Privacy policy

01Overview

By using our website or engaging with our services, you agree to the practices described in this policy. If you do not agree, please do not use our website or services.

Who we are: doTask is Dotask Enterprise (registration no. 202403036995 / 003574878-D), a business registered in Malaysia, operating from Kuala Lumpur. We make the doTask customer-messaging software, and provide performance marketing, content production, branding, web development, and AI-powered marketing services.

02Data we collect

We collect personal data in two ways. Data you provide directly, and data collected automatically when you use our website.

Data you provide to us

Data collected automatically

We do not collect sensitive personal data (such as identity card numbers, racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data) unless explicitly required for a specific service and with your consent.

03How we use your data

We use your personal data only for legitimate purposes:

• Service delivery: To provide, manage, and improve the services you've engaged us for.
• Communication: To respond to enquiries, send project updates, invoices, and account notices.
• Marketing (with consent): To send newsletters, blog updates, or promotional content. Only where you've opted in. You may unsubscribe at any time.
• Analytics: To understand how visitors use our website so we can improve it.
• Legal compliance: To meet our obligations under Malaysian law, including PDPA 2010 and tax requirements.
• Fraud prevention: To detect and prevent fraudulent activity and protect our website and users.

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

04Messaging & AI (doTask Chatbot)

What we receive and store

When a customer messages a merchant on a connected channel, we receive the message from the platform (for Instagram, WhatsApp and Messenger, from Meta) and store it so the merchant can read and answer it. For each conversation we store:

• the content of the messages exchanged, in both directions;
• a platform identifier for the customer (for example an Instagram-scoped ID or a WhatsApp phone number) and, where the platform provides it, a display name;
• timestamps, delivery status, and which replies were written by the merchant's staff and which were generated automatically;
• for a merchant's own connection: an access token for their Instagram account, Facebook Page or WhatsApp number, stored encrypted.

We do not read a customer's other messages, contacts, followers, or content. We receive only the conversation between that customer and that merchant.

Comments, posts and insights

Merchants who connect an Instagram professional account or a Facebook Page can also use the following. Each works only on the merchant's own account or Page.

• Comment replies. A merchant can set keyword rules (for example "PRICE"). When someone comments on one of the merchant's posts, Meta sends us the comment; if it matches a rule the merchant switched on, we post the merchant's own public reply under it and send the commenter one private reply. We keep the comment and the conversation it starts like any other conversation; a comment that matches no rule is not stored. We never hide, edit or delete comments.
• Posts. A merchant can write posts in doTask and publish them to their own Instagram account and Facebook Page, now or at a time they choose. We publish only what the merchant wrote and confirmed. Pictures and videos the merchant uploads for posts are stored (Supabase, Singapore) until the merchant deletes them; a video is removed 60 days after its post went up.
• Insights. A merchant can see how their own account and Page are doing (reach, views, engagement, followers, and figures per post). These figures are read from Meta each time the merchant opens the page, shown only to that merchant's team, and not stored.

Automated replies are generated by an AI model

Message content is sent to Anthropic, an AI provider, to generate suggested or automatic replies on the merchant's behalf. What is sent is the conversation text, together with the merchant's own instructions and business information (opening hours, policies, product details). Anthropic processes this to produce a reply and does not use it to train its models. Replies generated this way are marked as such in the merchant's inbox. A merchant can take over any conversation and reply personally at any time, and the automated replies stop while they do.

Photos a customer sends (for example a picture of a product, a receipt or a screenshot) are sent to Anthropic in the same way, so the assistant can answer from what the picture shows; the merchant can switch this off. Card numbers, identity documents and passwords visible in a photo are never repeated back.

After a conversation ends, its text may be sent to Anthropic once more so that it can be filed under a topic and given a quality score for the merchant's own reporting. What is kept from this is a topic, a score, a one-sentence summary and a one-sentence suggestion; the merchant can switch this off.

Email the merchant sends through doTask

A merchant can reply to tickets, send booking reminders and satisfaction surveys, and send marketing emails ("broadcasts") from a mailbox address doTask provides. These emails are delivered by Resend. Broadcasts go only to customers the merchant has an address for and who have not unsubscribed; every broadcast carries an unsubscribe link and header, and one click stops all further broadcasts from that merchant. A broadcast contains a small image and a tracked button so the merchant can see whether it was opened and whether the button was pressed; nothing else about the reader is recorded.

