Privacy policy

1About this policy

This policy explains how wasabi collects, uses, shares and protects personal data. It covers three groups of people:

• Operators: businesses such as houseboat, chalet and homestay operators that use wasabi, and the people who manage their accounts.
• Guests: people who message an operator's WhatsApp number that wasabi serves.
• Website visitors: people who visit wasabi.halinaztech.com.

We process personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA), as amended.

2Who we are

wasabi is a product of Halinaz Consultancy and Resources, a business registered in Malaysia with the Companies Commission of Malaysia (SSM) under registration number 202403334587 (SA0627202-D). In this policy, "we", "us" and "our" mean Halinaz Consultancy and Resources.

3Our role

Who decides how personal data is used depends on whose data it is.

• Guest data: each operator decides why and how its guests' data is used, and is the data user (controller) under the PDPA. We process guest data on the operator's behalf and on its instructions, as a data processor.
• Operator and website data: we are the data user (controller) for information about operators' accounts and for our own website.

If you are a guest, the operator you messaged is your first point of contact for questions about your booking data. We will help them respond, and you can also contact us directly.

4Information we collect

About guests, through an operator's WhatsApp number

• Your WhatsApp phone number and WhatsApp profile name.
• The content of messages you send to the operator, including text, voice notes, images and locations you choose to share.
• Booking details: dates, number of guests, the boat, unit or package booked, prices, deposit amounts and booking references.
• Payment receipts you send as proof of payment. We do not collect card or bank account numbers.
• How you found the operator, such as the advertisement or post that opened the chat.
• Message metadata, such as times sent and delivery status.

About operators

• Business name, registration details, address and contact details.
• Names, phone numbers and email addresses of people who manage the account.
• WhatsApp Business account identifiers and the access credentials needed to send and receive messages on the operator's behalf.
• Rates, units, policies and other settings the operator gives us.
• Calendar identifiers, if the operator connects a Google Calendar.
• Billing and correspondence records.

About website visitors

Our hosting provider records basic technical data, such as IP address, browser type and pages requested, to deliver the site and protect it from abuse. If you email us, we receive your email address and message.

5How we use it

We use personal data only to:

• reply to guests' enquiries on the operator's behalf, check availability, give quotes and create bookings;
• send booking confirmations, payment requests and reminders before arrival;
• let operators review conversations, confirm payments and take over chats;
• show operators which posts and advertisements lead to bookings;
• keep the service secure, prevent misuse and fix problems;
• manage operator accounts, billing and support; and
• meet our legal obligations.

We do not sell personal data, use guest data for our own advertising, or send guests marketing messages from wasabi. We do not combine one operator's guest data with another's.

6Automated replies and AI

wasabi uses an AI language model to understand guest messages and write replies. Each message is sent to our AI provider together with the operator's own information, such as rates, policies and FAQs, so that the reply is accurate for that operator.

• Prices, availability and booking status come from the operator's records, not from the AI model.
• Bookings are confirmed by the operator, not by the AI.
• A guest can ask to speak to a person at any time, and the operator can take over any conversation.
• We do not use guests' messages to train AI models, and we use AI providers whose terms do not allow them to train their models on the data we send.
• Voice notes are converted to text by our hosting provider, Cloudflare, so that they can be answered. The transcript is then handled like any other message.

7Data we receive from WhatsApp

wasabi connects to the WhatsApp Business Platform, operated by Meta Platforms, Inc. When an operator connects its WhatsApp Business account to wasabi, we receive the messages its guests send to that number, the related metadata described in section 4, and the account identifiers needed to reply.

• We use this data only to provide wasabi to the operator who owns that WhatsApp account.
• We do not sell it, use it to build advertising profiles, or share it beyond the service providers listed in section 8.
• We handle it in line with Meta's Platform Terms and WhatsApp's business policies.
• When an operator disconnects its account, we stop receiving its messages and delete the access credentials.

8Who we share it with

We share personal data only with the operator concerned and with the service providers below, who process it on our instructions and under contract.

We may also disclose personal data where the law requires it, for example to comply with a court order, or to protect the rights and safety of guests, operators or the public. If our business is transferred, personal data may pass to the new owner, who must continue to protect it as this policy describes.

9Transfers outside Malaysia

Some of the providers above process data in data centres outside Malaysia. We only use providers that protect personal data to a standard comparable to the PDPA, under contractual safeguards, and we transfer only what each provider needs to do its job.

10How long we keep it

An operator can ask us to delete its guests' data sooner. When the retention period ends, we delete the data or make it anonymous.

11How we protect it

• All data is encrypted in transit, and access credentials are stored encrypted.
• Each operator's bookings and conversations are stored in a separate database.
• Access is limited to the operator's authorised people and to our staff who need it to run and support the service, and access is logged.
• Payment receipts are stored privately and are never publicly accessible.

No system is completely secure. If a personal data breach occurs, we act quickly to contain it, tell affected operators without undue delay, and notify the Personal Data Protection Commissioner and affected individuals where the law requires.

12Your rights

Under the PDPA, you can:

• ask for access to the personal data held about you;
• ask for inaccurate or incomplete data to be corrected;
• withdraw your consent, or ask us to limit how your data is processed;
• ask for your data to be sent to you or to another organisation in a commonly used format; and
• ask for your data to be deleted, as described in section 13.

Guests should usually contact the operator they messaged first; we will help the operator respond. You can also contact us. We respond to requests within 21 days. We may need to confirm your identity first, for example by asking you to message us from the WhatsApp number concerned.

If you withdraw consent, the operator may no longer be able to take or manage your booking through WhatsApp.

13Deleting your data

If you are a guest

1. Ask the operator you messaged to delete your data, or email privacy@halinaztech.com with the subject "Delete my data".
2. Include the WhatsApp number you used and the name of the operator you contacted.
3. We will confirm your request, usually by WhatsApp message to that number, and delete your conversations, receipts and personal details within 30 days. We will tell the operator.

An operator may need to keep a basic record of a completed or paid booking for its own accounts; we will tell you if that applies.

If you are an operator

1. Email privacy@halinaztech.com from your registered email address, asking us to close your account and delete your data.
2. To disconnect wasabi from WhatsApp yourself, open the WhatsApp Business app and go to Settings › Account › Business Platform › Disconnect.
3. If you connected through Facebook, you can also remove wasabi in Facebook under Settings & privacy › Settings › Business integrations.

We delete your account data and your guests' data within 30 days of your request, except billing records we must keep by law.

14Cookies

Our website does not use cookies for advertising or analytics. Our hosting provider may set a strictly necessary security cookie to protect the site from automated abuse.

15Children

wasabi is a service for businesses and is not directed at children. Bookings are normally made by adults. If you believe a child has given us personal data, please contact us and we will delete it.

16Changes to this policy

We may update this policy as wasabi changes or the law changes. We will update the date at the top of this page, and tell operators by email before any significant change takes effect.

17Contact us

For privacy questions, requests or complaints, email privacy@halinaztech.com or write to us at the address in section 2.

If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner, Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi), at www.pdp.gov.my.