Privacy Policy

1. Data we collect

• Account: name, email, phone number (if given), business name and password (stored as a hash, not the original text).
• Your customer data: leads that you or your team enter, import or receive through forms — for example name, phone number, product of interest, notes and follow-ups.
• Payments: processed by Stripe. We do not receive or store card numbers. We store the subscription reference, invoice records and the card “fingerprint” from Stripe (a code that cannot be turned back into a card number) to ensure one free trial per card.
• Activity records: important actions in the account (for example subscription changes or lead assignment) for security and dispute resolution.

2. Purposes

• Providing and operating the service, including notifications and reminders.
• Processing subscriptions and payments, and preventing abuse of the free trial.
• Sending account emails, for example verification, charge reminders and failed payments.
• Security, such as limiting repeated sign-in attempts.

We do not sell your data and do not use it for advertising.

3. Your customer data

For the leads and customer data you enter, you are the data controller under the PDPA and we process it on your behalf, following your instructions through your use of the service. You are responsible for ensuring your customers have agreed to be contacted and that their data was collected lawfully.

4. WhatsApp and AI Assistant (if enabled)

This section applies only if your business connects a WhatsApp Business number to Velto Prime.

• WhatsApp messages between your business and your customers are stored in your account so your team can read and reply to them. This includes messages sent from the WhatsApp Business app on your phone if you use phone + Velto Prime mode, to the extent Meta delivers them to us.
• Photos, audio, video and documents are currently not stored in our systems. They are fetched from Meta when opened by an authorised team member, and may no longer be available after Meta deletes them.
• Chat history and contact names: if you choose phone + Velto Prime mode and allow it in the WhatsApp Business app, Meta may copy earlier chat history (up to the period Meta sets) and contact names to your account. What is copied and for how long is decided by Meta.
• AI Assistant: if you switch it on, conversation content, summaries and the business information you enter are sent to Anthropic to produce replies, drafts and summaries. We record the usage and estimated cost of each AI call. Under Anthropic’s commercial API terms currently in force, data sent through the API is not used to train their models by default. Anthropic’s terms may change from time to time.
• The AI may reply in the name of the business or of your salesperson. It is designed not to give a false impression of its identity when asked directly.
• If a customer sends a message such as “STOP” or “berhenti”, the system flags that number and the AI and automatic follow-ups stop for it. Team members can still reply manually; you are responsible for respecting a customer’s request not to be contacted.
• Customer questions the AI could not answer are recorded so the account owner can add answers. Information used by the AI is only added when the account owner saves it; the AI is not retrained on customer messages.

For your customer data in WhatsApp, you remain the data controller under the PDPA and we process it on your behalf.

5. Third parties and data transfers outside Malaysia

We use the following providers to run the service:

• Stripe — payment processing.
• Cloudflare — application and database hosting.
• Resend — email delivery.
• Meta (WhatsApp Business Platform) — sending and receiving WhatsApp messages, if connected.
• Anthropic — AI model for the AI Assistant, if enabled.

These providers process data on servers that may be outside Malaysia, including in the United States and other countries. This means your personal data and your customer data may be transferred and processed outside Malaysia. We share data only as far as needed to provide the service, and we choose providers with published data protection and security commitments. By using Velto Prime, you acknowledge these transfers. If you enter customer data, you are responsible for informing your customers appropriately.

6. Cookies

Velto Prime uses a single cookie to keep you signed in, and remembers your chosen language. There are no analytics or advertising cookies from us. If you connect WhatsApp through Meta’s window, Meta may use its own cookies in that window, subject to Meta’s policies.

7. Retention

Account and lead data is kept while your account is active. After the subscription ends, data is kept for up to 12 months so you can come back, then deleted, and user accounts that are no longer members of any active workspace are de-identified. Payment and subscription records, records of agreement to the terms, and the card “fingerprint” (to keep the one-free-trial-per-card limit) are kept longer for accounting, disputes and abuse prevention, or where required by law.

8. Security

Connections are encrypted (HTTPS), passwords are stored as hashes, and WhatsApp connection tokens are stored encrypted. Access to data is controlled by workspace and role: one workspace’s data is not shared with another, team members usually see only the leads assigned to them, and the workspace owner can see all leads in that workspace. No system is entirely free of risk; we will inform you of an incident affecting your data as required by law.

9. Your rights

• Request a copy of your personal data.
• Correct inaccurate data (most of it can be done yourself in the app).
• Request deletion of your account and data.
• Withdraw consent — this may mean the service can no longer be provided.

Send requests to support@veltoprime.com. We will respond to data access requests within 21 days of receiving a complete request, as required by the PDPA. Other requests will be handled within a reasonable time. For customer data you entered, requests from those customers must be handled by you as the data controller; we will assist as far as reasonable.

10. Changes and contact

We may update this policy and will notify you of important changes. Questions: support@veltoprime.com or Telegram @VELTOPRIME.