Privacy Policy

1. Who we are

TapBrig is operated by Reach & Bridge Sdn Bhd, a company registered in Malaysia. We build AI-powered customer engagement tools for small and medium businesses across Southeast Asia. This policy explains what we do with your personal data when you visit tapbrig.com or use our product at app.tapbrig.com.

Our office is at Level 5, Mercu 3, Jalan Bangsar, KL Eco City, Mid Valley City, 59200 Kuala Lumpur, Malaysia. We'd rather collect a little and explain it clearly than collect a lot and bury it in legalese.

2. What information we collect

We collect three kinds of data: what you give us directly, what is generated automatically as you use the service, and what we receive from third parties such as Meta's WhatsApp Business API.

Information you give us directly

• Account info — your name, work email, company name, role, password hash, and contact preferences.
• Business profile content — what you upload to train your AI: knowledge base articles, documents, FAQs, price lists, and your website URL.
• Payment data — card details are handled by our payment processor (Stripe); we only store the last four digits and billing metadata.
• Support data — messages you send when you ask for help or contact us.

Information collected automatically

• Usage data — IP address, browser type, device info, pages viewed, feature usage, and timestamps.
• Cookies — see our separate Cookies Policy.
• Diagnostic logs — error reports, AI inference latency, delivery status.

Information received from third parties

• WhatsApp Business API (Meta Platforms) — when a customer messages your business on WhatsApp, we receive the message content, the customer's WhatsApp phone number, their WhatsApp display name (if not hidden), optional profile photo, message timestamps, and conversation metadata.
• Website chat (WebChat widget) — when a visitor uses your embedded chat widget, we receive the message content, any contact details they choose to provide, IP-derived approximate location, and the page they were on.
• Name card (Cards) — when someone scans a TapBrig digital card, we receive their contact details if they fill the form, and minimal device metadata.
• Payment processor — transaction confirmations and dispute status from Stripe.

3. How we use your data

We use your data only for clearly defined purposes:

• To provide, maintain, and operate the TapBrig service.
• To process incoming customer messages through our AI and generate response suggestions or auto-replies.
• To route conversations to your team, store them in your inbox, and link them to your CRM contacts.
• To improve AI quality through aggregated and de-identified analysis. We do not train foundation models on your raw customer data.
• To bill you and manage your subscription.
• To protect against fraud, abuse, and security threats.
• To send product updates and respond to support tickets.
• To comply with Malaysian and Singaporean law.

4. Legal basis (PDPA)

Under the Malaysia Personal Data Protection Act 2010 and the Singapore Personal Data Protection Act 2012, we process data on the following grounds:

• Consent — given when you sign up and accept this policy, or when a customer initiates a conversation with your business.
• Contractual necessity — to deliver the service you've paid for.
• Legitimate interest — for security, fraud prevention, and product improvement.
• Legal obligation — when required by law or a valid court order.

5. WhatsApp Business API — our role and Meta's role

TapBrig integrates with the official WhatsApp Business Platform operated by Meta Platforms Ireland Limited. When your business uses WhatsApp through TapBrig, data flows between you, your customers, TapBrig, and Meta.

• You are the data controller for messages and contacts in your business account.
• TapBrig acts as your data processor — we store, route, and apply AI to your messages on your instruction.
• Meta is the underlying message-delivery provider and has its own privacy obligations under its WhatsApp Business Solution Terms and WhatsApp Privacy Policy.

We only request the minimum permissions needed to operate the WhatsApp Business integration: send and receive messages, manage business profile, and read delivery receipts. We do not access your personal WhatsApp account or your private contacts outside of conversations sent to your business number.

6. Sharing with third parties

We do not sell your personal data. We share it only with vendors that help us run TapBrig, under contracts that require them to protect it.

• Cloud hosting — Amazon Web Services (AWS), region ap-southeast-1 (Singapore).
• Messaging infrastructure — Meta Platforms Ireland Limited for WhatsApp Business API delivery.
• AI providers — Anthropic and OpenAI for language model inference. Data is sent under contractual data-processing terms and is not used to train their public models.
• Payments — Stripe for subscription billing.
• Analytics — Vercel Analytics for anonymized site usage.
• Customer support tools — for managing tickets and conversations with you.
• Legal — when required by court order, subpoena, or other lawful request, limited to what is strictly compelled.

7. International data transfers

Our primary data residency is Singapore (AWS ap-southeast-1). Some processors — including Meta, Anthropic, OpenAI, and Stripe — may process data outside Malaysia and Singapore. When this happens, we rely on contractual safeguards (standard contractual clauses or equivalent) and only transfer what is necessary to deliver the service.

8. Data retention

We keep your account data while your account is active. After cancellation, we retain it for 90 days so you can recover or export it, then delete it from production systems. Backups are purged on a rolling schedule (typically within 30 days of production deletion). Aggregated or de-identified data — which cannot be linked back to you — may be kept longer for analytics.

WhatsApp conversation content is retained as long as the conversation is active in your inbox, or until you explicitly delete it. You can configure shorter retention windows in your account settings.

9. Your rights and how to request data deletion

Under PDPA and applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Withdraw consent (which may end your ability to use the service).
• Request deletion of your account and data.
• Lodge a complaint with the relevant data protection authority — the Department of Personal Data Protection (Malaysia) or the Personal Data Protection Commission (Singapore).

How to request deletion of your data

To request deletion of any personal data we hold about you, including data we received via the WhatsApp Business API or any Meta service:

1. Email us at hello@tapbrig.com with the subject "Data deletion request", or use our contact form.
2. Include the email address or WhatsApp number associated with your data so we can identify the right records.
3. We will confirm receipt within 5 business days and complete the deletion within 30 days, unless we are legally required to retain certain records (in which case we will tell you which records we are keeping and why).

This deletion path is available to both account holders and any end customer whose data we may have processed.

10. Security

We protect your data with encryption in transit (TLS 1.2+) and at rest (AES-256), strict access controls, audit logging, and regular security reviews. No system is perfectly secure, but we take reasonable steps to minimize risk. If a breach affects your data, we will notify you and the relevant data protection authority within the timeframes required by law.

11. Children's privacy

TapBrig is a business tool and is not intended for users under 18. We do not knowingly collect data from children. If you believe a minor has provided us data, contact us and we will remove it.

12. Changes to this policy

We may update this policy as the product evolves or the law changes. When we do, we will update the "Last updated" date above and, for material changes, notify you via email or an in-app banner before the change takes effect.

13. Contact

For privacy questions or to exercise any rights described above, contact our Data Protection Officer at hello@tapbrig.com.

Postal address:
Reach & Bridge Sdn Bhd
Level 5, Mercu 3
Jalan Bangsar, KL Eco City
Mid Valley City, 59200 Kuala Lumpur
Malaysia