Privacy Policy

NinjaBot: WhatsApp Automation and CRM Platform
Effective Date: 8 October 2026

1. Our Commitment to Your Privacy

1.1 This Privacy Policy ("Policy") describes how Next Wave Global Solutions Sdn. Bhd. (Company Registration No. 1680474-P) ("Next Wave", "NinjaBot", "we", "us" or "our") collects, uses, discloses, stores, transfers and otherwise processes your Personal Data.

1.2 This Policy applies to Personal Data collected through our website (ninjabot.ai), our web application (dashboard and admin panel), our mobile app, our WhatsApp Business API integrations, our CRM and automation tools, customer support channels, sales channels, and any other products or services operated by or on behalf of Next Wave under the NinjaBot brand (collectively, the "Services").

1.3 We are committed to handling Personal Data in accordance with the Personal Data Protection Act 2010 (PDPA) and other applicable Malaysian laws, as amended from time to time.

1.4 This Policy explains what data we collect, how we collect it, how we use it, when we share it, how we protect it, how long we keep it, and your rights over it.

1.5 This Policy supplements, and does not override, any contractual terms, order forms, service agreements, or other notices provided by Next Wave.

2. Definitions

2.1 "Personal Data" means any information relating to an identified or identifiable individual.

2.2 "Processing" means collecting, recording, storing, using, disclosing, transferring, or otherwise handling Personal Data.

2.3 "Client Data" means information, contacts, WhatsApp messages, CRM records, automation workflows, files, media, or other data submitted to us by a customer (or their end customers) for use in connection with the Services.

3. Consent and Acknowledgement

3.1 By using our Services, creating an account, submitting information to us, or communicating with us, you acknowledge that you have read this Policy and consent to the processing of your Personal Data as described, where consent is required by law.

3.2 If you provide Personal Data belonging to someone else, for example your employees, customers, or contacts you upload into NinjaBot, you confirm that:

3.2.1 you are authorised to provide that data to us;

3.2.2 you have given the relevant notice to that individual; and

3.2.3 you have obtained any necessary consent for us to process that data.

3.3 Where providing Personal Data is required for us to deliver the Services, process payment, verify your account, or comply with law, failure to provide it may mean we cannot serve you.

4. Categories of Personal Data We Collect

4.1 Identity and contact information: full name, business name, job title, email, phone number, business address.

4.2 Account and subscription information: login credentials, account ID, subscription plan (Essential, Growth or Scale), add ons, invoices, payment status, usage records (such as Active Contact counts), and service history.

4.3 Payment and billing information: processed via Curlec. We do not store your full card, FPX, or bank account details. Curlec handles and stores payment credentials under its own security standards. We retain billing references, invoice records, and transaction status.

4.4 WhatsApp and messaging data: messages, media, contacts, broadcast lists, chatbot flows, and conversation logs that pass through your connected WhatsApp Business API account and any other channels you connect (e.g. Facebook Messenger or Instagram, if enabled).

4.5 CRM and business data: customer records, leads, appointment and booking details, pipeline stages, tags, notes, and any custom fields you or your end customers input into NinjaBot.

4.6 Technical and usage information: IP address, browser and device type, log data, feature usage, error logs, and diagnostic data from using the platform.

4.7 Communications data: support tickets, emails, and any feedback you send us.

4.8 Verification information: where required for account setup or Meta Business Verification (e.g. business registration proof), we may collect basic company verification details.

We do not intentionally collect sensitive personal data (e.g. health, religion, race) unless it is submitted by you through your own CRM or WhatsApp data. In that case, you as the account owner remain responsible for having proper consent from your end customers (see Section 7).

5. Data We Collect From Other Sources

5.1 We may collect data:

5.1.1 directly from you when you sign up, use the dashboard or mobile app, or contact support;

5.1.2 from Meta and the WhatsApp Business Platform, when you connect your WhatsApp Business API account or other Meta channels;

5.1.3 from Curlec, for payment and subscription status;

5.1.4 automatically through cookies and analytics tools on our website and app.

6. How We Use Your Personal Data

6.1 To provide the Services: create and manage your account, run your WhatsApp automations, chatbot flows, AI features, CRM, and broadcasts.

6.2 To fulfil our contract with you: process subscriptions, add ons, invoices, and renewals via Curlec, and track usage against your plan limits.

6.3 To communicate with you: respond to support requests, send account notices, service updates, and maintenance alerts.

6.4 To improve NinjaBot: analyse usage patterns, fix bugs, and improve automation performance and reliability.

6.5 For security: detect fraud, abuse, or unauthorised access, and monitor platform integrity.

6.6 For marketing (only where you have opted in): product updates, tips, and promotional offers.

6.7 For legal compliance: where required by Malaysian law or lawful government or regulatory requests.

7. Use of Client Data (Your WhatsApp Contacts and CRM Data)

7.1 When you use NinjaBot to manage WhatsApp conversations, contacts, and CRM records, you are the data controller of that Client Data, and Next Wave acts as a data processor and service provider on your behalf.

