Privacy Notice

1. Who we are

SENTUAH JAYA WORKS (SSM No. 202603205142 (NS0326104-P)), a sole proprietorship registered in Malaysia, of 9-10, Avenue Crest, Jalan Jubli Perak 22/1, Seksyen 22, 40300 Shah Alam, Selangor, Malaysia, trading as Jawabkan, is the data controller responsible for the personal data described in this notice.

Contact us about anything in this notice at hello@jawabkan.com or on WhatsApp at +60 19-391 3891.

2. What this notice covers

This notice applies to the Jawabkan website, to enquiries you send us through it, and to conversations you have with our own WhatsApp number, +60 19-391 3891. In all three we are the data controller.

It does not cover the assistant we operate on behalf of a business that has engaged us — if you are messaging a shop, a clinic or a tuition centre that uses Jawabkan — on its WhatsApp number, in a chat window on its website, on Telegram or on LINE — that business is the data controller for its own customers' data, and we act as a data processor on its instructions under a separate agreement. Ask them for their privacy notice, not this one.

3. What personal data we collect

Only what you choose to send us, through one of three routes. They behave differently, so each is described separately below.

• The demo request on the home page — your name and WhatsApp number (required, so we can arrange a demo), and your business name (optional).
• The contact form — your name and WhatsApp number (required), plus business name, email address, industry, and a description of what you would like the assistant to handle (all optional). If you choose to answer them, also what the enquiry is about, roughly how many repeat questions you get a day, where they arrive, and whether your prices are written down. If the link that brought you to the site carried a campaign tag (such as utm_source=newsletter), your browser keeps that tag for the open tab only, and it is stored with your enquiry only if you send one, so we know which post or campaign it came from.
• Messaging our WhatsApp number — your WhatsApp number, the display name WhatsApp shows us, and what you write. Section 3.2.

We do not collect sensitive personal data as defined in section 4 of the Act, and we ask that you do not include any in your message.

What the website does not do

This is unusual enough to state plainly:

• No cookies, except two for the live demo. The site sets none for analytics, advertising or remembering you. The only exception: when you type a question into the live demo, two strictly necessary cookies are set. A session cookie holds your demo conversation and ends when you close the browser. A cookie named jd holds a random number, with nothing about you in it, used only to limit how many live questions one browser can ask in a day; it expires after 24 hours. Tapping the preset questions sets no cookie.
• No third-party analytics, and no profiling. No third-party measurement of any kind — no Google Analytics, no advertising pixels, nothing that reports your visit to anybody else. We do count page views on our own server, and we count them in a way that cannot identify you: we record only which page was opened, on which day, and which site linked you here. We also count a few actions on a page, such as starting or finishing the self-test, using the calculator, working through the steps of the live demo, pressing a pilot button, starting to fill in or sending an enquiry form, opening checkout, following a WhatsApp, Telegram or LINE link, or opening the QR code that lets you continue on your phone, as a number against that page and day. If the link that brought you carried a campaign tag (such as utm_source=newsletter), we count that tag too; it names the campaign, not you. We store no visitor identifier at all — not your IP address, not a hash of it, not a fingerprint — so there is nothing that could be joined up across visits even by accident. The price of that choice is ours to pay: we cannot tell how many people visit, only how many times a page was opened.
• No third-party requests. Fonts are served from our own domain, so no external provider sees your visit.
• The demo on the home page is a recording, not a conversation. It is a fixed script that plays out in your browser. There is nothing to type into it, nothing is sent anywhere when it runs, and it is not an AI answering you. Until 5 August 2026 that demo did send what you typed to our server to be answered; it no longer exists, and any messages sent to it have been deleted.
• The live demo answers what you type, and keeps it only for your visit. The live demo page lets you question a made-up shop. Tapping a preset question sends nothing. A question you type is sent to our server and to our AI model provider to write the answer, together with your earlier questions in the same visit. It is held only in the temporary session for your visit on our server and is not saved to any log or record; it is discarded when the session expires. To stop abuse we count questions per connection using a salted, one-way code of your IP address, never the address itself, and delete those counts after 48 hours. Please do not type personal details into it.
• The site stores nothing in your browser's local storage.

3.1 What happens when you send a form

The demo request on the home page is sent to our server. When you press "Send my number", your name, WhatsApp number and business name are transmitted to this website and written to a file on the same Malaysian server that hosts the site, and a copy is emailed to us. That is the whole journey — it is not passed to any marketing platform, advertising network or CRM. Until you press that button nothing is sent, and closing the page before then leaves no record of you.

