Privacy Policy

Last updated 14 November 2026

Sambung is a customer messaging and CRM service run by KEVA Technologies Sdn Bhd ("KEVA", "we"), a company registered in Malaysia. This policy explains what personal data Sambung handles, why, and the choices you have. We follow Malaysia's Personal Data Protection Act 2010 (PDPA).

Who this applies to

• Workspace users: businesses and their staff who sign up and use Sambung.
• End customers: people who message a business that uses Sambung, for example on WhatsApp, Messenger or Instagram, or who fill in a Meta lead form. For this data the business is the data user (controller) and KEVA processes it on the business's behalf.

Data we handle

• Account details of workspace users: name, email address, password (stored hashed), role and language.
• Messages and contact details of end customers: phone number, profile name, message content, photos, videos and documents sent or received, and answers given in automated flows.
• Business records the workspace creates: sales stages, notes, appointments, tags, follow-ups and sale values.
• Meta advertising data the workspace connects: campaigns, ad sets, ads, spend and results, plus the ad a conversation came from (such as a click-to-WhatsApp click ID) and lead form answers.
• Access tokens for the workspace's WhatsApp, Facebook, Instagram and ad accounts, stored encrypted.
• Basic technical logs, such as request times and errors, used to keep the service running.

How we use it

• To deliver and receive messages, show them in the shared inbox and run the workspace's flows and reminders.
• To report which ads bring leads and sales, and to manage the workspace's ads when it asks us to.
• To send conversion events back to Meta when the workspace turns this on. These events contain the ad click ID or lead ID and the event type, not the customer's phone number or message content.
• To suggest or send AI-drafted replies, only when the workspace turns AI features on.
• To provide support, keep the service secure and meet legal obligations.

We do not sell personal data and we do not use end customers' messages to advertise to them.

Service providers

We use these providers to run Sambung. Each only gets the data it needs for its part of the service.

• Meta Platforms (WhatsApp Business Platform, Messenger, Instagram, Marketing API) to send and receive messages and read ad data.
• Vercel (application hosting) and Supabase (database), with servers in Singapore.
• Anthropic (AI model provider), only for workspaces that turn on AI replies.
• OpenAI (speech-to-text and text-to-speech), to turn voice notes into text and read replies aloud, only when those features are used.
• Email and notification providers to send password resets, invites and alerts.

Some providers may process data outside Malaysia. We choose providers that protect data to a standard comparable to the PDPA.

Data from Meta

Data we receive through Meta's platforms is used only to provide Sambung to the workspace that connected it, in line with Meta's Platform Terms and developer policies. A workspace can disconnect its WhatsApp number, Pages or ad accounts at any time in Settings, and we stop receiving new data from them.

How long we keep data

We keep workspace data while the workspace is active. When a workspace is closed, or deletion is requested, we delete its data within 30 days, except where the law requires us to keep it longer. Backups are overwritten on a rolling basis.

Security

Data is sent over encrypted connections. Access tokens are encrypted in the database, passwords are hashed, and incoming webhooks are checked against Meta's signature before they are processed.

Your rights

You can ask to see, correct or delete your personal data, or withdraw consent. End customers can also reply STOP to a business to opt out of its broadcasts. If you are an end customer, you can contact the business you messaged, or contact us and we will pass your request on. See Data deletion for how to have data removed.

Children

Sambung is a business tool and is not meant for people under 18.

Changes

We may update this policy. We will change the date above and tell workspace owners about major changes.

Contact

KEVA Technologies Sdn Bhd, Kuching, Sarawak, Malaysia. Email keva.aitech@gmail.com.