Privacy Policy

Last updated: 16 September 2026

Talkalize SDN. BHD. ("Talkalize", "we", "us", or "our") is a Malaysian company providing WhatsApp messaging, team inbox, templates, campaigns, analytics and API integrations. This policy explains how we handle personal information through our website and service.

1. Our role and our customers' role

We determine how information about our own account holders, billing contacts and website visitors is used to manage accounts, take payments, provide support and operate our business. For that information, Talkalize acts as the data controller where that term applies.

Business customers decide why they communicate with their contacts and what they send. We process their contacts, conversations and related workspace data on their instructions to provide the service, acting as a processor where that term applies. Customers are responsible for their privacy notices, lawful instructions, permissions and responses to individuals. Our handling of service billing and security records is separate from their decisions about communications.

2. Information we process

Account and business information: names, email addresses, phone numbers, company details, login information, team membership, roles, settings and support correspondence.
Billing information: plans, subscription dates and status, invoices, payments, wallet top-ups, balances, usage charges and transaction references. Stripe processes payments for supported checkout and recurring billing flows. Saved payment-method references and limited card details may be used for authorized wallet auto-recharge; full card details are entered through the payment provider.
WhatsApp connection information: WhatsApp Business Account (WABA) IDs, business phone numbers and phone-number IDs, associated Meta app IDs, connection status and timestamps, and access tokens used to call Meta APIs. Access depends on permissions granted for the connected assets, including messaging and account or template management. These permissions authorize operations; they are not your Facebook password.
Communications and contacts: recipient numbers, names and other contact details supplied by a customer or received through WhatsApp, contact lists, labels, assignments and opt-out status; incoming and outgoing message content, template variables, images, audio, video, documents and other supported attachments or media links.
Messaging and operational records: message identifiers, senders and recipients, delivery/read/failure status and timestamps, templates, campaigns, automation settings, usage and analytics, webhook events and diagnostic logs. Logs can contain message content, phone numbers and event details as well as technical errors.
Website and technical information: page visits, browser/device information, IP addresses, session and cookie information and interactions with our website, as described below.

The information involved depends on the plan, connected assets and features used. Embedded Signup is in development and is not publicly released; this policy does not describe it as an available public connection method.

3. How information is used and shared

We use account and billing information to authenticate users, administer access, process subscriptions and wallet transactions, send service notices, answer support requests and keep business records. We process workspace information to send and receive messages, show conversations to authorized team members, manage contacts and templates, run customer campaigns and automations, and report delivery and usage. Operational records support troubleshooting, billing reconciliation, reliability and investigation of misuse.

Information is shared with Meta and WhatsApp to operate the connection and messaging service; payment providers for payments; and hosting, storage and communications providers to run the service and store or deliver data. Media uploads use object storage. Customer-configured API and webhook integrations can send message and contact data to the customer's chosen systems. Those recipients and the customer's team may keep their own copies.

Our website loads Google Analytics for usage measurement, Microsoft Clarity for interaction analytics, including session replay, and Google Fonts for fonts. These services receive browser requests and associated technical information and may use cookies or similar technologies. Selected campaign pages also load Meta Pixel when configured, for page-view and campaign measurement. Browser controls can limit cookies and tracking; restricting necessary cookies can affect sign-in or preferences.

Meta, payment providers and other providers may also process information for their own purposes under their privacy notices. Information may be disclosed where required by law or necessary to address a specific security incident, legal claim or dispute.

4. Retention

Accounts and billing: account details support the customer relationship. Payment, invoice and wallet records may remain necessary after cancellation to reconcile charges, resolve a specific dispute or meet an applicable recordkeeping obligation.
Messages, contacts and media: these support the customer's inbox, campaigns and history. Retention depends on the customer's instructions, continued need for the service and deletion requests. Removing a contact, list or conversation does not necessarily remove related campaign history, separately stored attachments, logs or exported copies.
Logs: diagnostic and messaging logs are separate from inbox records. Relevant records may be needed to investigate an error, abuse or disputed transaction. There is no single published expiry period for all logs.
Disconnected accounts: disconnecting or ceasing to use WhatsApp does not automatically erase stored credentials, messages or the Talkalize account. Request deletion separately using the instructions below.
Backups: deletion from active systems is separate from removal of backup copies. Any remaining copies need to be addressed in the deletion review; no fixed backup-expiry period is stated here. Request the applicable scope and timing when submitting your request.

Retention exceptions must relate to the information and purpose in question. A billing-record requirement is not a general reason to retain message content. For Meta Platform data, applicable Meta deletion requirements also apply; a general preference to keep historical records does not override them.

5. Access, correction, withdrawal and deletion

Disconnecting does not automatically cancel already queued campaign messages or stop all event logging and status updates. A request to stop future processing needs to cover pending work and event handling as well as stored data.

Account holders can contact info@talkalize.com to request access to or correction of their information, a copy, deletion, or account closure. Depending on applicable law, you may also have rights to object to or restrict processing and withdraw consent where processing relies on consent. Withdrawal affects future processing based on that consent and may prevent the relevant feature from working.

To withdraw WhatsApp access, use the relevant Meta business or integration settings to remove Talkalize's permissions, or ask us for help with your managed connection. Where a Talkalize disconnect control is available, it marks the connection inactive; it does not itself revoke the token at Meta or erase existing records. Revoking access and requesting deletion are separate steps.

If you communicated with a business using Talkalize, contact that business first because it controls the workspace information. You can also email us with the business name, your WhatsApp number and the request. You do not need a Talkalize account. We may need to verify your relationship to the information and coordinate with the business before acting; do not send passwords or access tokens.

See our Data Deletion Instructions for the request process, scope and retained-copy questions. Deletion by Talkalize does not delete your Facebook or WhatsApp account, a WABA, or copies held independently by Meta or a recipient.

6. Security and international processing

The service uses account authentication, password hashing and role-based access controls for workspace features. These measures do not guarantee that every risk is eliminated. Protect your credentials and only grant access to authorized team members.

We operate from Malaysia. Processing by Meta, payment, analytics and infrastructure services can involve other countries. Contact us for information about the providers relevant to your use of Talkalize.

7. Updates and contact

Updates to this policy will be posted here with a revised date. This policy explains our handling of information; it does not replace a business customer's own privacy notice.

Talkalize SDN. BHD.
Malaysia
info@talkalize.com