Privacy Policy

Last updated: 15 November 2026

1. Who we are

The websites www.cdsb.asia and chatreply.my and the ChatReply software are operated by Creative Distributions Sdn. Bhd., Registration No. 201801014951 (1276967-X), referred to in this policy as "CDSB", "we" or "us". Our address is Lot 23, 1st Floor, Block D, Damai Plaza 3, Lorong Pokok Kayu Manis, 88300 Kota Kinabalu, Sabah, Malaysia.

ChatReply is customer messaging software that lets businesses answer their customers on WhatsApp, Facebook Messenger and Instagram from one shared inbox. For WhatsApp, ChatReply uses the WhatsApp Business Platform (Cloud API) provided by Meta.

We handle personal data in accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA").

2. What this policy covers

This policy explains how we handle personal data in two situations:

• Our websites and enquiries. When you visit www.cdsb.asia or chatreply.my, fill in the contact form on chatreply.my, or contact us by email.
• ChatReply. When a business that uses ChatReply (a "business customer") communicates with its own customers and contacts ("end users") through it.

If you are an end user who has messaged a business that uses ChatReply, that business decides why and how your personal data is used. Its own privacy notice also applies to you.

LearnUp, BizMate, Gogo Mobile and Macintosh Sdn. Bhd. have their own websites and privacy notices. This policy does not cover them.

3. Personal data we collect

From website visitors and people who contact us

• Contact details you give us, such as your name, business name, email address and phone number.
• The content of your enquiry and our correspondence with you.

www.cdsb.asia has no contact form and no user accounts. chatreply.my has a contact form: when you submit it, we receive the details you enter (such as your name, business name, phone number, email address, industry, how many businesses or branches you have and your message) and your consent to be contacted. We use them only to reply to you about ChatReply. Otherwise we receive your details only when you choose to email us.

From business customers

• Business and account details, such as the business name, registration details and billing contact.
• Names, email addresses and phone numbers of the staff members who use ChatReply.
• Content the business gives us to configure the service, such as knowledge base articles, message templates and quick replies.

On behalf of business customers, about end users

When a business customer uses ChatReply to communicate with end users, we process the following on that business's behalf:

• The end user's identifier and profile name on the channel they use: their WhatsApp phone number and profile name, or their Facebook Messenger or Instagram account ID, name and username as provided by Meta.
• The content of messages sent and received, including any text, images, documents or other attachments.
• Message information such as timestamps and delivery and read status.
• Opt-in records, labels, conversation assignments and internal notes created by the business's staff.

4. How we use personal data

• Respond to enquiries.
• Set up, provide and maintain ChatReply for business customers, including support.
• Deliver messages between a business customer and its end users, show conversations in the shared inbox, and, where the business turns this on, generate automated replies from the business's own knowledge base.
• Send broadcasts for a business customer to contacts who have opted in to receive them.
• Provide delivery and read statistics to the business customer.
• Keep ChatReply secure, prevent misuse and investigate faults.
• Issue invoices and keep business records.
• Comply with legal obligations.

We do not sell personal data. We do not use end users' message content for our own marketing or to build advertising profiles.

5. Our role when we act for a business

For end users' personal data, each business customer is the data controller (referred to as the "data user" in earlier versions of the PDPA). The business customer decides the purposes for which its end users' personal data is processed and is responsible for giving notice to, and obtaining consent from, its end users, including consent to receive broadcast messages.

CDSB acts as a data processor. We process end users' personal data only on behalf of the business customer, on its instructions and in order to provide ChatReply to it.

For personal data of website visitors and people who contact us, and for business customers' own account and staff details, CDSB is the data controller.

6. Who we share personal data with

• Meta. Messages are sent and received through platforms operated by Meta Platforms: the WhatsApp Business Platform for WhatsApp, and the Messenger Platform and Instagram messaging for Facebook Messenger and Instagram. Meta processes message data and account identifiers in accordance with its own terms and privacy policies.
• Infrastructure and service providers. We store ChatReply data on servers in Malaysia. We also rely on third-party providers for hosting our websites, for payments (Billplz processes subscription payments; we do not store full card numbers), and for services such as databases, storage and the AI language processing that generates automated replies. We require our service providers to process personal data only in order to provide their services to us.
• The business customer. End users' messages and contact details are available to the business they are communicating with, and to its authorised staff.
• Authorities and advisers. Where the law requires it, or where it is necessary to establish or defend legal claims.

Some of these providers may process personal data outside Malaysia. Where that happens, we take reasonable steps to ensure the data continues to be protected in line with the PDPA.

We do not sell, rent or trade personal data to anyone.

7. Sensitive information

ChatReply's AI assistant is not designed to collect, and we do not ask end users to send, identity card (MyKad) or passport numbers, bank account or payment card details, passwords, or health information.

We require our business customers not to use ChatReply to request this kind of information through chat. If you are an end user, please do not send such information in a conversation with a business.

8. How long we keep personal data

• Enquiries. We keep correspondence for as long as needed to deal with your enquiry and for a reasonable period afterwards for our business records.
• Data processed for business customers. We keep conversation data and contact records for the duration of our service to that business customer. After the service ends, including when a free trial ends without a paid plan, we keep the data for 30 days so the business can export it or reactivate its account, and then delete or anonymise it, unless the business customer asks us to delete it sooner or the law requires us to keep it longer.
• Billing and business records. We keep these for as long as Malaysian law requires.

When personal data is no longer needed for the purpose it was collected for, we take reasonable steps to delete it or make it anonymous.

9. Security and separation of customer data

We take reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access. ChatReply limits access to personal data to those who need it, and keeps each business customer's data separate from that of other business customers.

No system can be guaranteed to be completely secure. If we become aware of a personal data breach that affects you, we will act as required by the PDPA.

10. Your rights

Subject to the PDPA, you have the right to:

• Ask for access to the personal data we hold about you.
• Ask us to correct personal data that is inaccurate, incomplete or out of date.
• Withdraw your consent to our processing of your personal data, or ask us to limit that processing.
• Stop receiving broadcast or marketing messages at any time.
• Ask us to delete your personal data, as explained in the next section.

To exercise any of these rights, email hello@cdsb.asia. We may need to verify your identity before acting on a request.

If your request concerns messages you exchanged with a business that uses ChatReply, we will pass your request to that business, because it is the data controller for that data, and we will assist it in responding.

11. How to request deletion of your data

1. Send an email to hello@cdsb.asia with the subject "Data deletion request".
2. Tell us the phone number, email address or Messenger or Instagram account the data relates to and, if you messaged a business that uses ChatReply, the name of that business.

We will confirm that we have received your request. Where CDSB is the data controller, we will delete the data unless the law requires us to keep it. Where we hold the data on behalf of a business customer, we will notify that business and delete the data on its instruction.

You can also contact the business you were messaging directly and ask it to delete your data.

12. Cookies

Our websites do not use tracking cookies, advertising cookies or analytics tools, and they do not load third-party scripts or fonts.

Like most websites, the servers that host our websites may automatically record basic technical information, such as IP address, browser type and the time of the request, in server logs. This information is used only to operate and secure the website.

13. Changes to this policy

We may update this policy from time to time. When we do, we will publish the new version on this page and change the "Last updated" date at the top. If a change is significant, we will also notify our business customers directly.

14. Contact us

For questions about this policy or about your personal data, contact:

Creative Distributions Sdn. Bhd.
Lot 23, 1st Floor, Block D, Damai Plaza 3,
Lorong Pokok Kayu Manis,
88300 Kota Kinabalu, Sabah, Malaysia
Email: hello@cdsb.asia