Privacy Policy

1. Information We Collect

1.1 Personal Identification Information

We may collect personal information when you register for or use our Services, including:

• Name, email address, phone number, and company name
• Billing and payment information (processed securely via third-party payment providers)
• Business details such as industry type and operational requirements

1.2 Customer Conversation Data

MINA AI processes messages exchanged between your business and your customers on connected messaging platforms. This may include:

• Customer names and contact numbers submitted through messaging channels
• Appointment requests, payment queries, and shipping inquiries
• Conversation logs used to deliver AI responses and improve service quality

Our business clients ("Partners") act as data controllers for their customers' data. MINA AI processes this data on behalf of Partners in accordance with our service agreements.

1.3 Non-Personal / Technical Information

We may collect non-personal information including browser type, device type, IP address, operating system, pages visited, and usage patterns when you interact with our website or platform dashboard.

1.4 Cookies

Our website uses cookies to enhance user experience and gather analytics data. You may disable cookies in your browser settings, though some features of the website may not function correctly as a result.

2. Consent

In accordance with the PDPA 2010, we will only process your personal data with your consent, except where permitted by law. Consent may be given expressly (e.g. by agreeing to this Privacy Policy or signing a service agreement) or implicitly through continued use of the Services.

You have the right to withdraw your consent at any time by contacting us at the details provided in Section 15. Please note that withdrawal of consent may affect our ability to continue providing the Services to you. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal.

3. Notice and Choice

In accordance with the Notice and Choice Principle under the PDPA 2010, we will inform you of the following at or before the time of collection:

• The types of personal data being collected
• The purposes for which your personal data is being collected and processed
• Your right to request access to and correction of your personal data
• Whether your personal data will be disclosed to any third parties
• Whether it is obligatory or voluntary for you to supply your personal data, and the consequences of failing to supply it

You may choose not to provide certain personal data, though this may limit your ability to access or use certain features of the Services.

4. How We Use Your Information

We use collected information for the following purposes:

• To provide, operate, and improve the MINA AI platform and its features across all applications and services
• To process and respond to customer inquiries on behalf of our business clients
• To facilitate appointment bookings, payment coordination, and shipping updates
• To send service-related communications, updates, and notifications
• To monitor platform performance, detect errors, and troubleshoot technical issues
• To comply with applicable laws and regulations in Malaysia, including the PDPA 2010
• To protect the security and integrity of our platform and users
• To conduct analytics to understand how our Services are used and how to improve them

We will not use your personal data for any purpose other than those stated above without first obtaining your consent.

5. Sensitive Personal Data

Under the PDPA 2010, certain categories of data are classified as sensitive personal data, including physical or mental health information, political opinions, religious beliefs, and biometric data. MINA AI does not intentionally collect sensitive personal data as part of its core Services.

If sensitive personal data is incidentally shared by a user or customer through a conversation on the platform, we will treat such data with a higher standard of care and will not process it beyond what is strictly necessary to deliver the Services. Explicit consent will be sought where required by law.

6. Sharing Your Information

6.1 With Service Providers

We do not sell your personal information. We share data only as necessary to deliver our Services, including with:

• Messaging platform providers (e.g. Meta for WhatsApp and Instagram integrations) to route conversations
• Payment service providers for transaction processing
• Cloud infrastructure and hosting providers that support platform operations

All third-party service providers are contractually obligated to protect your data and use it only for the purposes specified, consistent with the Disclosure Principle under the PDPA 2010.

6.2 Legal Compliance

We may disclose your information where required by law or in response to valid legal processes, including requests from Malaysian regulatory authorities such as the Department of Personal Data Protection (JPDP), or where disclosure is necessary to protect the rights, safety, or property of Nexgentech, our clients, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify affected users via email or a prominent notice on our website before such a transfer takes effect.

7. Data Integrity

In accordance with the Data Integrity Principle under the PDPA 2010, we take reasonable steps to ensure that the personal data we process is accurate, complete, not misleading, and kept up to date. We rely on you to provide accurate information and to notify us of any changes to your personal data.

If you believe that any personal data we hold about you is inaccurate or incomplete, you may submit a correction request to us using the contact details in Section 15.

8. Data Security

In accordance with the Security Principle under the PDPA 2010, we take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, disclosure, alteration, or destruction. This includes:

• SSL/TLS encryption for all data transmitted through our platform
• Restricted access controls for internal team members
• Regular security monitoring and vulnerability assessments

While we implement strong security practices, no method of data transmission over the internet is completely secure. You transmit information at your own risk, and we cannot guarantee absolute security. In the event of a data breach that is likely to affect your rights and interests, we will notify you and the relevant authorities as required under applicable law.

9. Data Retention and Deletion

In accordance with the Retention Principle under the PDPA 2010, we will not retain personal data longer than is necessary for the fulfillment of the purposes for which it was collected, or as required by law.

We will delete or permanently anonymise your personal data without undue delay in the following circumstances:

• Upon your written request for deletion submitted to us via the contact details in Section 15
• Upon closure or termination of your account with us
• Upon the termination of a business client's service agreement, in respect of their customers' data processed through MINA AI
• When the data is no longer required for the purpose for which it was collected and no legal retention obligation applies

Where data has been shared with third-party service providers, we will take reasonable steps to ensure those providers also delete the relevant data in accordance with our contractual agreements with them. Once personal data is no longer required, it will be destroyed or permanently deleted in a secure manner.

10. Your Rights

Under the PDPA 2010, you have the following rights in relation to your personal data:

• Right to Access — You may request a copy of the personal data we hold about you
• Right to Correction — You may request that inaccurate, incomplete, or outdated personal data be corrected
• Right to Withdraw Consent — You may withdraw consent to the processing of your personal data at any time
• Right to Limit Processing — You may request that we limit the processing of your personal data in certain circumstances
• Right to Deletion — You may request deletion of your personal data, subject to any applicable legal retention requirements
• Right to Complain — You may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your rights under the PDPA have been violated

To exercise any of these rights, please submit a written request to us at the contact details in Section 15. We will respond within 21 days as required under the PDPA 2010. A processing fee may apply for access requests as permitted by law.

11. Children's Privacy

MINA AI Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us immediately and we will take steps to remove such information promptly.

12. Third-Party Platforms

MINA AI integrates with third-party messaging platforms including WhatsApp, Instagram, and Facebook Messenger. Your use of those platforms is also subject to their respective privacy policies. We are not responsible for the data practices of these third parties.

Links to third-party websites on our platform are provided for convenience only. We do not control those sites and are not responsible for their content or privacy practices.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will notify registered users via email or through the platform dashboard.

Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Malaysia, including the Personal Data Protection Act 2010 (Act 709). Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Malaysia.

For matters relating to personal data protection, you may also contact the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.

15. Contact Us

If you have any questions, concerns, access requests, or correction requests regarding this Privacy Policy or your personal data, please contact our designated Personal Data Officer:

We will endeavour to respond to all enquiries within 5 business days, and to all formal data access or correction requests within 21 days as required under the PDPA 2010.