Welkai Privacy Policy

Version 1.0. Effective date: 1 November 2026.

This policy explains how VERTEX REALITY DIGITAL SOLUTION (SSM registration no. 202603285026 (003903877-X)), trading as Welkai ("we", "us"), handles personal data under the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA").

Contact: [email protected], phone or WhatsApp 011-6842 0290, address A-145, Taman Kok Doh, Jalan Segambut, 51200 Kuala Lumpur, Malaysia.
Data Protection Officer: Choo Kah Hoe, [email protected].

1. Two roles

1.1 We are the data controller for data about the businesses that use Welkai and their users: account, billing, support, security and website data, and data about referrers. Sections 2 to 4 cover this data.

1.2 We are the data processor for the data a business puts into Welkai about its own contacts and customers: contacts, chats, media, call and voice data, flows, appointments and form responses. The business is the data controller and decides why this data is used. We process it only on the business's instructions, under our Data Processing Agreement. If you are a contact of a business that uses Welkai, please contact that business first. Section 5 covers this data.

2. Personal data we collect as controller

Data	Examples	Where it comes from
Sign-up and account	name, business name, SSM number (if any), industry, website or page, intended use, expected volume, email, phone, how you heard about us, referral code and advertising source (for example `utm_source`)	you
Verification	phone one-time code results, checks against duplicate phone numbers, emails and business names	you, our systems
Users	names, emails, roles, login times, two-factor settings	you and your team
Billing	plan, invoices, receipts, payment status, payment reference, payer name; card details are handled by our payment gateway and we do not store full card numbers	you, CHIP
Agreement records	which version of each legal document was accepted, when, from which IP address and by whom	our systems
Support	messages and emails you send us, call notes	you
Usage and security	IP address, browser, device, logs of actions in the account (audit log), AI usage counts (feature, credits, tokens; not the text)	our systems
Referrals	who used your code, their business name and progress (signed up, on trial, subscribed, paid, claimed)	our systems
Website	the language you chose (stored only in your browser), and standard server logs (IP address, pages, time) kept by our web host	your browser
Pre-registration form	answers you give in our Google Form	you, through Google Forms

2.1 Obligatory or voluntary. Data marked as required on our forms is obligatory: without it we cannot approve your application, provide the Service or bill you. Other data is voluntary.

3. Why we use it, and on what basis

3.1 We use personal data for these purposes:

(a) checking sign-up applications and preventing fraud and abuse (for example one trial per business);
(b) providing, securing and supporting the Service;
(c) billing, receipts, collecting overdue payments and keeping accounting and tax records;
(d) running the referral programme;
(e) sending service messages (invites, password resets, alerts, invoices, renewal and overdue notices, notices of changes);
(f) improving the Service using usage counts and feedback;
(g) meeting legal duties and responding to lawful requests from authorities;
(h) sending you news and offers, only if you agreed, and you can stop at any time.

3.2 Basis under the PDPA. We process your personal data with your consent, which you give when you apply, sign up or join a programme, or where the PDPA allows processing without consent, for example where it is necessary to perform our contract with you, to comply with a legal obligation, or for the administration of justice (section 6 of the PDPA).

3.3 We do not sell personal data. We do not use your data, or the data businesses put into Welkai, to train AI models.

4.1 We share personal data only as needed:

(a) our service providers (subprocessors), listed in the Subprocessor List, for hosting, storage, backups, email, AI, payments and support;
(b) platforms you connect, such as Meta and Google, when you connect them;
(c) our payment gateway CHIP, to take payments and refunds;
(d) our accountant;
(e) a referrer, who sees your business name and progress when you used their code;
(f) authorities, courts or advisers when the law requires it or to protect rights, safety and the Service;
(g) a company that takes over the Welkai business, under this policy.

5. Data we process for businesses (as processor)

5.1 Businesses use Welkai to store and handle data about their contacts: names, phone numbers, usernames, email addresses, tags and fields they add, chat messages, photos, videos, voice notes, documents, call information, appointment bookings, Google Forms responses and knowledge base content. Some of it may be sensitive (for example health details someone writes in a chat, or voice samples used to clone a voice, which may be biometric data).

5.2 We use this data only to provide the Service to that business: storing it, delivering messages, running flows, scanning files for viruses, converting media, reading documents for the business (rendered to images first), and sending text to AI providers when the business uses AI features.

5.3 When a business uses AI features, the text needed for that task (for example the customer's message, recent chat history, the business's instructions and knowledge) is sent to our AI providers to produce the reply. Voice notes are sent for transcription when the business turns that on.

5.4 Requests from contacts (access, correction, deletion, opting out) go to the business that holds the data. If you send them to us, we pass them to that business and help it respond.

6. Where data is stored and sent (outside Malaysia)

6.1 Welkai's servers are in data centres of Hetzner in the European Union (Germany or Finland). Files and backups are stored with Cloudflare R2 and off-site backups with Backblaze B2. Email is sent through Amazon SES. You can ask us which region Backblaze B2 and Amazon SES use for our data. Our AI providers (Anthropic, OpenRouter and DeepInfra) are in the United States. Cloudflare's network, which carries traffic to our websites, runs in many countries.

