidential.
Our email provider, [EMAIL PROVIDER], which carries the copy of a demo request that is sent to us.
OpenAI, which receives the text of WhatsApp messages in order to generate the assistant's reply, as described in section 3.2. It receives your message, not your name or your number.
Authorities, where disclosure is required by Malaysian law or a valid legal order.

That is the complete list. We use no form-handling service, no CRM, no marketing platform and no advertising network, and we do not sell or rent personal data to anyone.

6. Transfers outside Malaysia

The server that runs this website, and on which a demo request is stored, is located in Malaysia.

Three things do leave it, and you should know which:

Email. A copy of each demo request is sent to us by email, and email providers routinely operate servers outside Malaysia.
WhatsApp. Messages are carried by Meta Platforms on infrastructure outside Malaysia.
The AI model. The text of a WhatsApp message is sent to OpenAI, outside Malaysia, to generate the reply. This is unavoidable for the service to work at all, which is why it is stated plainly rather than buried.

Where personal data is transferred abroad in this way, we take reasonable steps to ensure it receives protection comparable to that required under the Act, including contractual safeguards with the provider. By choosing to send us your details, or to message our WhatsApp number, you consent to that transfer, as section 129 of the Act contemplates.

7. How we keep it safe

We apply practical safeguards appropriate to a small operation: access limited to people who need it, accounts protected by strong authentication, encryption in transit, and prompt deletion of data we no longer need. No system is perfectly secure, and we do not claim otherwise.

If a breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner, and affected individuals, as required under the Act.

8. How long we keep it

Enquiries that do not become customers — 12 months from your last contact with us, then deleted. This covers the copy stored on our server, the copy in our email, and any notes we made while following it up.
Customer records — for the life of the account and 7 years afterwards, where needed for tax and accounting obligations.
WhatsApp conversations — the working memory for 24 hours, deleted within 48; the conversation record for 12 months, then deleted automatically.
Server logs — 30 days.
The anti-spam counters described in section 3.1 — they stop being used after 48 hours and are deleted automatically thereafter. They hold no name or number, and the IP address in them is scrambled beyond recovery.

You can ask us to delete your details sooner, and we will unless we are required by law to keep them.

9. Your rights

Under the Act you may:

Access the personal data we hold about you, and be told how it is being processed.
Correct data that is inaccurate, incomplete or out of date.
Withdraw consent at any time, after which we stop processing and delete your details unless we must keep them by law.
Limit processing, including asking us not to contact you for direct marketing.
Request portability — that we transmit your data to another data controller, where technically feasible.

To exercise any of these, email hello@jawabkan.com. We will respond within the period the Act allows. We may ask you to confirm your identity first, so that we do not disclose your data to someone else. A fee may apply to a data access request, as permitted by the Act.

10. Children

This site is intended for business owners and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.

11. Changes to this notice

If we change how we handle personal data we will update this page and the version and date above. Material changes affecting existing enquiries or customers will be communicated directly.

12. Complaints

If you are unhappy with how we have handled your personal data, please raise it with us first at hello@jawabkan.com — most issues are resolved quickly.

You also have the right to complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia.

13. Language

This notice is published in English and Bahasa Malaysia, as required by section 7(3) of the Act. In the event of any inconsistency, the Bahasa Malaysia version prevails.