Privacy Policy

1. Introduction

Wakiroo ("we", "us", or "our") operates the Wakiroo service — an AI-powered content, scheduling and comment-reply tool for Threads and Facebook. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it. It is prepared with the Malaysian Personal Data Protection Act 2010 (PDPA) in mind.

By creating an account or using the service, you agree to the practices described here and in our Terms of Service. If you do not agree, please do not use the service.

2. Data we collect

We collect only the data needed to run the service:

• Account data — your email address, an optional full name, and a password that is stored only as a one-way cryptographic hash (never in plaintext).
• Connection data — the Threads profiles and Facebook Pages you connect through AdFlow, including account handles, display names and provider resource identifiers.
• Content you create — post drafts and scheduled/published content, AI caption drafts, reply drafts, your research profile (niche and keywords) and generated trend briefs.
• Comment data — comments and author names delivered to us by webhooks from your connected accounts, so we can show them in your inbox and draft replies.
• Usage and billing data — a usage log of AI generations and publish/send attempts (action, provider, outcome, token counts and an estimated cost), plus payment records (order number, plan, amount, status and gateway reference). We do not store your card or bank details — those stay with our payment provider, BayarCash.
• Technical data — your IP address (used for rate limiting and abuse protection) and standard server logs.

3. How we use your data

• To provide the service — publishing and scheduling posts, generating AI drafts, and sending approved replies on your behalf.
• To run trend research against the niche and keywords you configure.
• To process payments and manage your subscription.
• To secure the service — authentication, rate limiting and fraud prevention.
• To respond to support enquiries and to comply with legal obligations.

We do not sell your personal data, and we do not use it for advertising.

4. Third parties and processors

To deliver the service we share the minimum data necessary with these processors:

• AdFlow (Kobaran Teguh Sdn Bhd, Johor, Malaysia) — publishes posts, sends approved replies, and delivers comment webhooks from Threads and Facebook. Your content and reply text pass through AdFlow to reach your accounts.
• kie.ai — our AI provider (Gemini 2.5 Flash). Post topics, reply text and comment context are transmitted to generate drafts.
• Tavily — powers trend research web searches from your configured niche and keywords.
• BayarCash (Webimpian) — processes payments. Your bank or card details are entered on BayarCash's payment pages and never reach our servers.

Where personal data is transferred outside Malaysia, we rely on the applicable PDPA cross-border transfer provisions and contractually require our processors to protect the data.

5. AI processing

AI features transmit the content you provide (topics, comment text, tone guidance) to our AI provider to generate drafts. Replies are human-in-loop: a draft is a suggestion that you review, edit and approve before it is published or sent. Please do not include sensitive personal data (identity card numbers, financial details, health information) in content you process through the service, and always review AI output for accuracy before posting.

6. Data retention

We keep your data for as long as your account is active, and for as long as needed to provide the service, manage billing, and meet legal and accounting obligations (payment records are kept for the period required by Malaysian law). When an account is closed or deactivated, we take reasonable steps to delete or anonymise your personal data, except where retention is legally required.

7. Your rights

Under the PDPA you may request access to, correction of, or deletion of your personal data, and you may withdraw consent where processing relies on it. To exercise any of these rights, contact us at info@wakiroo.com. We will respond within the timeframe required by law.

8. Security

• All traffic is encrypted in transit (HTTPS).
• Passwords are stored as one-way hashes; we cannot read your password.
• Provider webhooks are verified with signed payloads.
• Access to the service is authenticated per user, and administrative functions are restricted by role.

No method of transmission or storage is completely secure, but we apply reasonable technical and organisational measures to protect your data.

9. Local storage

We use your browser's local storage to keep a session token so you stay signed in. We do not use third-party advertising cookies or cross-site tracking.

10. Children

The service is intended for users aged 18 and over who manage their own or their clients' business accounts. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. The revised version will be published on this page with a new "last updated" date, and significant changes will be highlighted in the app.

12. Contact us

Questions about this policy or your personal data can be sent to info@wakiroo.com.

Wakiroo is currently in beta and operates under the Wakiroo brand. If a registered legal entity is formed later, the operator details on this page will be updated.