Privacy Policy

SeeSharp Solutions ("SeeSharp", "we", "us") operates SharpTXT, a WhatsApp messaging platform offered as two products: WaWeb, which links a WhatsApp account by QR code, and Cloud API, which connects through Meta's official WhatsApp Business Platform. This notice explains what personal data we handle, on what basis, and what you can ask us to do with it.

It applies to the SharpTXT website, the customer portal, and both products. Our contact details are in section 14.

1. The two roles we act in

This is the most important distinction in this notice, and everything below depends on it.

As a data controller, we decide how personal data is handled for our own account, billing, and support records. That covers you as a subscriber: the person who signs up, the people you add to your team, and the payment information attached to your subscription. Section 2 describes that data.

As a data processor, we handle personal data on your instructions and for your purposes when you use SharpTXT to message your own customers. Your contact list, the message content, the media exchanged, and any conversation history synchronised from a connected WhatsApp account are yours. You decide who is messaged and why. We store and transmit that data so the platform works, and we do not use it for our own purposes. Section 3 sets out exactly what that data is.

Where we act as a processor, you are the data controller and the legal obligations that come with that role - obtaining consent, issuing your own notice, and honouring withdrawal - rest with you. See section 7 and Schedule 1 of our Terms of Service.

2. Personal data we collect about you, our customer

Data you give us directly

Account and identity data: name, business email address, phone number, job title, and the name of the business you represent.
Billing data: billing address, subscription tier, invoice history, and the payment reference returned by our payment provider. We do not store full card numbers.
Support data: the content of enquiries and correspondence you send us.

Data generated when you use the platform

Authentication and usage data: sign-in events, IP address, browser and device information, timestamps, and pages accessed.
Operational logs: message delivery status, error records, and webhook events, retained so failures can be diagnosed and delivery can be proven. Delivery status recorded against a message is kept for as long as that message is; error records and webhook events are kept for 12 months. Section 9 sets both out.

3. Data we hold about your end users

When you connect a WhatsApp account and message people through SharpTXT, we hold data about those people - your end users - on your behalf. We set it out in full here, because it is the data you are most accountable for and the data you are least likely to have entered yourself.

Identity

The end user's phone number, and the WhatsApp identifier attached to it.
The end user's WhatsApp profile name, and their profile picture where their WhatsApp privacy settings make it visible.
The name saved for that person in the address book of a connected WaWeb account, where one exists.
Whether the account is a WhatsApp Business account, whether it is blocked, and whether it appears in the connected account's own contacts.
Any name, tag, or attribute you add to the contact yourself.

Conversation

The messages exchanged between you and the end user: text, images, documents, and other media.
Whether each conversation is open, who on your team it is assigned to, and how many messages are unread.
For group chats, the group subject and the participants' identifiers.

Activity and delivery

The date and time of the end user's last activity, and of their last inbound message.
Delivery state for each message - queued, sent, delivered, read, or failed - with the timestamp of each and the reason for any failure.

Consent

Whether the end user is recorded as opted in, opted out, or unknown; when that was captured; how it was obtained; and the evidence you attach to it, including the wording they were shown.

SharpTXT obtains an end user's identity information - profile name, phone number, profile picture - from WhatsApp itself, not from any list we hold. That information is data the end user has chosen to share on that service under its own privacy settings. It is stored in your SharpTXT tenant for as long as you choose to keep it there, and it is deleted when you delete the contact or when your subscription ends under the periods in section 9.

It is your responsibility to manage the data held in your SharpTXT account in compliance with the law. We do not decide which contacts you keep, which people you message, or how long you retain a conversation. Section 7 sets out what that responsibility involves.

If you are an end user of one of our customers and you want your data corrected or deleted, contact that business directly. They are the data controller; we act only on their instructions, and we will refer your request to them.

4. What a connected WhatsApp account gives us access to

Linking a WhatsApp account gives SharpTXT access to data on that account. We state this plainly because it is the point at which most personal data enters the platform.

Both products. Once linked, messages sent to and from the connected number pass through the platform and are stored against your tenant, including message text, attachments, sender phone numbers, and WhatsApp profile names.

WaWeb (QR-linked). Linking by QR code establishes a WhatsApp linked-device session on the connected account. That session can read the account's contact list and address book, and its existing chats. If you link a personal WhatsApp number rather than a business one, the personal number, profile name, and profile picture on that account become visible inside your SharpTXT tenant and to your team members, and personal chats on that account fall within the session's reach. We ask you to acknowledge both of these before a QR code is generated, and we record when you did.

Cloud API (official). Where Coexistence onboarding is used, Meta pushes the connected phone's existing address book and, subject to your approval, up to 180 days of past conversations. This happens once, shortly after onboarding, and cannot be triggered on demand.

You should link a WhatsApp account only if you are entitled to do so, and only if the people in that account's contact list and chat history have been told their data will be processed by a service provider on your behalf.

