Privacy Policy

Cozee is a product of Choozi Tech, a sole proprietorship registered with Suruhanjaya Syarikat Malaysia (SSM). This Privacy Policy explains what personal data we collect when you use our AI receptionist and booking-calendar service, and how we use it. It covers both your own account data as the business owner and the conversation and booking data of customers who contact your business through Cozee. Cozee handles personal data in accordance with applicable data protection and privacy laws.

Your account email and password (handled by our authentication provider, which stores the password in hashed form — we never see it), your business profile (name, category, address, timezone and currency), your knowledge base content (services, prices, policies, FAQs and opening hours), your bookable resources and staff names, connected calendar details, and the mobile number you set up to receive booking notifications. We also keep operational records needed to run the Service securely: sign-in and password-reset activity linked to your email address (including failed attempts, to detect misuse), a count of AI generations and messages used against your plan, and records of notifications we sent on your behalf.

Customers reach your business through the hosted chat page Cozee gives you (a link you share, not a public directory). Cozee stores the conversation — their messages and our replies — and any booking details they provide, such as name, contact number and what they are requesting, so you can see and act on it in your dashboard and calendar. Cozee processes this conversation data on behalf of the business using Cozee, to provide the Service, respond to enquiries, process bookings, and carry out the actions the business or its customer has requested. Where a customer explicitly opts in, we also use the contact number they give to send them transactional booking notifications on WhatsApp; they can decline and still complete a booking.

If you use Cozee to communicate with your own customers, you're responsible for providing them with appropriate privacy notices and obtaining any consent, or otherwise establishing a lawful basis, required to process their personal data under the laws that apply to your business. Where applicable, Cozee processes your customers' conversation data according to your instructions as the business using the Service.

We process your account data to provide the Service you signed up for, your customers' conversation data on your instructions and to operate the Service on your behalf, and billing data to meet our own financial record-keeping obligations. Where consent is the applicable basis for a particular use — for example, marketing communications — you can withdraw it at any time by contacting us.

Cozee sends conversation content to a third-party AI provider to generate automated replies. That provider is currently DeepSeek, a company based in China, which means conversation content — including anything a customer types into the chat — is transmitted to and processed on infrastructure in China. We constrain the AI to discussing only the information in your own knowledge base, and we do not send it your billing details or your account password. If we change AI provider, we will update this policy. See Section 10 (International data transfers).

Cozee uses artificial intelligence to generate automated responses to customer messages. These responses may occasionally be inaccurate or incomplete. Businesses using Cozee are responsible for configuring their knowledge base and instructions appropriately, and Cozee should not be relied on as a substitute for professional, medical, legal, or safety-critical advice.

Billing is handled by Stripe. Cozee never sees or stores your card details — Stripe processes payments directly and we only receive confirmation of your subscription status.

We don't sell your data or your customers' data, and we don't use it to train AI models of our own. We share information only with the service providers necessary to operate Cozee: Vercel (application hosting — all requests pass through it), Supabase (database and authentication), DeepSeek (AI-generated replies), Meta's WhatsApp Business Platform (transactional notification delivery), Google or Microsoft where you choose to connect a calendar, and Stripe (billing). Each is bound by its own data protection terms. We may also disclose data where we are legally required to, or where necessary to establish, exercise or defend legal claims.

Cozee is operated from Malaysia, but personal data is stored and processed outside Malaysia. Specifically: your account, business, conversation and booking data is stored in Japan (our database and application hosting both run in the Tokyo region); conversation content is sent to China for AI reply generation (see Section 6); and our billing, authentication, calendar and WhatsApp notification providers may process data in the United States, the European Union or elsewhere, depending on the provider. Where personal data is transferred out of Malaysia we take reasonable steps to ensure it continues to receive an appropriate level of protection, including relying on the provider's own contractual data protection terms. If you are not comfortable with conversation content being processed in China, do not use Cozee to handle that information, and tell your own customers accordingly.

We retain personal data only for as long as reasonably necessary to provide the Service, maintain your account, comply with our legal obligations, resolve disputes, enforce our agreements, and protect against fraud and abuse. Conversation and booking records are kept while your account is open so you retain your own business history. When your account is closed we delete or anonymise your data within a reasonable period, except where we are required or permitted to keep it longer — billing and tax records, for example, are kept for the period required by Malaysian law, and security logs are kept for a limited period to investigate misuse.

Under Malaysian data protection law you have the right to ask for access to the personal data we hold about you, to have inaccurate data corrected, to withdraw a consent you previously gave, and to ask us to limit processing for direct marketing. Depending on where your business is based, local law may give you further rights. You can review and update much of your business data — your profile, knowledge base, resources and notification settings — directly from your dashboard at any time. For anything else, including a copy of your data, correction of other records, or closure of your account, contact us at hey.cozee.online@gmail.com. We will respond as soon as practicable and in any event within the period required by applicable law, subject to the retention obligations in Section 11. If you are unhappy with how we handle a request, you may complain to the Personal Data Protection Commissioner in Malaysia.

Individuals who message a business using Cozee may have rights under the privacy laws that apply to them, such as the right to access or request correction of their personal data. Requests relating to a business's customer data should generally be directed to that business, since they collected the data and are best placed to handle it — Cozee will assist the business where appropriate.

We use reasonable technical and organisational measures — including encrypted connections and access controls that restrict data to the account it belongs to — to help protect personal data against unauthorised access, loss, misuse, or disclosure. No method of transmission or storage over the internet is completely secure, and we can't guarantee absolute security.

If a personal data breach occurs, we will assess, contain, investigate and remediate it. Where the breach causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner in Malaysia as soon as practicable and within 72 hours of becoming aware of it, and notify affected individuals without unnecessary delay and within seven days of notifying the Commissioner, as required by the Personal Data Protection Act 2010 (as amended). Where a breach affects your customers' data, we will inform you so you can meet your own notification obligations to them.

Cozee is intended for use by businesses and their adult representatives, and is not directed at children. Businesses using Cozee remain responsible for complying with any applicable requirements concerning the personal data of children who may contact them.

Cozee uses a small number of strictly necessary technologies, and no advertising or cross-site tracking cookies. When you sign in, our authentication provider sets cookies that keep you logged in; these are required for the dashboard to work. We also store your language choice in a cookie so the site stays in the language you picked. On the hosted chat page, a randomly generated session identifier is saved in the visitor's own browser storage so that returning to the link continues their conversation instead of starting a new one. That identifier is not linked to any advertising profile and does not identify the visitor to anyone other than the business they contacted. Clearing browser storage for the site ends that chat session and signs you out.

Some categories of personal data — including information about physical or mental health, religious beliefs, political opinions, and the commission of an offence — are treated as sensitive personal data under Malaysian law and generally require the individual's explicit consent to process. Cozee is not designed as a system of record for sensitive personal data, and we ask you not to put it into your knowledge base. If your business is of a kind where customers may volunteer such information in a message — a clinic or dental practice, for example — you are responsible for obtaining the explicit consent required and for telling those customers, before they share anything, that their message is handled by an AI service and processed outside Malaysia, including in China (see Sections 6 and 10). If that is not acceptable for your customers, use Cozee for general enquiries and bookings only, and take the clinical conversation offline.

If we make material changes to this Privacy Policy, we'll notify account owners by email or in the dashboard before they take effect.

Questions about this policy, or requests to exercise your data protection rights? Reach us at hey.cozee.online@gmail.com.