If our server cannot be reached, the page instead offers to hand your details to WhatsApp with the message already written, for you to send yourself. In that case nothing is stored on this website at all, and the enquiry reaches us only if you choose to press send in WhatsApp.

The contact form is sent to our server. This changed on 21 August 2026; before that date it transmitted nothing at all. It has two steps. Pressing “Continue” at the first step sends nothing — it only reveals the rest of the form. When you press “Send my details”, what you have filled in is transmitted to this website and written to a file on the same Malaysian server that hosts the site, and a copy is emailed to us: your name and WhatsApp number, together with whichever of business name, email address, industry and message you chose to give. Those four are optional and the form works without them. It is not passed to any marketing platform, advertising network or CRM.

If our server cannot be reached, or does not confirm that your enquiry was stored, the page tells you your details are “ready to send” rather than received, and offers to hand them to WhatsApp or to your email program for you to send yourself. We do not tell you we have your enquiry unless it is on our server.

Both forms contain a field that is hidden from view. It exists only to catch automated spam — a submission that fills it in is discarded and never reaches us — and it is never shown to you or asked of you. If you reach it with assistive technology, leave it empty.

To stop either form being used to send bulk mail, our server counts how many requests come from an internet connection each hour and each day. That count is kept against a one-way scrambled form of the IP address, never the address itself, and it is deleted automatically within 48 hours.

How long we keep what you send is in section 8.

3.2 If you message our WhatsApp number

When you message +60 19-391 3891, we receive your WhatsApp number, the display name WhatsApp shows for you, what you write, and when you sent it.

An AI assistant writes the replies, and we will not pretend otherwise. It says so if you ask. A person can join the same conversation at any time and does so for anything the assistant should not decide alone — pricing outside our published plans, complaints, or anything it is unsure of. When a person is handling your conversation, the assistant stops replying.

To write a reply, the text of your message and the last few messages in the conversation are sent to our AI model provider, a third-party processor, which processes them on servers outside Malaysia and returns the reply. They process it on our instructions in order to answer you. Its terms for business customers state that content submitted this way is not used to train its models.

Voice notes. If you send a voice note, the recording is sent to our AI model provider to be turned into text, and the reply is written from that text. We do not keep the recording: it is fetched from WhatsApp, turned into text and discarded. The text is then handled like a typed message, as described in this section. If the text is unclear, the assistant does not guess; it passes your voice note to a person.

We keep two things, for different reasons and for different lengths of time:

• A short working memory — the last few messages, so that "and to Penang?" still makes sense. Held for 24 hours and deleted within 48.
• A record of the conversation — kept for 12 months, then deleted automatically.

We also use these conversations to improve the assistant. We read them to find questions it answers badly, facts missing from the information it works from, and mistakes worth correcting — and we use them to improve the instructions it follows and the information it works from. Nothing you send is used to train an AI model — not ours, because we do not train one, and not our AI model provider's, whose terms are described above. This is a separate purpose from answering your message, which is why it is stated here rather than assumed. We do not sell them, share them, or publish them.

WhatsApp itself is operated by Meta Platforms, on infrastructure outside Malaysia, under their own terms and privacy policy. Messages are encrypted in transit by WhatsApp; once delivered to us they are handled as described above.

Please do not send sensitive personal data through WhatsApp — identity-card details, payment card numbers, health information or anything of that kind. We do not ask for them and do not need them to answer an enquiry.

You can ask us to delete your conversation at any time — section 9.

3.3 If you subscribe

The subscribe form is sent to our server. When you continue to payment, your business name, your name, your email address and your WhatsApp number are written to a file on the same Malaysian server that hosts this site, together with a record of the date you accepted our terms and which versions of them were in force. A copy is emailed to us.

We never see your banking or card details. Payment is handled entirely by Billplz, a Malaysian payment gateway, on their own pages. We receive only confirmation that a bill was paid, the amount, and the email address and number you gave them. We name them here rather than describing them by function, unlike our hosting and email suppliers, because they are a regulated payment institution you transact with directly and we could not change them without telling you.

If you start a subscription and do not pay, we keep what you entered so that we can follow it up, on the same footing as any other enquiry. You can ask us to delete it at any time — section 9.

Server logs

Our web hosting provider — a commercial hosting company whose servers are located in Malaysia — automatically records standard technical information when a page is requested — IP address, browser type, page requested, and timestamp. This is generated by the hosting infrastructure rather than collected by us, is used only for security and reliability, and is retained for 30 days.

4. Why we process it, and our lawful basis

We process the data you send us to respond to your enquiry, arrange and run a demonstration, prepare a quotation, and — if you become a customer — to set up and support your account.

