Privacy Policy
Last updated 23 August 2026
1. What this policy covers
This Privacy Policy explains what information Cozee collects when you use our AI receptionist service, and how we use it. It covers both your own account data and the WhatsApp conversation data of the customers who message your business. Cozee operates as a Malaysian company serving businesses across Malaysia, Singapore, and Southeast Asia, and this policy is written to meet the obligations of Malaysia's Personal Data Protection Act 2010 (PDPA) — our home jurisdiction's data protection law — alongside Singapore's Personal Data Protection Act (PDPA) for customers and businesses based there. Where you or your customers are located elsewhere (including the EU/EEA), we also apply the broader rights described in Section 10 as a general baseline.
2. Information we collect from you
Your account email and password (handled by our authentication provider), your business profile (name, category, hours, address), your knowledge base content (services, policies, FAQs), and your WhatsApp number if you set one up to receive booking notifications.
3. Information from your customers
When a customer messages your business's WhatsApp number, Cozee stores the conversation (their messages and our replies) and any booking details they share — name, contact number, and what they're requesting — so you can see and act on it in your dashboard. We don't use this data for anything beyond operating the Service for your business. Under the Singapore and Malaysia PDPA, your customer's act of messaging your WhatsApp Business number is treated as their consent to your business (and Cozee, acting as your data intermediary/processor) collecting and using that message to respond to them — you're responsible for making sure your own customer-facing communications don't misrepresent how their messages are handled.
4. Legal basis for processing
We process account data to perform our contract with you (running the Service you signed up for), customer conversation data on your instructions and for your business's legitimate interest in responding to its own customers, and billing data to comply with financial record-keeping obligations. Where consent is the applicable basis (for example, marketing communications), you can withdraw it at any time by contacting us.
5. How we use AI providers
Cozee sends conversation content to a third-party AI provider (currently DeepSeek) to generate replies. We don't send this data anywhere else, and we constrain the AI to only discuss information you've provided in your knowledge base.
6. Payment information
Billing is handled by Stripe. Cozee never sees or stores your card details — Stripe processes payments directly and we only receive confirmation of your subscription status.
7. International data transfers
Our infrastructure providers — including our database host, AI provider, messaging provider, and payment processor — may store or process data outside Singapore and Malaysia. Where we transfer personal data overseas, we take steps consistent with the PDPA's transfer-limitation obligations to ensure the receiving party is bound to a standard of protection comparable to the PDPA, whether by contract or by the provider's own certifications.
8. Data retention
We retain your account and conversation data for as long as your account is active. If you close your account, we delete your business data within a reasonable period, except where we're required to retain records for legal, tax, or accounting purposes. We don't keep personal data longer than is necessary for the purposes it was collected for, consistent with the PDPA's retention limitation obligation.
9. Data sharing
We don't sell your data or your customers' data. We share information only with the service providers necessary to run Cozee — Supabase (database and authentication), Twilio (WhatsApp delivery), DeepSeek (AI replies), and Stripe (billing) — each acting as our data intermediary/processor and bound by their own data protection terms.
10. Your rights
You can access, correct, export, or delete your business data from your dashboard at any time. You (and, where applicable, your customers) also have the right to: access a copy of personal data we hold, request correction of inaccurate data, withdraw previously given consent, and request deletion — subject to our legal retention obligations under Section 8. To request deletion of your account entirely, to exercise any of these rights, or to ask about the data we hold, contact us at hey.cozee.online@gmail.com.
11. Data breach notification
If a data breach occurs that's likely to result in significant harm to affected individuals, or that's of a significant scale, we'll notify Malaysia's Department of Personal Data Protection (and Singapore's Personal Data Protection Commission, where affected individuals are based there) and affected individuals as required by law, without undue delay.
12. Changes to this policy
If we make material changes to this Privacy Policy, we'll notify account owners by email or in the dashboard before they take effect.
13. Contact
Questions about this policy, or requests to exercise your data protection rights? Reach us at hey.cozee.online@gmail.com.