Privacy Policy

Last updated: 7 September 2026

Summary: We collect what is needed to run the service and to carry messages between a business and its customers. We do not sell personal data and we do not use message content for advertising. To have your data deleted, email admin@modusaiassociates.com — see Delete your data.

1. Who we are

Modus AI Associates (business registration no. 202403281139 / 003660934-V, registered under the Registration of Businesses Act 1956, Malaysia), 25, Jalan TK2/19, Taman Kinrara, Seksyen 2, 47180 Puchong, Selangor — “Modus”, “we”. We operate M-EasyDo AI+ (“the Service”) at m-easydo-ai-production.up.railway.app.

We are the data controller for the account data of businesses that use the Service, and a data processor for the customer conversations those businesses conduct through it. Contact: admin@modusaiassociates.com.

2. Who this policy covers

Operators — businesses that create an account on the Service.
Staff — team members an Operator invites into their workspace.
Customers — people who message an Operator through WhatsApp, Facebook Messenger, Instagram, Telegram, LINE, SMS, email or a booking page.

Customers' data is processed on the Operator's behalf and under the Operator's instructions. If you are a Customer and want your data removed, you may contact either the business you were messaging or us directly — see section 9.

3. Information we collect from Operators

Name and email address from registration; name, email address and profile photo where Google sign-in is used.
Company name, team members and their roles.
CRM records the Operator enters: contacts, leads, accounts, opportunities, tasks, notes and activities.
Email marketing lists, campaigns and consent records.
Booking hosts, availability and appointments.
Documents an Operator uploads for extraction, and the records created from them.
Account settings.

What we do not keep. The Service stores no access log of its own — your IP address and browser details are not written to its database. Our hosting provider produces ordinary server request logs, which we can read while operating and securing the Service.

4. Information we receive from Meta platforms

For each Meta channel the Service is connected to — WhatsApp Business, Facebook Messenger or Instagram — we receive through Meta's APIs and webhooks:

The Customer's phone number or platform-scoped ID, and their display name.
The content of messages sent to and from the connected account, including media the Customer sends.
Message status events (sent, delivered, read) and timestamps.
The WhatsApp Business Account ID, phone number ID and approved message templates for the connected number.

We do not receive Customers' contact lists, location, profile data beyond a display name, or any data outside the conversation with that account. Our use of information received from Meta APIs complies with Meta's Platform Terms and Developer Policies, including the WhatsApp Business Terms of Service.

Channel credentials are held as sealed environment variables on our hosting platform and are configured by Modus for each deployment of the Service. They are not stored in the application database.

5. How we use it

To deliver messages to and from the Operator's inbox.
To let the Operator's AI assistant (“Asha”) reply, follow up and book appointments on the Operator's behalf, subject to the Operator's settings.
To link conversations to the Operator's CRM records.
To send booking confirmations, reminders and service notifications.
To produce analytics for the Operator about the Operator's own data.
To secure and operate the Service and to meet legal obligations.

We do not sell personal data. We do not use Customers' message content for advertising, and the Service carries no advertising or tracking cookies.

6. Automated processing and AI

Message content, CRM context and uploaded document text may be sent to a third-party large-language-model provider to generate replies, summaries and field suggestions. This deployment uses DeepSeek (deepseek-v4-flash, api.deepseek.com); Groq is the alternative provider the Service supports, selected by deployment configuration.

We state what each provider actually promises, because they differ. Groq's published terms say it does not train on customer inputs or outputs and does not retain them by default. DeepSeek makes no equivalent commitment: its privacy policy (last updated 10 February 2026) says it processes and stores personal data in the People's Republic of China and may use data to train and improve its models, while offering a right to opt out of that use. If this matters to you as an Operator, tell us and we will say which provider your deployment is running and what we have opted out of.

Asha is instructed to identify itself as an AI assistant and never to impersonate a human when asked directly, and a Customer can always reach a person at the Operator's business without going through the AI. Appointment times and other figures Asha presents are read from the Operator's own calendar and CRM records, not written by the model.

7. Who we share data with

Meta Platforms — to deliver WhatsApp, Messenger and Instagram messages.
The AI provider named in section 6 — DeepSeek, or Groq where a deployment is configured for it.
Railway — application hosting and the PostgreSQL database. This deployment runs in Railway's us-east4 region in the United States, so personal data is transferred outside Malaysia.
Resend — transactional and marketing email delivery.
Twilio — SMS delivery and inbound SMS.
Google — sign-in only; we request name, email address and profile photo, and no access to Gmail, Drive or any other Google service.
Telegram and LINE — where the Operator's deployment is connected to those channels.
iPay88 — payment processing, where subscription billing is enabled.

Each processes data only to provide its service to us. We disclose data otherwise only where Malaysian law or a lawful request requires it.

8. Retention

Conversations, messages, CRM records and uploaded documents are kept for as long as the Operator's account is active. The Service runs no automatic pruning or expiry job — nothing is deleted on a timer, including message status events. An Operator can delete an individual conversation from the inbox at any time, which removes that conversation and its messages immediately.

When an account is deleted (section 9), the account and everything belonging to it — conversations, messages, CRM records, bookings and documents — is removed from the live database within 30 days. Database backups are operated by our hosting provider, Railway, on its own schedule; we do not run a separate backup copy of our own, and we cannot selectively edit a provider backup.

9. Delete your data

Operators. Email admin@modusaiassociates.com from the email address on the account. We delete the account and all of its data within 30 days and confirm by reply. The Delete account control in Settings is not connected to a deletion endpoint today, so it does not complete this; the request is handled by us, by email. We would rather say so than point you at a control that does not finish the job.

Customers. Ask the business you were messaging, or email admin@modusaiassociates.com with the phone number or platform ID you used. We will delete the conversation data held for you under that Operator within 30 days and confirm by reply.

Meta data-deletion requests. Requests that reach us through Meta's data-deletion route are honoured on the same terms and within the same 30 days.

Marketing opt-out. Replying STOP (or berhenti, or 停止) to a WhatsApp message from an Operator withdraws your consent immediately and removes you from every marketing audience that Operator can build.

10. Your rights under the PDPA 2010

Under Malaysia's Personal Data Protection Act 2010 you may request access to your personal data, ask us to correct it, withdraw consent, limit how it is processed, and complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi). Exercise any of these by emailing admin@modusaiassociates.com.

Operators can export their CRM records from the app at any time. A bulk archive of an entire workspace is not automated today; ask us and we will produce it.

11. Security

HTTPS/TLS for all data in transit.
Signature verification on inbound webhooks — Meta's X-Hub-Signature-256 for WhatsApp, Messenger and Instagram, Twilio's signature for SMS, and a shared secret for Telegram. A request that fails verification is rejected before it reaches any handler.
Server-side sessions with an HTTP-only session cookie.
Role-based access within a workspace, and every query scoped to the owning account.
Parameterised database queries throughout.
Channel and provider credentials held as sealed environment variables on the hosting platform, never in the application database and never in the browser.

12. Cookies

One session cookie, measyddo.sid, which keeps you signed in and is essential to the Service. Your theme and language preferences are kept in your browser's local storage. We use no advertising, analytics or tracking cookies.

13. Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18, and we delete the data of a minor on notice.

14. Changes to this policy

We may update this policy. Material changes are notified to Operators by email and are reflected in the date at the top of this page.