7.2 As the account owner, you are responsible for:

7.2.1 having the right to collect and upload your customers' data into NinjaBot;

7.2.2 giving proper notice to your own customers about how their data is used;

7.2.3 obtaining any consents required under PDPA or other applicable law before messaging them via WhatsApp automation.

7.3 We process your Client Data strictly to deliver the Services, such as running your chatbot flows, storing your CRM records and sending your broadcasts, and for platform security, troubleshooting, and support.

7.4 We do not sell your Client Data, and we do not use your customers' WhatsApp conversations to train third-party AI models without your consent.

7.5 Where AI features are used (e.g. AI chatbot replies, chat summaries, voice and image understanding, smart tagging), the relevant messages and content are sent to our AI service providers to generate a response. Outputs are generated based on the data you have connected. You remain responsible for reviewing outputs before relying on them for business decisions.

8. Disclosure of Personal Data

We may disclose Personal Data, on a need-to-know basis, to:

8.1 our authorised employees and personnel;

8.2 our hosting and infrastructure providers, including Hostinger (server hosting) and Cloudflare (file and media storage);

8.3 Curlec, for payment processing;

8.4 Meta and WhatsApp, as required to operate your connected WhatsApp Business API account and other Meta channels;

8.5 AI service providers (such as OpenAI), to power AI features within the Services;

8.6 email delivery providers, to send account and transactional emails;

8.7 professional advisers (lawyers, auditors, accountants), where needed;

8.8 regulators, courts, or law enforcement, where required by law;

8.9 any other party you specifically authorise.

We may also share anonymised, aggregated data (e.g. "X% of users automate bookings") that does not identify you personally.

9. Transfer of Personal Data

Your data may be stored and processed on servers located outside Malaysia, depending on the server locations of our hosting, storage, payment, AI and email partners (including Hostinger, Cloudflare and OpenAI). By using our Services, you consent to this transfer, which is necessary for us to provide the Services to you.

10. Cookies and Similar Technologies

10.1 Our website and app may use cookies and similar technologies to keep you logged in, remember preferences, analyse traffic, and measure marketing performance.

10.2 You can disable cookies via your browser settings, though this may limit some website or app functionality.

11. Data Retention

11.1 Your chat history, media and Client Data are kept for as long as your account remains active.

11.2 Media files older than 24 months may be moved to archive storage. Archived files remain available but may take longer to load.

11.3 If your subscription ends, your Client Data will be kept for 30 days. During this period, you may download your data or reactivate your account. After 30 days, your Client Data will be permanently deleted or anonymised.

11.4 Some records, such as invoices and billing history, may be kept longer where we are legally required to do so (e.g. for tax and accounting purposes).

11.5 Further details are set out in Section 6 of our Terms and Conditions.

12. Security of Personal Data

12.1 We apply reasonable technical and organisational safeguards, including access controls, authentication, encrypted connections, and server-level security across our hosting and storage infrastructure, to protect your data.

12.2 No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Data Breach Management

13.1 We maintain internal procedures to detect, assess, and respond to any suspected data breach.

13.2 Where required by law, we will notify affected users and/or the relevant authority within the required timeframe.

14. Your Rights

Subject to PDPA and applicable law, you may:

14.1 request access to your Personal Data;

14.2 request correction of inaccurate data;

14.3 withdraw consent, where processing is based on consent;

14.4 request deletion of your data, where legally permissible;

14.5 opt out of marketing communications.

We may verify your identity before processing any such request, and may decline requests where permitted by law.

15. How to Exercise Your Rights

To make any request regarding your Personal Data, contact us at support@ninjabot.ai. We may ask for identifying information to process your request securely.

16. Marketing Communications

16.1 We may send product updates or promotional messages by email or WhatsApp, where permitted.

16.2 You can opt out anytime by clicking "unsubscribe", replying "STOP", or emailing us directly.

16.3 Even after opting out of marketing, we may still send essential account, billing, or security related messages.

17. Third-Party Integrations

Our Services may connect to third-party platforms (e.g. Meta and WhatsApp, Curlec, and other tools you choose to integrate). We are not responsible for their privacy practices. Please review their own privacy policies.

18. Children and Minors

Our Services are intended for business users and are not directed at children. We do not knowingly collect data from minors.

19. Contact Details

Next Wave Global Solutions Sdn. Bhd.
Company Registration No.: 1680474-P
Address: 40, Jalan Tan Iu Ghee, Taman Free School, 10460 George Town, Pulau Pinang, Malaysia
Email: support@ninjabot.ai
Website: https://ninjabot.ai

20. Amendments

20.1 We may update this Policy from time to time to reflect changes in our Services or legal requirements.

20.2 The latest version will always be posted on our website with a revised Effective Date.

20.3 Continued use of NinjaBot after changes means you accept the updated Policy.