Every conversation your customers have with an AI Convo chatbot involves personal data: a name, a phone number, sometimes more. This page explains, in plain English, how that data is collected, used, stored and protected under Singapore's Personal Data Protection Act. It's an operational overview, not a substitute for legal advice, our full legal notice is the Privacy Policy and PDPA Notice.
A customer sends a message on your website, WhatsApp or Facebook Messenger.
The message is processed to generate a grounded reply from your approved training material, over an encrypted connection.
If the customer shares contact details, they're stored against that conversation in your account, isolated from other businesses' data.
Data is kept for the retention period in our Privacy Policy, then securely purged unless a legal, dispute or contractual reason requires longer retention.
| Data category | Purpose | Lawful basis |
|---|---|---|
| Name, phone, email | Follow-up and service delivery | Consent given during the conversation |
| Conversation content | Answering the enquiry, quality review | Consent / contract performance |
| Usage data (device, page visited) | Service operation and improvement | Legitimate interest, disclosed in Privacy Policy |
Retention, deletion, access and correction are covered in full in the Privacy Policy and PDPA Notice.
Data is encrypted at rest (AES-256) and in transit (HTTPS/TLS), per our published Privacy Policy.
Each business's data is logically isolated from every other business on the platform, with row-level access controls.
Production data access is restricted; developers do not have standing direct access to production databases, only app-generated queries are executed.
Conversation logs are retained for the same period as the underlying data, and are available to your team for review and quality control.
Tell customers they're speaking with an AI assistant and link to your privacy notice, this is good practice and, in many cases, a PDPA expectation.
Configure the bot to ask for the minimum details required for the enquiry, not every field you could theoretically capture.
Assign someone to periodically review conversations, both for data-handling issues and answer quality.
If you believe there's been a data incident affecting your account, contact our Data Protection Officer immediately using the details in our Privacy Policy. We investigate and notify affected parties per PDPA breach-notification obligations where applicable.
Book a free demo and we'll walk through the data-handling detail relevant to your business and industry.
Tell us your industry and we'll be in touch.