Skip to content
Log in
Get started

Privacy Policy

Last updated: 31 October 2026

This policy will be reviewed by counsel; we will tell you before any change. It is also available in Bahasa Melayu and 中文.

1. Who we are

BOOK IN CHAT PTE. LTD. (UEN 202646792Z), 60 Paya Lebar Road #06-28, Paya Lebar Square, Singapore 409051 (BookInChat, we). We provide an AI-assisted receptionist (on WhatsApp, Facebook Messenger and Instagram, and for comments on Threads), booking and shop-management platform to salons, wellness shops and skin and aesthetic clinics (Shops) in Malaysia and Singapore.

Data Protection Officer: Lee Cheng Han, dpo@bookinchat.com. You can also write to the DPO at the address above. For general support, email support@bookinchat.com.

2. What this policy covers

This policy explains how we handle personal data where we decide why and how it is used, as an "organisation" under Singapore's Personal Data Protection Act 2012 (SG PDPA) and as a "data controller" under Malaysia's Personal Data Protection Act 2010 as amended in 2024 (MY PDPA). It covers:

  • A. Shop owners and staff who register for or use BookInChat;
  • B. Website visitors to our website;
  • C. Shops' customers (Customers), only for BookInChat's own purposes (section 5). For everything else, the Shop decides how Customer data is used and the Shop's own privacy notice applies; we handle that data on the Shop's behalf;
  • D. Business contacts we communicate with, including businesses whose business contact details we find in public business listings and directories (for example their own website, social pages or map listings). We use those details to contact the business in person or by phone, to offer BookInChat. We message a business on WhatsApp only after it agrees. We send other marketing only to people who have opted in. To ask us to stop contacting your business and to delete its details, tell us when we contact you, or email our Data Protection Officer at dpo@bookinchat.com.

3. Personal data we collect

  • A. Shop owners and staff: name, email, phone or WhatsApp number, role, business name and details, login and security data (password hash, device and session data, IP address), billing contact and subscription records (card data is handled by HitPay, not stored by us), support messages, settings and consents (for example marketing and the improvement opt-out), and usage records. Source: you, colleagues who invite you, and HitPay.
  • B. Website visitors: IP address, browser and device data, pages viewed, form entries (for example a demo request) and Cloudflare Turnstile bot-check signals. Source: you, and the essential cookies and similar technologies described in our Cookie Policy. If you accept analytics cookies, we also measure visits with Google Analytics (Google LLC, our processor): pages viewed, the referring site or campaign, demo link clicks with their source code, approximate location (country or city) and device type, used for aggregate reports only. Without your consent it does not load. Our demo WhatsApp links add a short source code (ref) to the pre-filled message, which tells us which page or source you came from. When we contact businesses, each outreach batch (a group of businesses we contact at the same time) gets one shared code, for example "out-" followed by the batch name. The code tells us which batch, not which business.
  • C. Customers (for our purposes): WhatsApp name and number, or on Facebook Messenger, Instagram and Threads the name, profile picture and the account ID that Meta gives the Shop's Page or account; messages (on Threads, the public replies to the Shop's own posts), voice notes, images, bookings and records the Shop keeps in or imports into BookInChat (section 6), technical and delivery data, and opt-out records. Source: the Customer through WhatsApp, Facebook Messenger, Instagram or Threads, the Shop, and Meta and Kapso.
  • D. Business contacts: name, role, business contact details and communications. If you message our demo WhatsApp number, this includes your WhatsApp name and number, your messages and any source code (ref) in them. Source: you, or public business listings and directories.

Is it obligatory? For group A, account, contact and billing details are needed to provide the Service; without them we cannot open or bill your account. Marketing consent is voluntary. For group B, any cookie other than an essential cookie is voluntary. For group C, Customers can contact the Shop by other means if they do not wish to message an AI-assisted receptionist.

4. Why we use it

  • To create and manage accounts, provide the Service and give support (A).
  • To bill and collect payment, and to keep accounting and tax records the law requires (A).
  • For security, to prevent fraud, spam and abuse, and to enforce our terms, including the Acceptable Use Policy (A, B, C).
  • To operate, maintain and fix the Service (A, C).
  • To improve our AI and product using de-identified data (section 5) (C, and usage data of A).
  • To comply with the law, respond to authorities and handle legal claims (all groups).
  • To send service messages about billing, security and changes to our terms (A).
  • Marketing messages (news and offers, by email or WhatsApp) to Shop owners and business contacts: only with your opt-in consent; you can unsubscribe at any time (A, D).
  • To contact businesses in person or by phone to offer BookInChat, using public business contact details (D). A business can ask us at any time to stop contacting it and to delete its details (section 10).
  • Marketing-source measurement: website analytics (Google Analytics, only with your consent through our cookie banner) and the source code (ref) in our demo WhatsApp links, to learn which pages and sources lead to demo requests. We use aggregate reports only: counts by page, source and code, with no names or numbers (B, D).
  • Advertising tools that use cookies (such as Meta Pixel or Google Ads), on our website or in the staff app: only with your consent through a cookie banner (A, B).

