Privacy Policy

1. Who we are

Tapost Sdn. Bhd. is the data user responsible for your personal data. You can contact us at [email protected] — please put “Personal data” in the subject line.

2. Personal data we collect

• Account data: your name, email address and password (stored only in hashed form by our sign-in provider). If you sign in with Google: your Google name, email address and profile picture.
• Business and brand data: your company and brand names, what you sell, your selling points and customers, country, language, brand colours, logos and settings. This may include personal data where the business is you.
• Content you provide: briefs, photos, videos, documents, logos and other uploads, and the captions, images and videos we generate for you. These may show or describe people.
• Brand Characters: the descriptions, reference photos and generated reference images of characters you create. We use them to draw the character. We do not create face-recognition templates or use them to identify anyone.
• Public information you ask us to read: when you give us links to your website, Facebook, Instagram or TikTok, we read the publicly available content (such as names, bios, posts and images) to set up your brand.
• Connected accounts: when you connect a social account for posting, its account name and identifiers and the status and results of your posts. Access tokens are held by our posting provider.
• Telegram: your Telegram user ID, username, group and topic IDs, and the messages and files you send to our bot or in project topics.
• Usage and technical data: IP address, approximate country, browser and device information, log and security data, the features and AI actions you use, credit balances and transactions, and when you were last active.
• Communications: messages, feedback (including any screenshots you attach) and support requests.
• Cookies: we use cookies that are strictly necessary to sign you in and keep your session secure, and analytics cookies to understand how visitors find and use the Service. We do not use advertising cookies.

We do not knowingly collect sensitive personal data (such as data about health, religious beliefs or biometrics). Please do not upload it unless your content needs it and you have the right to do so.

3. Where we get it from

Directly from you; automatically when you use the Service; from Google when you sign in with Google; from the public pages you point us to; from members of your team who add content to your workspace; and from third-party services you connect.

4. Why we use it

• to create and manage your account and workspace;
• to provide the Service — generating, editing, storing, exporting and publishing content on your instruction;
• to tailor the Service to your brand;
• to manage credits, plans and payments;
• to send service messages, such as sign-up confirmation, password resets and notifications by email or Telegram;
• to give support and respond to feedback;
• to keep the Service secure, prevent fraud and abuse, and enforce our Terms;
• to monitor performance, fix problems and improve the Service (we do not use your content to train AI models);
• to comply with the law and legal processes; and
• with your consent, to send you news and offers — you can opt out at any time.

5. Is giving us your data obligatory?

Your email address and a password (or Google sign-in) are obligatory to create an account, and business information and uploads are needed for the features that use them. If you do not provide obligatory data, we cannot provide the Service to you. Everything else is voluntary.

6. Who we disclose it to

We do not sell personal data. We disclose it only to:

• service providers who process it for us under contract;
• social platforms, when you publish content to them (publicly, as you choose);
• members of your workspace, and anyone you choose to share content with;
• our professional advisers, auditors and insurers;
• authorities and courts, where the law requires it or to protect rights and safety; and
• a buyer or successor of our business in a merger or acquisition, under confidentiality.

7. Transfers outside Malaysia

Our service providers are located outside Malaysia (for example in Singapore and the United States). We transfer personal data outside Malaysia only as permitted by section 129 of the PDPA — including where the receiving country has laws substantially similar to the PDPA or ensures an adequate level of protection, where we have taken reasonable precautions and exercised due diligence (including contractual protections), or where you have consented. By agreeing to this notice, you consent to these transfers.

8. AI processing

To produce results for you, we send the content each request needs to our AI providers. We do not use your content to train AI models, and we do not authorise our AI providers to use it for training. They may keep it for a limited time, under their own terms, to provide their service and to monitor abuse.

AI results are generated automatically. They are not decisions about you that have legal or similarly significant effects.

9. How long we keep it

We keep personal data while your account is active and for as long as the purposes above need it. Projects and uploads you delete are removed from our storage, and logs are kept for a limited period. After your account is closed, we delete or anonymise your personal data within a reasonable period, except where the law requires us to keep it longer (for example, financial records for seven years) or where we need it to resolve a dispute. Backups are overwritten on a rolling basis.

10. Security

We take reasonable practical steps to protect personal data, including encryption in transit, access controls, row-level security in our database, hashed passwords and limited staff access. No method is completely secure.

If a personal data breach happens, we will notify the Personal Data Protection Commissioner and the affected users where the PDPA requires it.

11. Your rights

Subject to the PDPA, you may:

• ask for access to, and a copy of, your personal data;
• ask us to correct personal data that is inaccurate, incomplete or misleading;
• withdraw your consent (this may mean we can no longer provide the Service to you);
• limit how we process your data, including stopping direct marketing;
• ask us to transmit your data to another data user, where applicable; and
• ask us to stop processing that is likely to cause you damage or distress.

Send requests to [email protected]. We will respond within the time the PDPA requires (generally 21 days). We may need to verify your identity, and we may refuse a request where the PDPA allows it — if we do, we will tell you why.

12. Personal data of others you upload

If you put other people's personal data into the Service (for example customers, staff or models), you are the data user for that data and we process it on your behalf only to provide the Service. You are responsible for giving them notice and obtaining any consent required.

13. Children

The Service is not for anyone under 18, and we do not knowingly collect their personal data. If you upload content showing children, you must have the consent of their parent or guardian.

14. Changes to this notice

We may update this notice. We will change the date at the top and, for a material change, ask you to agree before you continue to use the Service.

15. Contact us and complaints

For any question, request or complaint about your personal data, contact [email protected]. If you are not satisfied with our answer, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.

16. Language

This notice is issued in English and Bahasa Malaysia. If there is any inconsistency between them, the English version prevails.