Privacy Notice

1. Who we are

Webbalances Solution (003096168-D) ("we") provides MetriCRM. This notice explains how we handle personal data when you visit our website, sign up, use MetriCRM or contact us. It should be read with our PDPA Notice.

2. Our role

We act in two different roles:

• Data controller for account, billing, support and website data — this notice covers that data.
• Data processor for the content our customers store in their workspaces, such as their customers' contact details, emails and cases. Our customer decides how that data is used; if you are one of their customers, please contact that organisation. Our obligations for that data are in the Data Processing Agreement.

3. Personal data we collect

• Account data: name, work email, phone number (optional), role, language and time zone, profile picture (optional).
• Authentication and security data: hashed passwords, two-factor settings, sign-in history, IP address, browser and device information, audit logs.
• Billing data: billing contact, company name, address and tax identifiers, invoices. Card details are collected and stored by Stripe, not by us.
• Support and communications: messages you send us, contact form and demo requests.
• Usage data: features used, errors and performance information, collected without advertising or cross-site tracking.

4. How and why we use it

We use personal data only for these purposes:

• to create and run your workspace and provide the service (performance of our contract);
• to secure the service, prevent fraud and investigate errors (our legitimate interests and legal obligations);
• to bill you and keep financial records (contract and legal obligations);
• to send service and security emails, which you cannot opt out of while you have an account;
• to send product news and offers, only with your consent, which you can withdraw at any time;
• to meet legal obligations and respond to lawful requests from authorities.

5. AI features

When your organisation enables AI features, relevant workspace content is sent to the AI provider it selected to produce the result. Your administrators can turn on redaction rules that remove personal data such as IC numbers, phone numbers and card numbers first. AI providers we use do not train their models on this data. If your organisation uses its own AI provider key, that provider processes the data under its agreement with your organisation.

6. Who we share it with

We never sell personal data. We share it only with:

• service providers that host and operate MetriCRM for us, listed in the Data Processing Agreement, under contracts that require them to protect it;
• professional advisers such as auditors and lawyers, under confidentiality duties;
• authorities, where the law requires or to protect our rights or someone's safety;
• a buyer or successor if our business is reorganised or sold, who must continue to protect it as described here.

7. International transfers

Workspace databases, application servers and files are hosted in Singapore; no provider currently offers hosting in Malaysia. Some service providers, such as payment, background job and AI providers, may process limited data in other countries, including the United States. We transfer data outside Malaysia only in line with section 129 of the Personal Data Protection Act 2010, for example where the destination has substantially similar protection or where contractual safeguards are in place.

8. How we protect it

Each workspace has its own database. Data is encrypted in transit and at rest, and secrets such as mailbox passwords and API keys are additionally encrypted. Access is limited by role, protected by two-factor authentication, and recorded in audit logs. Our staff and providers are bound by confidentiality.

9. How long we keep it

• Account and workspace data: while the subscription is active, then 30 days for export, after which it is deleted.
• Backups: overwritten in the normal backup cycle after deletion.
• Invoices and billing records: 7 years, as Malaysian tax law requires.
• Security and audit logs: up to 12 months, unless needed longer to investigate an incident.
• Marketing preferences: until you withdraw consent.

10. Your rights

Under the Personal Data Protection Act 2010 you may:

• request access to the personal data we hold about you and a copy of it;
• ask us to correct data that is inaccurate, incomplete or out of date;
• withdraw consent, or ask us to limit processing, including for direct marketing;
• request your data in a structured, commonly used format where data portability applies.

11. Making a request

Email our data protection officer at dpo@webbalances.com with the subject "Personal data request". We will verify your identity and reply within 21 days. A fee may be charged for a copy only where the law allows. If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia.

12. Personal data breaches

If a breach is likely to cause significant harm, we notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it and notify affected individuals without undue delay. Where the breach affects a customer's workspace, we notify that customer so it can meet its own obligations.

13. Children

MetriCRM is a business service and is not directed at people under 18. We do not knowingly collect their data for our own purposes.

14. Cookies

We use only essential cookies. See the Cookie Policy for details.

15. Changes and contact

We will post any update here and change the date at the top; for material changes we also tell account holders by email. Questions about this notice can be sent to our data protection officer at dpo@webbalances.com, or by post to Webbalances Solution (003096168-D), Unit 6, Level 4, Setiawalk Mall (Block K), Persiaran Wawasan, Pusat Bandar Puchong, 47160 Puchong, Selangor.