6.2 This means personal data is transferred outside Malaysia. Under section 129 of the PDPA, we transfer it only where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, or where an exception in section 129(3) applies, such as your consent, the need to perform our contract with you, or where we have taken all reasonable precautions and exercised due diligence. We choose providers with written data protection terms and security commitments, and we assess the transfers as the Commissioner's Cross Border Personal Data Transfer Guideline expects.

6.3 By using Welkai you consent to these transfers for the purposes in this policy. You can ask us for more detail about the safeguards for a transfer.

7. How long we keep data

Data	How long
Account data	while the account exists, then deleted with the account (section 8 of the Terms), except records listed below
Billing and tax records, agreement records	7 years after the end of the year they relate to, as Malaysian tax law requires us to keep records
Business data (contacts, chats, flows, settings)	while the account exists; deleted 45 days (or within a few days after) after an unpaid due date, the end of a cancelled plan, or the end of a trial without a plan
Media files in chats	for the days your plan sets (Trial 14, Solo 90, Plus 120, Starter 180, Growth 365, Business 730, Enterprise while the account is active), then deleted and shown as "Media expired"
Chat history of a number removed after a downgrade	30 days
Backups of business data	nightly backups kept 14 days; weekly encrypted off-site copies kept about 5 weeks; after deletion of an account, backup copies expire within about 90 days
Backups of our own account and billing database	14 days of point-in-time backups; one encrypted copy a month kept 12 months
Voice samples and cloned voices	until the business deletes them or the account is deleted
Support messages	up to 2 years after the last message on the matter
Website server logs	as kept by our web host, IONOS, under its own log settings; ask us if you need the exact period

7.1 When we no longer need data, we delete it or make it anonymous.

8. How we protect data

8.1 We take practical steps to protect personal data from loss, misuse, unauthorised access, change or destruction, as the Security Principle (section 9 of the PDPA) and the Personal Data Protection Standard require. These include:

encrypted connections (HTTPS) for every page and API;
web traffic filtered through Cloudflare, with our servers accepting web traffic only from Cloudflare;
passwords and keys stored encrypted, and payment cards never stored by us;
two-factor login available for users and used for our own admin console;
every business's data kept separate, and each own-server customer on its own server;
backups encrypted before they leave the server, with recovery keys kept offline;
files people send are stored as inert files, never run on our servers, scanned for viruses (infected files are blocked), and converted in sandboxes with no network access;
access by our staff limited to what is needed, with changes in our admin console logged;
prompt security updates, monitoring and alerts.

8.2 No system is perfectly secure. Keep your password private and turn on two-factor login.

9. Data breaches

9.1 If a personal data breach happens to data we control, we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours where the PDPA and the Commissioner's guideline require it, and we will tell affected people without unnecessary delay, and within 7 days after notifying the Commissioner, where the breach causes or is likely to cause significant harm.

9.2 If a breach affects data we process for a business, we will tell that business without undue delay and within 24 hours of becoming aware of it, so that it can meet its own duties.

10. Your rights

10.1 Under the PDPA you can:

(a) access your personal data and get a copy (we reply within 21 days, or tell you within that time if we need up to 14 more days);
(b) correct data that is inaccurate, incomplete, misleading or out of date;
(c) withdraw consent to our processing (this may mean we cannot continue to provide the Service);
(d) ask us to stop or not begin processing that is likely to cause you substantial damage or distress;
(e) ask us to stop direct marketing to you;
(f) ask us to transmit your personal data to another data controller (data portability), where technically feasible and the data format is compatible;
(g) limit how we process your data, by telling us.

10.2 To use a right, email [email protected]. We may ask you to prove your identity. We do not charge for requests.

10.3 Complaints. If you are not happy with our answer, you can complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi): https://daftar.pdp.gov.my/p_aduan.

11. Google user data

11.1 When a business connects a Google account to use Google Forms with Welkai, we access only the forms and responses needed for the features the business uses (for example watching a form and bringing new responses into Welkai, or creating a form the business asks for). We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.

11.2 Welkai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11.3 A business can disconnect Google at any time in Settings, or in its Google account settings.

12. Cookies

12.1 We use only cookies and browser storage needed to run our websites and apps (for example to keep you logged in and remember your language). We do not use advertising or tracking cookies. See our Cookie Notice.

13. Children

13.1 Welkai is a service for businesses. Users must be at least 18. We do not knowingly collect personal data from children as controller. Businesses are responsible for the data of any children among their contacts.

14. Changes to this policy

14.1 We may update this policy. We will post the new version with its date, and for material changes we will email account owners and show a notice in the dashboard before the change takes effect.

14.2 This policy is available in English and Bahasa Melayu. If there is a difference, the English version applies.