Home

Privacy Policy

Last updated: July 15, 2026

1. Who We Are

Maloha Coast Sdn Bhd ("we", "us", "our") operates AI-powered services including a Discord application and WhatsApp-based conversational assistants. We are committed to protecting your privacy and being transparent about how we handle data. This policy explains what information we collect across all our services, how we use it, and your rights.

2. Data We Collect

Discord Bot

When you interact with our Discord application, we may collect:

Data	Purpose
Discord User ID	To identify users, track usage limits, and personalise responses.
Discord Server ID	To associate the Bot with the correct server and its configuration.
Channel ID	To route responses to the correct conversation.
Message Content	To generate AI responses. Messages directed at the Bot (mentions, commands) are processed in real time.
Command & Usage Logs	To monitor performance, debug issues, and improve the service.

WhatsApp Services

When you interact with our WhatsApp-based services (such as restaurant reservation and ordering assistants), we access the following through the Meta Business / WhatsApp Cloud API:

Data	Purpose
WhatsApp User Phone Number	To identify your conversation session and associate your requests (bookings, orders) with you.
Message Content	To understand and fulfil your requests — such as reservation details, order items, and preferences. Messages are processed to extract booking or ordering information.
WhatsApp Profile Name	To personalise responses and confirm your identity during transactions.
Message Timestamps	To manage conversation state and enforce booking/payment time windows.

We access this data solely through Meta's official WhatsApp Business API and only when you initiate a conversation with our business number. We do not access your contacts, media library, location, or any other data on your device.

3. How We Use Data

• Service Delivery — Processing your messages to generate AI responses and fulfil requests (reservations, orders, customer support) is the core function of our services.
• Transaction Processing — For WhatsApp services, your data is used to create, modify, and confirm bookings or orders with the business you are contacting.
• Improvement — Aggregated, anonymised usage patterns help us improve our services' performance and reliability.
• Security & Abuse Prevention — We monitor for misuse, spam, and violations of our Terms of Service.

We do not sell your data. We do not use your data for advertising. We do not build user profiles for commercial purposes. We do not use your WhatsApp data to contact you outside the context of your initiated conversation.

4. Data Storage & Retention

Data is stored on secure servers and retained only as long as necessary:

• Message content — Processed in real time; not stored beyond the session unless required for transaction records or debugging.
• WhatsApp phone numbers & profile names — Retained for the duration of the active conversation and for up to 90 days to support follow-up inquiries and transaction verification.
• Booking & order records — Retained by the business you transact with according to their own data policies. Our systems retain transaction metadata (reservation ID, timestamp, status) for operational auditing.
• Discord User & Server IDs — Retained while the Bot is active on your server.
• Usage logs — Retained for up to 90 days for operational purposes.

5. Third-Party Services

To deliver our services, we rely on the following third parties:

• AI Model Providers (such as Anthropic and DeepSeek) — Your messages may be transmitted to these providers solely for the purpose of generating a response. We select providers that do not use API-submitted data for model training. You can request details about our current providers at any time.
• Meta Platforms, Inc. — Our WhatsApp services operate through Meta's WhatsApp Business API. By using these services, your data is also subject to WhatsApp's Privacy Policy. Meta provides the underlying messaging infrastructure; we control how messages are processed once received.
• Business Clients — For WhatsApp services deployed on behalf of a business (e.g., a restaurant), your booking or order details are shared with that business to fulfil your request. The business's own privacy practices apply to data they retain.

We do not share your data with any other third parties except as required by law.

6. Legal Basis for Processing

We process your data on the following legal bases:

• Consent — By initiating a conversation with our WhatsApp business number or adding our Discord Bot to your server, you consent to the processing described in this policy.
• Legitimate Interest — Processing necessary to deliver the service you requested, prevent fraud, and improve our systems.

You may withdraw consent at any time — see Section 7.

7. Your Rights

You have the right to:

• Request a copy of any personal data we hold about you.
• Request correction or deletion of your data.
• Withdraw consent and object to processing.
• For Discord: remove the Bot from your server to stop all data collection.
• For WhatsApp: stop messaging our business number to end data collection. You may also block or report our number through WhatsApp.

To exercise these rights, contact us at info@malohacoast.com. We will respond within 30 days. For WhatsApp-specific concerns, you may also contact Meta through the WhatsApp application.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), encrypted storage of credentials, and restricted access controls. Our systems are self-hosted on secured infrastructure with access limited to authorised personnel.

9. Children's Privacy

Our services are not intended for users under 13 years of age. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us immediately.

10. International Data Transfers

Your data may be processed in servers located in Singapore, the United States, and Malaysia. We ensure appropriate safeguards are in place for any cross-border data transfers in compliance with applicable data protection laws, including Malaysia's Personal Data Protection Act 2010 (PDPA).

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via our website or direct notification where feasible. Continued use after changes are posted constitutes acceptance.

12. Contact

For privacy-related inquiries: info@malohacoast.com
Maloha Coast Sdn Bhd · Malaysia