Our basis is your consent, given when you choose to send us your details. You are not obliged to provide anything. If you do not provide a name and a contactable number, we cannot arrange a demo, since we would have no way to reach you.

We will not use your details for unrelated marketing without asking you separately, and we do not sell or rent personal data to anyone.

5. Who we disclose it to

We may disclose your personal data to:

• The messaging channel you chose. If you send your enquiry by WhatsApp, it is transmitted through WhatsApp, operated by Meta Platforms, and is subject to their terms and privacy policy. If you send it by email, it passes through your own email provider and ours.
• Our web hosting provider — a commercial hosting company, on whose Malaysian server this website runs and on which a demo request is stored. They process data on our instructions and are bound to keep it confidential.
• Our email provider — the email service that carries the copies of demo requests and subscription notices that are sent to us.
• Billplz, the Malaysian payment gateway that collects subscription payments, as described in section 3.3. They receive the name, email address and number you enter at checkout, and your payment details go to them and not to us.
• Our AI model provider (we will name it on written request), which receives the text of WhatsApp messages, voice notes sent to our WhatsApp number (to turn them into text), and questions typed into the live demo, in order to generate the assistant's reply, as described in section 3.2. It receives your message, not your name or your number.
• Authorities, where disclosure is required by Malaysian law or a valid legal order.

That is the complete list. We use no form-handling service, no CRM, no marketing platform and no advertising network, and we do not sell or rent personal data to anyone.

Our hosting and email suppliers are described by what they do rather than named, because we may change supplier without any change to how your data is handled. If you would like to know who they are at any given time, write to hello@jawabkan.com and we will tell you.

6. Transfers outside Malaysia

The server that runs this website, and on which a demo request is stored, is located in Malaysia.

Three things do leave it, and you should know which:

• Email. A copy of each demo request is sent to us by email, and email providers routinely operate servers outside Malaysia.
• WhatsApp. Messages are carried by Meta Platforms on infrastructure outside Malaysia.
• The AI model. The text of a WhatsApp message, or of a question typed into the live demo, is sent to our AI model provider, outside Malaysia, to generate the reply. This is unavoidable for the service to work at all, which is why it is stated plainly rather than buried.

Where personal data is transferred abroad in this way, we take reasonable steps to ensure it receives protection comparable to that required under the Act, including contractual safeguards with the provider. By choosing to send us your details, or to message our WhatsApp number, you consent to that transfer, as section 129 of the Act contemplates.

7. How we keep it safe

We apply practical safeguards appropriate to a small operation: access limited to people who need it, accounts protected by strong authentication, encryption in transit, and prompt deletion of data we no longer need. No system is perfectly secure, and we do not claim otherwise.

If a breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner, and affected individuals, as required under the Act.

8. How long we keep it

• Enquiries that do not become customers — 12 months from your last contact with us, then deleted. This covers the copy stored on our server, the copy in our email, and any notes we made while following it up.
• Started subscriptions that were never paid — 12 months from when you started one, then deleted, on the same basis as any other enquiry.
• Customer records — for the life of the account and 7 years afterwards, where needed for tax and accounting obligations.
• WhatsApp conversations — the working memory for 24 hours, deleted within 48; the conversation record for 12 months, then deleted automatically.
• Server logs — 30 days.
• The anti-spam counters described in section 3.1 — they stop being used after 48 hours and are deleted automatically thereafter. They hold no name or number, and the IP address in them is scrambled beyond recovery.

You can ask us to delete your details sooner, and we will unless we are required by law to keep them.

9. Your rights

Under the Act you may:

• Access the personal data we hold about you, and be told how it is being processed.
• Correct data that is inaccurate, incomplete or out of date.
• Withdraw consent at any time, after which we stop processing and delete your details unless we must keep them by law.
• Limit processing, including asking us not to contact you for direct marketing.
• Request portability — that we transmit your data to another data controller, where technically feasible.

To exercise any of these, email hello@jawabkan.com. We will respond within the period the Act allows. We may ask you to confirm your identity first, so that we do not disclose your data to someone else. A fee may apply to a data access request, as permitted by the Act.

10. Children

This site is intended for business owners and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.

11. Changes to this notice

If we change how we handle personal data we will update this page and the version and date above. Material changes affecting existing enquiries or customers will be communicated directly.

12. Complaints

If you are unhappy with how we have handled your personal data, please raise it with us first at hello@jawabkan.com — most issues are resolved quickly.

You also have the right to complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia.

13. Language

This notice is published in English and Bahasa Malaysia, as required by section 7(3) of the Act. In the event of any inconsistency, the Bahasa Malaysia version prevails.