We do not sell personal data. We do not use Customer data to market to Customers or to build advertising profiles.

5. Customers: what BookInChat does for its own purposes

When a Shop uses BookInChat, the Shop controls its Customers' data for its own business purposes. BookInChat is also responsible, as an independent controller, for limited purposes of its own:

  1. Running the Service: keeping it working, fixing errors and supporting the Shop.
  2. Security and integrity: detecting spam, abuse, fraud and security incidents, and honouring STOP requests.
  3. Legal: complying with the law and lawful requests, and handling legal claims.
  4. Training and improving that Shop's own assistant with de-identified data: unless the Shop opts out (or you object), we may create de-identified data from a Shop's conversations and bookings and use it to train and improve the AI that runs that same Shop's assistant. This includes fine-tuning our own AI models, on our own servers or, in future, in a data centre we operate. It is never used to train or improve another Shop's assistant or any shared model.
    • De-identified means we remove or replace names, phone numbers, WhatsApp IDs, addresses, identity and payment numbers and other personal identifiers, generalise dates and rare details, discard images and audio, and keep no key to link it back to a person. The data is tagged with the Shop it came from, so it can only be used for that Shop and can be removed if the Shop opts out. We review re-identification risk regularly. We do not attempt to re-identify anyone and we prohibit others from doing so.
    • Health, clinic and other sensitive data are always excluded, whether or not the Shop opts out. If you are a clinic patient, your health details are used only to serve you and are never used to improve BookInChat.
    • De-identified data may be kept after the Shop leaves, unless the Shop opted out.
    • Shops can opt out by emailing support@bookinchat.com; we then stop using their data and remove the de-identified data tagged to them.
    • Customers can object to this use through the Shop or by emailing support@bookinchat.com. Your objection takes effect within 5 business days.
    • We use data that comes through WhatsApp for improvement only as far as Meta's terms for the WhatsApp Business Platform allow.

Your choices as a Customer. Reply STOP in a Shop's WhatsApp, Messenger or Instagram chat to stop all automated messages from that Shop in that chat (assistant replies, reminders and booking notices) until you reply START. The assistant is not an emergency service and does not give medical advice; if you need urgent help, do not wait for a reply in the chat. You can ask to speak to a person at any time. Customers who want to access, correct or delete their data should usually contact the Shop first; you can also contact our Data Protection Officer at dpo@bookinchat.com, and we will pass requests about the Shop's purposes to the Shop.

