Privacy Policy

VaiaReply (“VaiaReply”, “we”, “us”) is an AI assistant platform that lets small and medium businesses in Malaysia and Saudi Arabia answer customers, take orders and book appointments over WhatsApp and phone. VaiaReply is operated by Kanz Industry.

For any privacy question or request, contact us at hma@kanzindustry.com.

VaiaReply acts in two capacities, and it matters which data you are looking at:

• For business account data (the account a business owner creates with us), we are the data controller — we decide how that account data is used to provide the service.
• For end-customer data (the people who message a business that uses VaiaReply), we are a data processor. The business is the data controller: it decides why and how its customers’ data is processed, and is responsible for having a lawful basis and the necessary consent. We only process that data on the business’s behalf and on its instructions, to deliver replies and run the features it has switched on.

Business account details. When a business owner signs up we collect their name, email address, password (stored only as a secure hash), business name, business type, operating hours, locale and the knowledge they teach the AI (menus, FAQs, policies, uploaded documents). We also keep settings, team members and usage/billing metadata.

End-customer data handled for the business. When a customer contacts a business through VaiaReply, we process the content needed to answer them on the business’s behalf, including:

• WhatsApp and phone messages — text, voice notes, images and call transcripts;
• the customer’s name and phone number (as provided by WhatsApp or the call);
• order, appointment and loyalty details — items, quantities, delivery addresses, booking times, stamps and any free-text feedback the customer sends;
• derived context our AI builds to stay helpful — for example a short rolling summary of the conversation, preferred language or dialect, and ordering patterns.

We do not ask businesses to send us special-category data, and we are not designed to collect payment card details — payment processing is not part of VaiaReply today.

End-customer data is processed for one purpose: to let the business’s AI assistant understand a customer’s message and respond accurately on the business’s behalf. To do that we:

• run AI inference through large-language-model providers — Google (Gemini),Groq, OpenRouter, Cerebras, DeepInfra and Together AI (serving models such as Meta’s Llama and other open models) — to read the message and generate a reply. We route to whichever provider is available so the assistant stays fast and reliable;
• create text embeddings of the business’s knowledge and the conversation so the AI can retrieve the most relevant facts before answering (retrieval-augmented generation);
• transcribe and synthesise speech for phone calls and voice notes using Vapi and ElevenLabs (text-to-speech voices);
• send transactional notifications (e.g. new-order or escalation emails to the business) via Resend.

We do not sell personal data, and we do not use end-customer message content to train our own or third parties’ foundation models.

For business account data, we rely on the performance of our contract with the business (providing the service) and our legitimate interest in operating and securing the platform. For end-customer data, the lawful basis and any required consent (including WhatsApp opt-in and marketing consent) are the responsibility of the business as data controller; we process that data under our agreement with the business and on its instructions.

We use a small set of trusted infrastructure and AI providers to deliver the service. Each processes data only as needed to perform its function:

• Meta / WhatsApp Business Platform — message delivery and the WhatsApp channel;
• Google (Gemini), Groq, OpenRouter, Cerebras, DeepInfra and Together AI — large-language-model inference that reads messages and generates replies;
• Vapi — phone-call orchestration, speech-to-text and text-to-speech;
• ElevenLabs — text-to-speech voices for phone calls and voice replies;
• Supabase — managed PostgreSQL database hosting;
• Vercel — application hosting and serverless compute;
• Cloudflare R2 — object storage for media and uploaded documents;
• Resend — transactional email delivery.

We keep personal data only as long as it is needed for the business to operate:

• Conversation content (message bodies, transcripts, media and voice-note links, image analysis and rolling summaries) is automatically purged about 90 days after a conversation is created. After purge, message content is scrubbed and the conversation is closed; only non-identifying aggregate counts may remain for the business’s reporting.
• Erasure requests are honoured. When a customer is erased, we immediately anonymise their record (removing name, phone, date of birth, dialect, dietary flags and other identifiers), scrub the content of their messages, and clear personal details such as delivery addresses and free-text feedback from past orders. The underlying customer record is then permanently hard-deleted after a short 7-day reversal window.
• Order totals and item counts may be retained in anonymised form so the business keeps accurate sales history, but they no longer identify the customer.

To request deletion, see our Data Deletion Instructions.

Data is encrypted in transit (TLS) and at rest (AES-256) by our hosting and database providers. VaiaReply is multi-tenant by design: every record is scoped to a single business, and strict tenant-isolation guards prevent one business from accessing another business’s data. Passwords are stored only as salted hashes, access to production systems is restricted, and we apply a strict Content-Security-Policy in production.

Under Malaysia’s Personal Data Protection Act (PDPA) and the Saudi Personal Data Protection Law (PDPL), individuals have the right to:

• Access — request a copy of the personal data held about you (we can export it as a portable file);
• Correction — ask for inaccurate data to be corrected;
• Deletion / erasure — ask for your data to be deleted or anonymised;
• Withdraw consent — opt out of further messaging at any time.

If you are an end-customer, the business you contacted is the controller of your data; you can raise a request with that business, and they can fulfil it inside VaiaReply. You may also contact us at hma@kanzindustry.com and we will help route or action the request. If you are a business owner, you can action access, correction and deletion for your customers directly from the customer’s page in the VaiaReply dashboard.

VaiaReply uses only strictly necessary cookies and local storage — for example to keep you signed in, maintain your session securely, and remember interface preferences such as language and theme. We do not use advertising or cross-site tracking cookies.

Our sub-processors may store or process data on infrastructure located outside Malaysia and Saudi Arabia. Where data is transferred internationally, we rely on those providers’ contractual safeguards and security commitments to protect it to a standard consistent with the PDPA and PDPL.

VaiaReply is a business tool and is not directed at children. We do not knowingly collect personal data from children. If you believe a child’s data has reached us, contact hma@kanzindustry.com and we will delete it.

We may update this Privacy Policy as the service evolves. When we do, we will revise the “Last updated” date above. Material changes will be communicated to business account holders.

Questions or requests about this policy or your data? Email us at hma@kanzindustry.com.