Chatolla
Privacy Policy
1. Who we are
KC SERVICES SDN. BHD. (Registration No. 202501058827 (1660233-W)), Unit 33-05 Menara Ecoworld, Bukit Bintang City Centre, No. 2, Jalan Hang Tuah, 55100 Kuala Lumpur, Wilayah Persekutuan, Malaysia ("Chatolla", "we", "us"), provides the Chatolla customer messaging platform to businesses ("Customers"). You can reach us at support@chatolla.com.
2. Our two roles
Controller. We decide how we use personal data about the people who use our platform on behalf of a Customer (the Customer's team members), about people who visit this website, and about our dealings with Customers.
Processor. When a Customer's own contacts (its "end users") chat with the Customer through Chatolla, the Customer decides why and how that conversation data is used. We process it only on the Customer's instructions to provide the service. End users should read the Customer's own privacy notice and send requests about their conversations to the Customer first.
3. Personal data we process
| Category | Examples | Comes from |
|---|---|---|
| Team member account | Name, username, avatar, role, multi-factor sign-in settings | The team member or the Customer's administrator |
| Sign-in sessions | IP address, browser type, device identifier, session times | Generated when a team member signs in |
| Conversations | Message text, attachments and media, voice messages and their transcripts, time sent, delivery status | End users and the Customer's agents |
| End-user profile | Name, username or phone number, tags, custom fields | The Customer, the end user, or the messaging channel |
| Connected-channel data | Identifiers of a connected channel (for WhatsApp: WhatsApp Business Account ID, phone number ID, display phone number), message template names and approval status, number quality and messaging limits, and the credentials needed to operate the channel for the Customer | The channel provider (for WhatsApp, Meta) after the Customer authorises the connection |
| AI outputs | Conversation summaries, suggested tags, AI-drafted replies | Generated from the conversation |
| Website visits | Standard request logs kept by our hosting provider: IP address, browser type, time of request | Your browser |
4. Why we use it
- to provide, operate and support the platform, including delivering and storing conversations;
- to keep the platform secure, detect abuse and keep audit records of administrative actions;
- to run the AI features a Customer chooses to use (section 5);
- to communicate with Customers about their account and the service;
- to meet our legal obligations.
We rely on our agreement with the Customer, the Customer's instructions (where we act as processor), our legal obligations, and consent where the law requires it.
We do not sell personal data. We do not use Customer conversation content to train AI models. We do not use data received from Meta for advertising.
5. AI features
If a Customer turns on AI features, the text (and, for voice messages, the audio) of the relevant conversation is sent to an AI provider listed in section 7 to produce conversation summaries, suggested customer tags, voice-message transcripts and knowledge-base replies. AI output is a suggestion for the Customer's team; the Customer is responsible for how it is used.
6. WhatsApp and Meta
When a Customer connects its WhatsApp Business Account to Chatolla, messages travel through Meta's WhatsApp Business Platform, and Meta handles them under its own terms and privacy policy. From Meta we receive the connected-channel data in section 3, the messages and media exchanged, delivery and read status, and the WhatsApp phone number and profile name of end users who message the Customer. We use this data only to provide the features the Customer asked for. The Customer can disconnect at any time (see Data Deletion).
7. Who else processes data for us
| Provider | What for | Location |
|---|---|---|
| Amazon Web Services | Hosting, database and file storage | Asia Pacific (Malaysia) |
| Vercel | Delivery of our web applications and this website | Global content delivery network |
| Cloudflare | DNS and traffic routing | Global |
| Meta Platforms (WhatsApp Business Platform) | Transport of WhatsApp messages for Customers who connect WhatsApp | Meta's data centres |
| Telegram | Transport of Telegram messages for Customers who connect a Telegram bot | Telegram's infrastructure |
| Groq | AI processing: conversation summaries, tag suggestions, voice-message transcription | Outside Malaysia, including the United States |
| OpenAI | AI processing for knowledge-base and assistant features | Outside Malaysia, including the United States |
Our staff access a Customer's data only as needed to run, secure and support the service.
8. Transfers outside Malaysia
Some providers above process data outside Malaysia. Where that happens we require them to protect the data to a standard that meets applicable law.
9. How long we keep data
A Customer can delete conversations and contacts in its workspace. After a Customer closes its workspace, we delete its conversation data and media within 30 days. Copies held in backups are removed when the backups expire, within a further 35 days. We keep records that the law requires us to keep, such as billing records, for as long as the law requires.
10. How we protect data
- Traffic between your browser and our services uses HTTPS.
- Each Customer's data is kept separate; team members see only their own workspace, according to the role assigned to them.
- Multi-factor sign-in is available for team members.
- Administrative actions are recorded in audit logs.
- Our database and the files stored in Amazon S3 are encrypted at rest.
- Multi-factor authentication secrets and the secrets of customer-configured integrations are encrypted before they are stored.
If a personal data breach affects a Customer's data, we will tell the Customer without undue delay.
11. Your rights
You may ask to access, correct or delete personal data we hold about you, or withdraw consent you have given. If you are an end user of a Customer, please contact that Customer first; we will help the Customer respond. To contact us directly, email support@chatolla.com or follow the steps on Data Deletion. You may also complain to the Personal Data Protection Commissioner of Malaysia.
12. Cookies
This website does not use cookies or analytics. The Chatolla web application sets one strictly necessary cookie to keep a team member signed in.
13. Children
Chatolla is a business service and is not directed at children under 18.
14. Changes to this policy
We will post any change on this page and update the date above. For material changes we will also notify Customers.