Shopify

When a merchant installs doTask on their Shopify store, we read the store's name, contact email and domain to set the workspace up, and its product catalogue and policies so the assistant can answer questions about them. With the merchant's permission (read_orders) the assistant may look up a customer's own order: only when the customer gives the order number together with the email used at checkout, or is already known to the merchant by that email, and only its status, items, total and tracking are shown. The merchant's sales report reads the order number, date, checkout email and total of recent orders from Shopify each time it is opened; orders are not stored in doTask. Shopify's data requests (customer data request, customer erasure, shop erasure) are received and honoured automatically.

Knowledge the merchant connects

A merchant can give the assistant text, files, web pages, Notion pages and Google Docs to answer from. For Notion, the merchant creates a read-only integration in their own Notion workspace and pastes its secret, which we store encrypted; we read only the pages the merchant shares with that integration, and re-read them weekly. For Google Docs, we read only documents the merchant has shared with "anyone with the link"; no Google account is connected. A merchant can mark any of these public, in which case they appear on the merchant's help-centre page for anyone to read.

Surveys, banners and the customer portal

A merchant may show a short survey or a banner on their own website through the chat widget. Survey answers are stored with the visitor's session; an answer to a "how likely are you to recommend us" question is kept on the customer's contact record. A merchant may also publish a customer portal, where a customer signs in with a six-digit code emailed to them (stored hashed, valid for fifteen minutes) and sees the tickets and bookings under that email address, replies, and opens new requests. The signed-in session is a cookie on that browser for thirty days.

WhatsApp

A merchant connects their own WhatsApp Business number to the doTask Chatbot through Meta's Embedded Signup: the merchant signs in with Meta, chooses or creates their WhatsApp Business Account, and authorises doTask to receive messages for that number and send replies on their behalf. Meta then issues us an access token for that account, which we store encrypted and delete when the merchant disconnects the number. The number and the account remain the merchant's; the merchant is billed by Meta directly for WhatsApp conversations, and doTask has no access to their Meta payment details.

Three kinds of message are sent on WhatsApp. Replies are sent within the 24-hour window that WhatsApp opens after a customer writes, by the merchant's staff or by the automated assistant, and may include reply buttons. Template messages are message templates approved by Meta in advance, which a merchant sends when the window has closed: an appointment reminder before a booking the customer made (containing the customer's name, the service and the time), an order or booking update, or a reply to a conversation older than 24 hours. Broadcasts are approved marketing templates a merchant sends to customers who have opted in to hear from that merchant; a customer can opt out at any time by replying STOP, after which the merchant's broadcasts are no longer sent to them. Every business-initiated message is sent by the merchant to their own customers; doTask sends none of its own, and Meta's WhatsApp Business policies apply to all of them.

When a customer books through the assistant or the merchant's booking page, we store the booking: the customer's name and the phone number or email they gave, the service, the time, and the conversation it came from. The merchant sees and manages these bookings in their calendar.

What we do not do with messages

• We do not sell message data or share it with advertisers.
• We do not use one merchant's conversations to serve, train, or improve the service for any other merchant. Each merchant's data is isolated.
• We do not train AI models on merchant or customer messages, and our AI provider does not either.
• We do not message customers unprompted. Automated replies are sent only in response to a message the customer sent first, or to a comment they left on the merchant's post that matches the merchant's rule (one private reply per comment), within the time limits each platform sets. Business-initiated messages (template messages and broadcasts, described above) are sent by the merchant, to the merchant's own customers, using templates Meta has approved.

Who processes it, and where

The doTask Chatbot runs on the following sub-processors, each bound by a written agreement:

Conversation data is stored in Singapore. Where a merchant or customer is in the United Kingdom or the European Union, transfers to Singapore and the United States are made under appropriate safeguards, including standard contractual clauses with the providers above. A copy of our data processing agreement for merchants is available on request.

Our role

For messages exchanged through the doTask Chatbot, the merchant decides why and how customer messages are used and is the data controller (PDPA: data user). doTask processes those messages on the merchant's instructions and is the data processor. If you are a customer of a merchant and have a question about how your messages are used, contact the merchant first; we will assist them, and you may also contact us directly using the details below.

How long we keep conversations

• Conversations and messages: for as long as the merchant's account is active and for 12 months after the last message in a conversation, after which they are deleted.
• Access tokens for a merchant's Instagram account, Facebook Page or WhatsApp number: until the merchant disconnects the account or closes theirs, then deleted immediately.
• Automated reply records (which model answered, token counts, cost): retained with the conversation for the merchant's billing history.
• Backups: deleted data leaves backups within 30 days.

