Privacy Policy

1. Who we are

TapBrig is operated by Reach & Bridge Sdn Bhd, a company registered in Malaysia. We build AI-powered customer engagement tools for small and medium businesses across Southeast Asia. This policy explains what we do with your personal data when you visit tapbrig.com or use our product at app.tapbrig.com.

We take this seriously. We'd rather collect a little and explain it clearly than collect a lot and bury it in legalese.

2. What information we collect

We collect data you give us directly, data generated as you use the service, and data from third-party providers (like payment processors).

• Account info — your name, work email, company name, role, and password hash.
• Usage data — IP address, browser type, device info, pages viewed, and feature usage.
• Customer messages — content sent through TapBrig (chats, WhatsApp messages, card taps) that may be processed by our AI to generate responses.
• Payment data — card details are handled by our payment processor (Stripe); we only store the last four digits and billing metadata.
• Support data — messages you send us when you ask for help.

3. How we use your data

We use your data to run TapBrig and make it better. Specifically:

• To provide, maintain, and operate the service.
• To improve AI quality through aggregated and de-identified analysis (we do not train foundation models on your raw customer data).
• To bill you and manage your subscription.
• To protect against fraud, abuse, and security threats.
• To communicate product updates and respond to support.
• To comply with Malaysian and Singaporean law.

4. Legal basis (PDPA)

Under the Malaysia Personal Data Protection Act 2010 and the Singapore Personal Data Protection Act 2012, we process data on the following grounds:

• Consent — given when you sign up and accept this policy.
• Contractual necessity — to deliver the service you've paid for.
• Legitimate interest — for security, fraud prevention, and product improvement.
• Legal obligation — when required by law or a valid court order.

5. Sharing with third parties

We do not sell your personal data. We share it only with vendors that help us run TapBrig, under contracts that require them to protect it.

• Cloud hosting — Amazon Web Services (AWS), region ap-southeast-1 (Singapore).
• AI providers — Anthropic and OpenAI for language model inference.
• Payments — Stripe for subscription billing.
• Analytics — Vercel Analytics for anonymized site usage.
• Customer support tools — for managing tickets and conversations with you.

6. International data transfers

Our primary data residency is Singapore (AWS ap-southeast-1). Some processors (e.g. AI providers) may transfer data outside Malaysia and Singapore. When we do this, we rely on contractual safeguards and only transfer what's necessary to deliver the service.

7. Data retention

We keep your account data while your account is active. After cancellation, we retain it for 90 daysso you can recover or export it, then delete it from production systems. Backups are purged on a rolling schedule. Aggregated or de-identified data (which can't be linked back to you) may be kept longer for analytics.

8. Your rights

Under PDPA, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Withdraw consent (which may end your ability to use the service).
• Request deletion of your account and data.
• Lodge a complaint with the relevant data protection authority.

To exercise any of these, email hello@tapbrig.com. We'll respond within 30 days.

9. Security

We protect your data with encryption in transit (TLS 1.2+) and at rest (AES-256), strict access controls, audit logging, and regular security reviews. No system is perfectly secure, but we take reasonable steps to minimize risk and we'll tell you promptly if a breach affects your data.

10. Children's privacy

TapBrig is a business tool and is not intended for users under 18. We don't knowingly collect data from children. If you believe a minor has provided us data, contact us and we'll remove it.

11. Changes to this policy

We may update this policy as the product evolves or the law changes. When we do, we'll update the "Last updated" date above and, for material changes, notify you via email or an in-app banner before the change takes effect.

12. Contact

For privacy questions, contact our Data Protection Officer at hello@tapbrig.com. Postal address: Reach & Bridge Sdn Bhd, Malaysia (full address available on request).