1. Scope
This Privacy Policy applies to the Terasetia website, web application, APIs and related services (collectively, the “Service”). By using the Service, you acknowledge that you have read this policy.
If you use Terasetia on behalf of a business, you represent that you have authority to bind that organisation and that end-customer data you upload is handled in accordance with applicable law and your own privacy notices.
2. Data we collect
We may collect the following categories of information:
- Account data — name, email address, organisation name, role and authentication credentials
- Billing data — subscription plan, payment references and transaction history (payment card details are processed by our payment provider, not stored by us)
- Usage data — logins, feature usage, IP address, browser type, device identifiers and audit events
- Messaging data — WhatsApp phone numbers, message content, delivery status, templates, campaign metadata and inbox history that you or your team create through the Service
- Contact data — CRM records, labels, pipeline stages and custom fields you store about your customers
- TeraAI-related data — chatbot configuration, knowledge base content, conversation context processed for automated replies (subject to your privacy mode settings)
- Support communications — emails or messages you send to our support team
3. How we use data
We use personal data to:
- Provide, operate and improve the Service
- Authenticate users and enforce account security
- Process subscriptions, wallet top-ups and billing
- Send service-related notifications (e.g. invites, security alerts, billing receipts)
- Enable WhatsApp messaging through our infrastructure partner (AiSensy) and in accordance with Meta policies
- Power AI chatbot features when enabled by your organisation
- Monitor abuse, fraud and compliance with our Terms of Service
- Respond to support requests and legal obligations
We do not sell your personal data. We do not use your end-customer message content for unrelated advertising purposes.
4. Legal bases (where applicable)
Depending on your jurisdiction, we process personal data on one or more of the following grounds:
- Contract — to deliver the Service you signed up for
- Legitimate interests — security, product improvement and fraud prevention, balanced against your rights
- Consent — where required for marketing communications or certain optional features
- Legal obligation — where we must retain or disclose data to comply with law
For users in Malaysia, we aim to handle personal data in line with the Personal Data Protection Act 2010 (PDPA), including providing notice and honouring access and correction requests where applicable.
6. Retention
We retain data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes and enforce agreements.
Message and contact data retention may be influenced by your organisation's settings (for example, chatbot privacy mode limits how long conversation content is stored for AI memory). When you delete data or close an account, we will delete or anonymise it within a reasonable period, except where retention is required by law or legitimate business needs (such as billing records).
7. Security
We implement administrative, technical and organisational measures designed to protect personal data, including access controls, encrypted transport (HTTPS), session management and audit logging for sensitive admin actions.
No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for configuring team access appropriately within your organisation.
8. Your rights
Depending on applicable law, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of data, subject to legal exceptions
- Object to or restrict certain processing
- Withdraw consent where processing is consent-based
- Lodge a complaint with a relevant data protection authority
To exercise these rights, email privacy@terasetia.com. We may need to verify your identity before responding.
10. International transfers
Your data may be processed outside Malaysia. We rely on the following subprocessors whose infrastructure is located in other countries:
- Moonshot AI — People's Republic of China. Conversation context (message content, contact names and voice notes) processed by TeraAI (powered by Kimi) for automated replies.
- AiSensy — India. WhatsApp message delivery and webhooks.
- Resend — United States. Transactional email delivery.
- Cloud hosting infrastructure — servers may be located in Singapore or other regions.
For users in Malaysia, we rely on contractual safeguards (data processing agreements) with these subprocessors to ensure an adequate level of protection for personal data transferred outside Malaysia, consistent with the requirements of the Personal Data Protection Act 2010 (PDPA). You may opt out of AI processing by disabling TeraAI in your chatbot settings, which stops conversation data from being sent to Moonshot AI.
11. Children
The Service is intended for businesses and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have done so, contact us and we will promptly delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated “Last updated” date. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
For significant changes, we may also notify account owners by email or in-app notice where appropriate.
13. Contact
Privacy enquiries: privacy@terasetia.com. General support: support@terasetia.com. See also our Terms of Service.