Deleting your data

A merchant can delete any conversation from their inbox, disconnect a channel at any time (which deletes the stored access token), or ask us to delete their account and all of its data by emailing [email protected] with the subject line "Data Deletion Request". A customer of a merchant can ask for their messages to be deleted by contacting the merchant or by emailing the same address; we will verify the request with the merchant and confirm deletion to you in writing. We act on deletion requests within 30 days.

If you connected an Instagram or Facebook account to the doTask Chatbot and later removed the app from your Meta account settings, you can use the same address to request deletion of anything we stored for that connection.

05Google user data

A business using doTask can connect a Google Calendar to a staff member or a room, so bookings and busy times stay in step, can connect a YouTube channel to post its videos from doTask, and can connect its Google Ads account to send results from its ads back to it. This part explains exactly what we receive from Google and what we do with it.

Each of these is connected only by an owner or admin of the business, with their own Google account, and only for that business. For every one of them we also receive the Google account's email address, to show which account is connected.

Google Calendar

• What we ask for: permission to see and edit events in your calendar (Google's calendar.events permission). Nothing else in your Google account for the calendar.

How we use it

• Bookings into your calendar: each doTask booking for that staff member or room is written as an event (the service, the customer's name, the booking code, their phone number if they gave one, the address for a home visit, and a Google Meet link when the service uses one). It is updated when the booking changes and removed when it is cancelled.
• Busy times out of your calendar: for the next 90 days we read only the start and end time and the free or busy status of your events, so doTask stops offering those times for online booking. We do not request the titles, descriptions, guests or attachments of events we did not create.
• We use Google user data only to provide the features the business connected: this calendar sync, and the YouTube and Google Ads features below. We do not use it for advertising, we do not sell it, and we do not use it to train AI or machine-learning models.
• No one at doTask reads any Google user data, except with the business's permission to help with a support request, where needed for security, or where the law requires it.

Where it is kept and who sees it

• The permission Google gives us (a refresh token) is stored encrypted. Busy times are stored as blocked time on the business's doTask calendar. Both are held with Supabase in Singapore.
• We do not share Google user data with anyone else, other than the hosting providers that run doTask for us, or where the law requires it.

Disconnecting and deleting

Disconnecting the calendar in doTask (Bookings, then the staff member or room) deletes the stored token and removes the busy times we imported from it, and revokes our access with Google unless the same Google account is still connected to doTask for something else (Google would cut that connection too). Events doTask already wrote stay in your calendar until you delete them. You can also remove doTask's access at any time at myaccount.google.com/permissions, or ask us to delete everything by emailing [email protected].

YouTube

doTask uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy.

• What we ask for: permission to upload videos to the channel (youtube.upload) and to see the channel's name and picture (youtube.readonly), so doTask can show which channel is connected. We do not read the channel's other videos, comments, subscribers or analytics.
• How we use it: only to upload the videos and Shorts the business writes in doTask's Social composer, with the title, description, privacy and made-for-kids setting it chooses, at the time it chooses. Nothing is posted without the business asking for it.
• Where it is kept: the permission Google gives us is stored encrypted with Supabase in Singapore, with the channel's name, picture and ID. A video is held only while it uploads. We do not sell this data, use it for advertising, share it beyond the providers that run doTask, or use it to train AI or machine-learning models.
• Removing access: disconnect the channel in doTask (Social, then Accounts) to delete the stored permission and channel details, or remove doTask at security.google.com/settings/security/permissions.

Google Ads

• What we ask for: permission to manage the business's Google Ads account (adwords), used only to list the accounts it can use, to make doTask's three conversion goals and to make a customer list for a segment, and permission to send data to it (datamanager), used only to send those results and lists. We do not read or change campaigns, budgets, bids or ads.
• Results sent: when someone who came from the business's Google ad books, buys or becomes a client, we send the ad click's identifier (the gclid Google adds to the link), the time, the kind of result and its value. No name, email or phone goes with it.
• Customer lists: when the business syncs a segment, we send the emails and phone numbers of the people in it who agreed to marketing, hashed with SHA-256 first, so Google receives no readable address or number. People who leave the segment or stop agreeing are taken off at the next sync. Before the first list, an owner or admin of the business agrees in doTask to Google's Customer Match policy and terms, confirming that the people on its lists gave their details and agreed to hear from the business; nothing is sent before that.
• Where it is kept: the permission Google gives us is stored encrypted with Supabase in Singapore. We keep the results we sent and the hashes on each list, to send each result once and to take people off a list. We do not sell this data, use it for our own advertising, share it beyond the providers that run doTask, or use it to train AI or machine-learning models.
• Removing access: disconnect Google Ads in doTask (Settings, then Google Ads) to delete the stored permission, or remove doTask at myaccount.google.com/permissions.