6. Who we share personal data with

  • AI model providers, reached only through our own AI gateway (LiteLLM): we use one or more of NUS SoC LaaS (National University of Singapore School of Computing), Alibaba Cloud Model Studio (Qwen), Google (Gemini API), OpenAI (OpenAI API) and Anthropic (Claude API). They read messages, transcribe voice notes and, outside clinics, read images, to understand and answer messages and draft replies. NUS SoC LaaS and Google (Gemini API) are our main AI providers: each AI task runs on NUS or Google Gemini, whichever is better tested for that task; where configured, the other provides a backup. For some Shops, OpenAI drafts replies and helps with bookings first, with these as the backup. Anthropic is used for a task only once it has tested better for that task; the list below shows where. Google transcribes voice notes first (voice notes are sent as audio), with NUS SoC LaaS as the backup; message text is masked where applicable. At clinics this includes the health details patients share after agreeing to the clinic's notice. The Sub-processor list shows the current providers and where they process data; we give Shops at least 3 hours' notice before adding or replacing one.
    • Per task today (the provider used first; where configured, the other is the backup): checking messages for urgent or medical content and sorting them: NUS SoC LaaS; screening messages for attempts to misuse the assistant: NUS SoC LaaS; helping with bookings: NUS SoC LaaS; writing replies: Google (Gemini API), backup NUS SoC LaaS; checking replies before they are sent: NUS SoC LaaS; transcribing voice notes: Google (Gemini API), backup NUS SoC LaaS; reading images (never at clinics): NUS SoC LaaS; background summaries and search: NUS SoC LaaS; for some Shops, writing replies and helping with bookings: OpenAI (OpenAI API) first; Anthropic (Claude API): not yet used for any task.
    • Where and how long: NUS SoC LaaS processes data in the locations it is configured to use, which may include regions outside Singapore and Malaysia. Google (Gemini API) may process data in any country where Google or its sub-processors have facilities, and keeps prompts and responses for a limited period only to detect abuse. OpenAI (OpenAI API) and Anthropic (Claude API) process data in the United States; under their API terms they do not use our API data to train their models, and keep it for a limited period (up to 30 days) mainly to detect abuse, longer only where the law or a safety investigation requires. How long each provider keeps data is set by its terms; the Sub-processor list gives the details.
  • Other service providers (sub-processors) that host, transmit or process data for us: server hosting in Singapore (Unihost), Cloudflare (network protection, bot checks and R2 file storage), Kapso (our WhatsApp connection for numbers connected through it), Meta (WhatsApp, including the WhatsApp Cloud API we connect to directly, as our processor; Facebook Messenger, Instagram and Threads), Resend (email), Sentry (error reports), HitPay (subscription billing) and, for website visitors who accept analytics cookies, Google (Google Analytics). The Sub-processor list gives what each one does and where.
  • The Shop: Customer data stays with the Shop the Customer deals with. Shop staff see the data their role allows.
  • Meta (WhatsApp, Facebook Messenger, Instagram and Threads): messages are delivered through Meta's platforms (the WhatsApp Business Platform and the Messenger, Instagram and Threads APIs); Meta also handles data under its own policies.
  • Authorities, courts and advisers, where required by law or to protect rights, safety and security.
  • A buyer or successor of our business, under confidentiality and this policy.

Records a Shop imports. A Shop can bring its own earlier records into BookInChat: past WhatsApp conversations (from the WhatsApp Business Platform or a WhatsApp chat export file) and customer and booking lists from another system. We process these records on the Shop's behalf, like the rest of its Customer data, and the Shop confirms it is allowed to move them. Customers from an imported list get no automated message from BookInChat until they message the Shop themselves; marketing preferences are not imported; identity card and passport numbers in an imported list are removed; and an uploaded customer list file is deleted once its import is complete.

7. International transfers

Our servers are in Singapore. Some providers process data in the United States, in Chile (Kapso), and in other countries where global networks operate (Cloudflare, Meta, and Google for website analytics, only with your consent). For Malaysian users, storing data in Singapore is itself a transfer outside Malaysia.

AI processing. The AI model providers in section 6 may process messages, including health details at clinics, outside Malaysia and Singapore (for example in the United States or wherever a provider runs its models). For these transfers we rely on contractual terms with each provider (their data processing terms) and on the providers' published API data terms. Alibaba Cloud and Google (paid Gemini API) each say in their published terms that they do not use our API data to train or improve their models without our agreement. The Sub-processor list shows the current providers and where they process data, and we give Shops at least 3 hours' notice before adding or replacing one.

We transfer data only where we have taken appropriate steps for the recipient to protect it to a standard comparable to Singapore and Malaysian law, through written contracts (data processing agreements and, where appropriate, standard or ASEAN model contractual clauses), provider certifications and our own security assessments, and, for Malaysia, on a basis permitted by section 129 of the MY PDPA. You can ask our Data Protection Officer for details.