5. Why we use personal data, and on what basis

Purpose	Basis
Creating and administering your account	Performance of our contract with you
Taking payment and issuing invoices	Performance of contract; legal obligation to keep records
Providing the messaging platform itself	Performance of contract; your instructions as controller
Security, abuse prevention, and rate limiting	Our legitimate interests in a safe service
Diagnosing faults and supporting you	Performance of contract
Sending you service notices about outages, changes, and billing	Performance of contract
Sending you marketing about SharpTXT	Your consent, which you may withdraw at any time
Complying with law and responding to lawful requests	Legal obligation

We do not sell personal data. SharpTXT is funded by subscription fees, not by advertising or by the resale of data. We do not use the message content, contact data, or conversation history you entrust to us to train machine-learning models, and we do not make decisions about your end users by automated means that produce legal effects for them.

Meta Platforms - unavoidably, for Cloud API. Messages you send through the official API are transmitted to and processed by Meta under Meta's own terms and privacy policy. Where you use WaWeb, messages traverse WhatsApp's network in the same way any WhatsApp message does.
Cloud infrastructure and hosting providers, who store the platform's data under contract.
Payment providers, who process your subscription payments.
Error monitoring and support tooling, which may incidentally hold diagnostic data.
Professional advisers, auditors, and regulators, where we are required or permitted to disclose.
An acquirer, if the business is sold or reorganised, subject to this notice continuing to apply.

Every processor we engage is bound by contract to security and confidentiality obligations at least as strict as those in this notice. A current list of our sub-processors is available on request from the address in section 14.

7. Your obligations when you message other people

When you use SharpTXT to message your customers, you are the data controller for those people. You are responsible for:

Having a lawful basis - normally consent - for messaging each recipient.
Giving those people your own privacy notice.
Honouring withdrawal of consent and opt-out requests promptly. Section 43 of the PDPA gives a person the right to require you to stop processing their data for direct marketing at any time.
Answering access and correction requests that your end users make to you.
Complying with the WhatsApp Business Messaging Policy and Meta's commerce and messaging rules.

SharpTXT records consent as an evidenced history - status, source, timestamp, and the evidence you attach - so that you can demonstrate opt-in per contact if you are ever asked to. Recording it is your responsibility; the platform gives you the place to do it. Our model consent wording is a starting point you can adapt.

8. Cross-border transfer

SharpTXT is operated from Malaysia. Personal data may be stored or processed outside Malaysia by the hosting, infrastructure, and messaging providers named in section 6, including by Meta.

Where we transfer personal data out of Malaysia we do so in reliance on the transfer conditions in section 129 of the PDPA, and we take reasonable steps to ensure the recipient is bound to a standard of protection comparable to the Act.

9. Retention

Account, billing, and tax records: for the life of the subscription and for seven years afterwards, which is the retention period Malaysian tax and companies legislation requires.
Message content, media, and conversation history: for the life of the subscription, and deleted within 90 days of termination unless you ask us to delete it sooner or the law requires us to keep it.
Contacts and consent records: for the life of the subscription. Because a consent record is the evidence that a person agreed to be messaged, it is kept for as long as the contact exists and is exportable so that it survives your leaving the platform.
Security and access logs: 12 months.
Operational logs: delivery status recorded against a message is kept for as long as the message itself, under the message-content period above, because it is what proves that message was delivered. Error records and webhook events are kept for 12 months.

You control the retention of end-user data within those limits: you can delete a contact, a conversation, or your whole tenant's message history at any time, and we will act on that without undue delay unless we are legally required to retain it. After termination you have 30 days to export your data before the periods above begin to run.

10. Security and data breaches

Each tenant's data is row-isolated, access is authenticated and permission-gated, data is encrypted in transit, and access to production systems is restricted to staff who need it. WhatsApp session credentials are held encrypted and separately from the rest of the platform's data. Staff with access to production systems are trained on their confidentiality and security obligations.

No system is perfectly secure and we do not claim otherwise. If a personal data breach occurs that causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it and notify affected individuals within 7 days of that notification where the amended PDPA requires it. Where we act as your processor, we will notify you without undue delay so that you can meet your own obligations.

11. Your rights

Subject to the exceptions in the PDPA, you may ask us to:

Access the personal data we hold about you, and be told how it has been used.
Correct data that is inaccurate, incomplete, or out of date.
Withdraw consent to processing for which consent is the basis, including marketing.
Limit processing for direct marketing purposes.
Receive your data in a portable form, where the amended PDPA's data portability right applies and the transfer is technically feasible.

Write to the address in section 14. We will respond within the statutory period - 21 days for an access or correction request - and will tell you if we need longer. A fee may apply to an access request where the Act permits one. Exercising these rights costs you nothing else.

12. Children

SharpTXT is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18 as a subscriber. If you use the platform to message a person under 18, the consent requirements that apply to a minor's personal data are yours to meet.

13. Cookies

The SharpTXT website and portal use cookies that are strictly necessary for authentication, session management, and security. Where we use analytics cookies we ask for your consent first, and you can withdraw it through your browser settings at any time.

14. Contact and complaints

Our Data Protection Officer can be reached at info@seesharpsolutions.com, or by post to SeeSharp Solutions, Kuala Lumpur, Malaysia.

If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia.

Your subscription is governed by our Terms of Service; Schedule 1 of those Terms sets out our obligations when we process personal data on your behalf.

15. Changes

We may update this notice. Where a change materially affects how we handle your personal data we will tell you before it takes effect, and the date at the top of this page will always show when it was last revised.