Last Updated: March 19, 2026

1. Overview and PDPA Compliance

Baba Group Sdn. Bhd. ("we", "us", or "our") operates BobWork AI and is committed to protecting your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). This Privacy Policy explains what data we collect, how we use it, and your rights as a data subject.

By using BobWork AI, you consent to the collection and processing of your personal data as described in this Policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect the following categories of data:

Account Information

Name, email address, company name, phone number, and billing details provided during registration.

WhatsApp & Messaging Integration Data

WhatsApp Business API credentials and access tokens provided through ChatDaddy or Meta's WhatsApp Cloud API. Conversation histories processed to train your AI agent. Contact information of your end-customers as shared through the integration.

Knowledge Base Content

Documents, URLs, and text data you upload to train your AI agent. This may include product catalogues, FAQs, and business information.

Usage and Analytics Data

Platform interactions, feature usage, AI credit consumption, session data, IP addresses, browser type, and device identifiers.

End-Customer Conversation Data

Messages exchanged between your AI agent and your customers. You, as the Subscriber, are the data controller for your end-customers' data. You are responsible for obtaining appropriate consent from your end-customers.

3. How We Use Your Information

We process your data for the following purposes:

Service Delivery: Providing, operating, and improving the BobWork AI platform and AI agent functionality.
AI Training: Using your knowledge base content and conversation style data to personalise your AI agent's responses. We do not use your data to train shared AI models without explicit consent.
Billing and Payments: Processing subscriptions and credit usage via Stripe.
Communications: Sending service updates, security alerts, and support responses.
Legal Compliance: Complying with applicable Malaysian law, including the PDPA, and responding to lawful government requests.
Analytics: Understanding platform usage to improve features and performance.

4. Data Storage and Security

Your data is stored on Amazon Web Services (AWS) infrastructure in the Asia Pacific (Singapore) region (ap-southeast-1). We implement the following security measures:

Encryption in transit using TLS 1.2 or higher for all data transmission.
Encryption at rest for database storage.
Access controls limiting employee access to data on a need-to-know basis.
Regular security reviews and vulnerability assessments.

While we implement industry-standard safeguards, no method of electronic transmission or storage is 100% secure. In the event of a data breach affecting your personal data, we will notify affected parties in accordance with the PDPA and applicable regulations.

5. Third-Party Services and Data Sharing

We share your data with third parties only as necessary to deliver the Service:

Provider	Purpose	Location
OpenAI	AI response generation	USA
Stripe	Payment processing	USA / Singapore
AWS (Amazon)	Cloud infrastructure and database	Singapore
ChatDaddy	WhatsApp Business API gateway	Singapore
Meta (WhatsApp / Instagram)	Messaging channel delivery	USA / Global

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Data Retention

We retain personal data only as long as necessary:

Account data: Retained for the duration of your subscription and for 12 months after termination for legal and business continuity purposes.
Conversation logs: Retained for up to 12 months. Subscribers may request earlier deletion.
Billing records: Retained for 7 years in compliance with Malaysian accounting and tax regulations.
Knowledge base content: Deleted upon your request or within 30 days of account termination.

7. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights:

Right of Access

Request a copy of the personal data we hold about you.

Right of Correction

Request correction of inaccurate or incomplete personal data.

Right to Withdraw Consent

Withdraw consent to processing where processing is based on consent.

Right to Prevent Processing

Object to processing that causes damage or distress.

Right to Data Portability

Request your data in a structured, machine-readable format.

Right to Erasure

Request deletion of your personal data, subject to legal retention obligations.

To exercise any of these rights, contact our Data Protection Officer at privacy@bobchat.ai. We will respond within 21 days.

8. Cookies and Tracking

We use cookies and similar tracking technologies to operate the Service and analyse usage. This includes:

Strictly necessary cookies: Required for authentication and session management.
Analytics cookies: Help us understand how users interact with the platform.
Preference cookies: Remember your language and UI settings.

For full details, see our Cookie Policy.

9. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please contact us immediately and we will take steps to delete the information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice within the platform at least 14 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

11. Contact and Data Protection Officer

For privacy-related queries, to exercise your PDPA rights, or to report a concern, contact our Data Protection Officer at: privacy@bobchat.ai or write to us at: Baba Group Sdn. Bhd., Kuala Lumpur, Malaysia.