Limited Use

doTask's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

06Sharing & disclosure

We share personal data only in the following limited circumstances:

Service providers

We work with trusted third-party service providers who process data on our behalf. All providers are contractually bound to handle data securely and only as instructed. Current providers include:

• Vercel. Website hosting and deployment; hosts the doTask Chatbot inbox
• Supabase. Database and authentication services (Singapore)
• Cloudflare. Network, security, and the messaging service that receives and sends chatbot messages
• Anthropic. AI model provider that generates automated chatbot replies from conversation content
• Google Analytics. Website analytics (anonymised)
• Resend / Mailchimp. Email delivery services
• Stripe / Billplz. Payment processing (we never see full card details)
• Calendly. Appointment booking

Legal requirements

We may disclose your data when required by Malaysian law, court order, or a lawful request from a public authority, and only to the extent required. Every such request is handled under our written procedure for requests from public authorities: the request must be in writing and is reviewed for its legal basis before anything is disclosed; a request we consider unlawful or broader than its purpose is refused, narrowed or challenged, with legal advice where needed; only the minimum data that a valid request covers is disclosed; and each request, our response and the legal reasoning are recorded in a register. Where we process data on a merchant's behalf, we inform the merchant of the request unless the law prohibits it. To date we have received no such request. A copy of the procedure is available on request from [email protected].

Business transfers

If doTask is involved in a merger, acquisition, or sale, your data may be transferred as part of that transaction. You will be notified before any such transfer if your data will be subject to a different privacy policy.

07Cookies

We use cookies — small text files stored on your device — to make our website work properly and to understand how it is used.

You can control cookies through your browser settings. Disabling certain cookies may affect website functionality. When you first visit our site, you will be given the option to accept or decline non-essential cookies.

08Data retention

We retain personal data only as long as necessary for the purposes outlined in this policy or as required by law:

• Client data: For the duration of the engagement and up to 7 years after for accounting and legal compliance (as required by Malaysian tax law).
• Marketing data: Until you unsubscribe or request deletion.
• Website analytics: Aggregated, anonymised data indefinitely; raw data up to 26 months.
• Enquiry data: Up to 2 years if no engagement follows.

09Your rights

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to correction: Request that we correct inaccurate or incomplete data.
• Right to withdraw consent: Withdraw consent for processing where consent is the basis (e.g., marketing emails).
• Right to limit processing: Request that we restrict how we process your data in certain circumstances.
• Right to be informed: Know what personal data we collect and how it is processed.

If you are in the United Kingdom or the European Union, you also have the rights the UK GDPR and EU GDPR give you: to erasure, to data portability, to object to processing based on legitimate interests, and to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office). Where we process messages on a merchant's behalf, we will pass your request to the merchant and help them respond.

To exercise any of these rights, email us at [email protected] with the subject line "Privacy Request." We will respond within 21 days as required under PDPA. We may need to verify your identity before processing your request.

10Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• HTTPS encryption for all data in transit
• Access controls. Only authorised staff can access personal data
• Regular security reviews of third-party service providers
• Database encryption at rest via Supabase
• Merchant platform credentials (Instagram and WhatsApp access tokens) are additionally encrypted with a key held only by the messaging service, never stored in plain text
• Every message from a platform is checked against the platform's signature before it is accepted

How we detect, contain and report a security incident is set out on the Security and incident response page.

Despite these measures, no method of internet transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant authorities as required under Malaysian law.

11Third-party links

Our website may contain links to third-party websites (such as client websites, social media platforms, or partner tools). We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies before providing any personal data.

12Children's privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at [email protected] and we will delete it promptly.

13Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will provide more prominent notice (such as an email to subscribers or a banner on our website).

Your continued use of our website after any changes constitutes your acceptance of the updated policy.

14Contact us

For any questions about this Privacy Policy, to exercise your rights, or to report a privacy concern, write with the subject line "Privacy Policy Enquiry":

doTask · Kuala Lumpur, Malaysia. We are committed to resolving privacy complaints promptly and transparently. If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia's Personal Data Protection Department (JPDP).