Privacy Policy

1. Introduction

DuoCode Technology (SSM Registration No. 202603062356, LA0087244-A), a sole proprietorship registered in Malaysia with its principal place of business at No 4 Jalan Mohd Tahir 1, 41200 Klang, Selangor ("we", "us", "our"), is committed to protecting the privacy and personal data of our website visitors, product design partners, pilot users, and clients.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the Malaysian Personal Data Protection Act 2010 ("PDPA").

2. Data We Collect

We may collect the following personal data when you interact with our website or services:

• Contact Form Data: name, email address, phone number, and message content when you submit our contact form.
• Communication Data: correspondence via email or WhatsApp when you reach out to us.
• Usage Data: anonymized analytics data collected through Vercel Analytics and our own self-hosted Umami server, including page views, the referring site, device type, browser, and approximate geographic location.
• Product Pilot Data: business requirements, workflow descriptions, support policies, integration needs, evaluation feedback, and demo or pilot context you choose to provide.
• Client Project Data: business requirements, technical specifications, and project-related information provided during our engagement.
• AI Customer-Service Data: when a customer messages a business that uses our AI customer-service product, Agentic CS (on WhatsApp or on the business's assistant page), we process that conversation on the business's behalf: the message content and any files, images, or voice notes sent, and, for WhatsApp conversations, the customer's phone number and WhatsApp profile name.

3. How We Use Your Data

Your personal data is used for the following purposes:

• To respond to your inquiries and provide requested information about our services.
• To deliver, manage, and improve our AI customer-service product, Design Studio debugging workflows, and software services.
• To answer a business's customers on that business's behalf, using only information the business has provided and approved, and to hand conversations to the business's own staff when a person is needed.
• To communicate project updates, invoices, and related correspondence.
• To evaluate product fit, integration requirements, support workflow safety, and design-partner feedback.
• To analyze website usage patterns and improve our website experience.
• To comply with legal and regulatory obligations.

4. Legal Basis for Processing

Under the PDPA, we process your personal data based on one or more of the following:

• Consent: when you voluntarily submit your data through our contact form or initiate communication.
• Contractual necessity: when processing is required to perform our services under an agreed engagement.
• Legal obligation: when we are required to retain or disclose data by law.

5. Our AI Customer-Service Product (Agentic CS)

Businesses use Agentic CS to answer their own customers' questions on WhatsApp and on their assistant pages. When we provide this service, the business decides why and how its customers' data is used: the business is the data user (controller), and DuoCode Technology processes that data on the business's behalf as a data processor.

• You may be talking with an AI assistant. Answers are generated by AI using only the information the business has provided and approved. When the assistant cannot help, or a person is needed, the conversation is handed to the business's own staff.
• WhatsApp. WhatsApp conversations are delivered through Meta's WhatsApp Business Platform. WhatsApp's own terms and privacy policy apply to your use of the WhatsApp app itself.
• No model training. We do not use these conversations to train AI models. The providers whose models generate answers (OpenAI and Google) process the data only to answer for the business and, under their business terms, do not use it to train their models.
• Kept separate. Each business's conversations are kept separate from every other business's, and are only visible to that business and to the DuoCode staff who support it.

6. Cookies and Analytics

Our website uses Vercel Analytics, a privacy-friendly analytics service that collects anonymized usage data. Vercel Analytics does not use cookies for tracking and does not collect personally identifiable information. For more information, see Vercel's Analytics Privacy Policy.

We also count page views with Umami, an open-source analytics tool that we run on our own server. It sets no cookies and stores nothing in your browser. For each visit it records the page, the referring site, your browser, operating system, device type, screen size and language, and an approximate location (country, region and city) worked out from your IP address. Your IP address itself is not stored.

7. Data Sharing and Disclosure

We do not sell, trade, or rent your personal data to third parties. We may share your data with:

• Service providers that we use to run our website and services, only as needed to provide them:
  • Vercel: website and application hosting.
  • Amazon Web Services: hosts our own page-view statistics server (Umami) in Singapore.
  • Convex: database and application backend.
  • Google Cloud: document processing and storage.
  • OpenAI, and Google (Gemini) for some features: AI models that generate answers.
  • Meta Platforms: the WhatsApp Business Platform, for WhatsApp conversations.
  • ElevenLabs and StepFun: speech-to-text and text-to-speech for voice features.
  • Arize: monitoring the quality and reliability of our AI service.
  • Email and communication platforms used to correspond with you.
• Legal authorities: when required by law, court order, or governmental regulation.

8. International Transfers

Some of our service providers store or process data outside Malaysia, for example in the United States or Singapore. We transfer personal data only to the extent needed to provide our services, and only to providers that are bound to protect it, in line with the PDPA.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Contact form submissions are retained for up to 12 months unless an ongoing business relationship exists. Client project data is retained for the duration of the engagement plus 3 years. AI customer-service conversations are kept for as long as the business uses Agentic CS, and are deleted when the business or the customer asks us to (see Data Deletion below).

10. Your Rights Under the PDPA

Under the Malaysian PDPA, you have the right to:

• Access your personal data held by us.
• Correct any inaccurate or incomplete personal data.
• Withdraw consent for processing at any time (this does not affect the lawfulness of prior processing).
• Request deletion of your personal data, subject to legal and contractual retention requirements.

To exercise any of these rights, please contact us using the details below.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our website is served over HTTPS with HSTS enabled, and our hosting infrastructure is managed by Vercel with enterprise-grade security. Access credentials for connected accounts, such as WhatsApp, are stored only on our servers and are never exposed to web browsers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Business: DuoCode Technology
• Address: No 4 Jalan Mohd Tahir 1, 41200 Klang, Selangor, Malaysia
• Email: duocodetechu@duocodetech.com
• WhatsApp: +60 14-739 8281