8. How long we keep it

  • Shop account and user data: while the account is active. After the account ends, the Shop can export its data for 90 days. After that period ends (by our daily job, usually within a few days), the Shop's users lose access to it; a user with no other active BookInChat account has their name, email address and phone number replaced with coded (pseudonymised) values and can no longer sign in. The Shop's name, web address and brand details are also replaced with coded values.
  • Customer data held for the Shop: as set by the Shop while the account is active. After the 90-day export period that follows the end of the Shop's account (by our daily job, usually within a few days), we (1) delete the Shop's WhatsApp, Instagram, Facebook Messenger and Threads messages, the files sent in them (such as voice notes and photos), the reply drafts made for them and our raw copies of them, and we also delete the clinic health notes, the assistant's conversation summaries (including those of deleted chats), the assistant's memory notes (remembered preferences and customer memory cards), the text of the assistant's draft replies, staff notes on the assistant's replies and the contents of imported customer files; (2) replace with coded (pseudonymised) values Customers' names, contact details and usernames, and the names and notes on the Shop's customer list, bookings, booking offers, late-cancellation and no-show records and customer profiles; remove Customers' names from receipts; and remove the staff notes and the chat and customer links from clinic health-alert records; and (3) keep only: receipts and payment proofs, for the periods the law requires (see the next bullet); clinic health-alert records (the alert type, level and times) for 7 years as safety records; the chat consent and STOP (opt-out) records, with the chat identifier they apply to; data needed for a legal claim or legal hold (as a separate copy of the records concerned, until it is resolved); and the audit trail. For at most 12 months after the Shop's account ends, the Shop's other records stay with the details in (2) coded (bookings, customer profiles, payment, credit and package records, staff names on the schedule, other stored files with coded file names, and the search indexes already built); coded data is still personal data, and we use these coded records only to detect fraud and abuse across the Service. 12 months after the account ends, our daily job erases each Customer's records as on a Customer erasure request: what stays is listed in (3), together with booking, package and payment rows that no longer carry any Customer details, and the Shop's own records that are not about a Customer (staff names on the schedule, the Shop's documents and the search indexes already built).
  • Invoices, payment and accounting records: as long as the law requires; payment proofs customers send for deposits and top-ups (receipt screenshots, invoice photos) are kept for 7 years from settlement for legal record-keeping, even after a deletion or erasure request (including a data-deletion request made through Meta or WhatsApp). After such a request a proof is kept with access restricted (the Shop's staff can no longer view it) and is deleted when the 7 years end.
  • Voice notes: a Customer's voice note is transcribed into text by our AI model provider, and the transcript is kept like any other message. The audio itself is kept for 90 days so the Shop's staff can replay it, then deleted automatically (sooner if the Customer's data is erased).
  • Opt-out, consent and marketing-preference records: as long as needed to keep honouring them.
  • Security logs: only as long as needed to keep the Service secure.
  • Website analytics (Google Analytics, only with your consent): event-level data kept for 14 months (our Google Analytics setting), then deleted by Google; aggregate reports may be kept longer.
  • Business contacts from public listings that do not become a Shop: deleted one year after our last contact, or straight away if the business asks us to stop contacting it or to delete its details. We keep only a record of that request, so that we do not contact the business again.
  • Demo chats from people who message our demo WhatsApp number and do not become a Shop: deleted 2 years after the last message, or straight away if you ask us to delete them.
  • Records needed for a legal claim or legal hold: until resolved.
  • De-identified data: may be kept after the Shop leaves, unless the Shop opted out.
  • Backups: overwritten in the normal backup cycle.

9. Security

We use encryption in transit, encrypted backups, separation of each Shop's data, role-based access, logging and restricted administrator access. We take steps to keep the text of messages out of our logs. No system is perfectly secure. If a data breach affects you, we will notify you and the regulator where the law requires.

10. Your rights

Subject to the law and its exceptions, you can:

  • access your personal data and ask how it has been used or disclosed;
  • correct inaccurate or incomplete data;
  • withdraw consent to processing that relies on consent, including marketing (this may mean we cannot provide some services);
  • in Malaysia, object to processing likely to cause substantial damage or distress, stop direct marketing, and ask for data portability where technically feasible;
  • ask us to stop contacting your business and to delete its details (section 2 D);
  • complain to us and to the regulator.

How: email our Data Protection Officer at dpo@bookinchat.com, or write to our address. We may need to verify your identity. We answer an access or export request within 5 business days, and other requests as soon as reasonably possible and within the time the law allows. We may charge a reasonable fee for access requests where the law allows, with an estimate first; correction is free.

Regulators: Singapore: Personal Data Protection Commission (www.pdpc.gov.sg). Malaysia: Jabatan Perlindungan Data Peribadi, the Personal Data Protection Commissioner (www.pdp.gov.my).

11. Marketing

We send marketing messages (such as email and WhatsApp) to Shop owners and business contacts only with opt-in consent. We may also contact businesses in person or by phone to offer BookInChat, as described in section 2 D. Every marketing email has an unsubscribe link. We do not send marketing to Customers.

12. Cookies

Our staff app uses essential cookies only. Our website uses essential cookies and, only if you click "Accept analytics" in our cookie banner, Google Analytics cookies (section 3 B). You can withdraw your consent at any time through the Cookie settings link at the bottom of any page of our website. Advertising cookies (such as Meta Pixel or Google Ads) may be added to the website and the staff app, but only after you agree through a cookie banner. See our Cookie Policy.

13. Children

BookInChat is for businesses and is not directed at children. Shop accounts require users aged 18 or over. Shops are responsible for handling any Customer data about minors lawfully.

14. Changes and language

We will post updates here and give Shop account owners at least 14 days' notice of material changes. This policy is available in English, Bahasa Melayu and 中文.

Privacy Policy | BookInChat