HOWDYLAH · THE DETAILS

Privacy policy

Effective: 22 October 2026 · Last updated: 22 October 2026

Baca notis privasi dalam Bahasa Malaysia ↓

1. Who we are and what this notice covers

Howdylah is built and managed by SUNSPARK STUDIO (registration 202403276086), at the address below. We control information used to operate accounts, support and our business. When a business uses Howdylah to manage its customers’ conversations, that business generally determines the purposes of those records and we process them to provide its workspace service. Contact that business about its own use of your information.

2. Information we collect and its sources

We receive information from you, your workspace administrators, connected messaging platforms, sign-in providers and service activity. This includes account email, name and authentication identifiers; workspace membership, invitations and access requests; customer names and contact details; WhatsApp messages, attachments, timestamps and delivery information; assignments, tags and internal notes; workspace instructions and knowledge supplied for AI replies; and technical or support records needed to operate and protect the service.

If you choose Google or Facebook sign-in, we request basic profile and email information shown on the provider’s permission screen. We do not receive your Google or Facebook password. We do not request access to your Gmail inbox for sign-in.

3. Purposes and choices

We use information to provide accounts and workspace access, display and route conversations, send authorised replies, support team collaboration and configured AI features, respond to enquiries, maintain security, investigate failures or abuse, and meet applicable obligations. Account identity and information necessary for a requested feature are required to provide that feature. Optional profile details and optional AI knowledge need not be supplied; choosing not to supply essential information may prevent account creation or the affected feature from working.

Administrators control workspace access and AI configuration. You can choose email sign-in instead of a social provider, contact us about your information, or request closure. Do not put sensitive information into knowledge materials or customer conversations unless your organisation has a valid reason and appropriate permissions.

4. Service providers and disclosures

We use Hostinger for hosting and email, Supabase for authentication, database and private storage, Meta for connected WhatsApp messaging, n8n for workflow automation, and OpenAI for configured AI generation. Google or Facebook processes authentication when you select its sign-in option. Relevant information is disclosed to these services as needed for the features you use; workspace members receive access according to their permissions, and message recipients receive messages sent to them.

Configured AI features can send relevant customer message content, conversation context, workspace instructions and knowledge to OpenAI to generate a reply. AI output can be inaccurate and should be overseen by the business. Provider processing is governed by their applicable terms; Howdylah does not promise zero retention by every provider.

We may disclose information where required by law, to protect rights and security, or to professional advisers under appropriate confidentiality obligations. We do not sell personal information or add advertising trackers as part of this website.

5. International processing and safeguards

Our providers may process information outside Malaysia. We assess relevant provider arrangements and applicable transfer requirements and use contractual and technical safeguards appropriate to the service. Safeguards include authenticated access, workspace permissions, HTTPS and private attachment access. No internet service can guarantee absolute security. Contact us for questions about relevant processing arrangements.

6. Cookies and browser storage

We use cookies or equivalent browser storage for authentication, sessions and secure sign-in flows. Blocking them may prevent sign-in or recovery from working. Google, Facebook and other linked services apply their own notices when you visit them.

7. Retention and deletion

We retain workspace records while the workspace is active and needed for the service. For a verified account or workspace closure/deletion request, our procedure is to remove the authorised primary records within 30 calendar days, except where applicable law requires or permits justified retention. We will explain material exceptions or a delay and handle requests within applicable legal requirements.

Closing one user account does not automatically delete another person’s workspace or the business’s shared conversation history. We confirm authority and scope first. Backup copies expire under the relevant provider’s configured retention schedules, rather than being immediately erased with live records. If a backup is restored, deletion instructions must be reapplied before affected data is returned to ordinary use.

We keep only necessary support, security and request-handling records for their stated purpose or applicable obligations, restrict retained exceptions, and review them for deletion when no longer needed. Copies held independently by recipients, connected platforms or the business are outside Howdylah’s direct deletion control.

8. Your rights, requests and complaints

You may ask about access, correction, withdrawal of consent where applicable, limiting processing, portability where applicable, or deletion. Email hq@howdylah.com. We may need proportionate identity or authority checks and will explain relevant limitations. Do not send passwords, access tokens or identity documents in your initial request. See deletion instructions.

Raise privacy concerns with us first so we can investigate. You may also contact Malaysia’s Personal Data Protection Commissioner through pdp.gov.my. This notice does not restrict applicable statutory rights.

9. Updates and contact

We update this notice when practices change and show the revision date here. We will provide additional notice for material changes where required. Privacy contact: hq@howdylah.com.