Privacy Policy

1. Introduction and Governing Law

Welcome to Jong, a service provided by (company no. ), ("we," "our," "us"), incorporated in Malaysia. We are committed to protecting your privacy in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and the other data-protection laws that apply to us, such as the GDPR where it applies. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our landing page, consumer mobile/web application, and merchant web application (collectively, our "Services").

Who is responsible for your data: for the data of people who use our Services directly — including business account holders, their team members, and anyone who contacts us — is the data controller. When you use an app, website or service flow that a business has built with our Flow product, that business is the controller of the data you give it, and we process that data on its behalf as its processor (see Schedule A).

We process your information only on the legal bases described in Section 3.

2. Information We Collect

We may collect information about you in a variety of ways to provide and improve the Services:

2.1. Registration and Personal Data

Personally identifiable information, such as your name, email address, phone number, and demographic information. This data is voluntarily provided when you register, create a profile, or set up biometric identification methods for enhanced security.

2.2. Interaction, Transactional, and Behavioral Data

Information automatically generated by your use of the Services, which is essential for the AI Agents and core platform functions (including personalized responses, historical data recall, and fulfillment):

• AI Interaction Data: All conversational prompts, voice inputs, and file attachments submitted to the Jong chatbot. This data is collected and retained for context management and fulfilling your intent.
• Transaction History: Detailed records of all past orders, bookings, e-commerce purchases, service requests, associated addresses, and transaction status. This data forms the basis for personalized actions and future requests.
• User Preferences & Context: Data inferred from your historical usage and explicit preferences (such as sharing settings, accessibility requirements, and preferred payment method).
• Metrics Queries: Prompts related to personal spending habits, business performance, and data analysis.
• Log and Technical Data: Your IP address, device ID, browser and operating system details, access times, and diagnostic data related to application performance, crashes, or service errors.

2.3. Financial Data and Payment Processing

We do not directly collect or store sensitive financial information (such as full credit card numbers). All payment information is provided directly to our secure, PCI-compliant third-party payment processors. Our business records only retain the necessary transaction identifiers and payment channel details for accounting and commission management.

2.4. Data from AI Interactions (Prompts)

Your conversational prompts, queries, and voice inputs are collected and processed by our AI Agents, including Metrics Queries used to generate personalized reports and charts. This data is used solely to fulfill your specific intent; we do not use it to train AI models (Section 11).

2.5. Merchant & Business Data

For Merchants using the Business Portal, we collect detailed business registration information, product catalogs, inventory levels, sales metrics, customer review data, and pricing schedules. This data is processed by the AI Assistant for automated onboarding, inventory management, and strategic sales analysis.

2.6. Identity Verification Data

Where you offer products or services through our marketplace, we collect and check the trader-identity information the law requires: your legal name, registered address, phone and email; your trade register and registration number; a copy of an identification document or an equivalent electronic identification; and your self-certification. We check that the document is genuine and matches the details you gave. We do not perform facial recognition or biometric face matching.

3. How We Use Your Information (The Legal Basis)

We process your data primarily to perform our contract with you and for legitimate business interests. Specifically, we use information collected about you via the Services to:

• Service Fulfillment: Create, manage, and process purchases, orders, and services accessed via the unified AI interface.
• Personalization & Intent: Analyze your prompts and historical data to understand your intent and provide highly personalized, multi-step actions.
• Platform Improvement: Compile anonymous statistical data and aggregated analysis to improve the efficiency, operation, and accuracy of our AI models and services.
• Merchant Support: Automate onboarding, inventory syncing, price comparison, and sales forecasting for Merchants via the AI Assistant.
• Communication: Email you regarding your account, order status, security updates, or policy changes.
• Security: Prevent fraudulent transactions, monitor unauthorized access, and ensure account integrity.
• Identity Verification and Marketplace Listing: Verify the legal identity of businesses that offer through our marketplace and decide listing eligibility. Our legal basis is our legal obligation under the Digital Services Act and applicable tax-reporting rules (Article 6(1)(c)) together with the performance of our contract with you (Article 6(1)(b)); related fraud prevention rests on our legitimate interests (Article 6(1)(f)).

4. Disclosure and Sharing of Your Information

We share your information only when necessary to fulfill your request or for legal compliance:

4.1. Sharing with Merchants and Businesses

To fulfill a transaction, we must share necessary information with the relevant third-party Merchant or Business. This typically includes your pickup/delivery address, contact number, name, and the specific items or services ordered. We only share the minimum data required to complete the specific transaction.

4.2. Third-Party Service Providers

We share your data with service providers that process it for us: cloud hosting and AI (Google Cloud), app notifications (Google Firebase), payments (Stripe), email (Mailgun), the edge network (Cloudflare) and professional advisors. The current list, with where each provider processes data and the safeguard we rely on, is at /main/subprocessors.

4.3. Legal Compliance and Protection

We may disclose your information if legally required to do so by the laws of Malaysia or of another country whose law applies to us, or if we believe it is necessary to respond to legal processes, investigate violations of our Terms, or protect the rights, property, and safety of our Company, our Merchants, or the public.

4.4. Identity Verification Recipients

To carry out identity verification and meet our marketplace obligations, your trader-identity information may be shared with our verification staff; our cloud hosting provider; competent authorities on a substantiated request under the Digital Services Act, Article 30(6); and tax authorities where reporting rules apply.

5. Your Privacy Rights

Wherever you live, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of any inaccurate or incomplete data we hold about you.
• Withdrawal of Consent: Withdraw your consent for processing where consent is the legal basis. Withdrawing consent may restrict your access to certain services.
• Erasure ("Right to be Forgotten"): Request the deletion of your personal data, subject to certain legal obligations such as transaction records required for tax or accounting purposes.

Erasure and legal holds: We will act on an erasure request except where we must keep specific information to meet a legal obligation, such as trader-identity records we are required to retain. Where we keep something on that basis, we will tell you what we keep and for how long.

The law of your country may give you further rights; Section 9 describes them. To exercise any right, contact us as Section 12 describes. We confirm your identity before we act, answer within the time the law that applies to you sets, and will not treat you less favourably for exercising your rights. If you are not satisfied with our answer, you may complain to the data-protection authority in your country.

6. Data Security and Retention

We implement administrative, technical, and physical safeguards to protect your personal information against accidental loss and unauthorized access. However, given the nature of the internet, we cannot guarantee the absolute security of your data. We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, or as required by Malaysian law.

Identity documents: An identification document you provide for verification is deleted within 30 days of our decision, and in any event no later than 6 months after our relationship with you ends. A record of what was checked and when is kept for longer where tax or record-keeping law requires it.

AI conversations: the text of your AI chats is kept for up to 39 days; after that only short summaries remain so a conversation can continue. Encrypted backups roll off within 14 more days. You can pin a personal conversation to keep its summary; a personal conversation with no new message for 30 days is otherwise deleted. You can delete a conversation at any time. When the AI takes an action on a Flow, we keep a record of that action, without message text, for 400 days for security.

Billing records: invoices and payment records are kept for 7 years to meet tax law. If you ask us to erase your account, we remove your name and contact details from them.

Consent records: proof of what you agreed to is kept until 3 years after the contract ends.

7. Policy for Children

Our Services are only for people aged 18 or over. When you sign up you confirm that you are 18 or over, and we record that confirmation. We do not knowingly collect personal data from anyone under 18. Businesses may not publish Flows or Flow AI features aimed at people under 18. If you believe a child has given us personal data, contact us and we will delete it.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the effective date. Where a change materially affects how your data is handled, we will also notify affected users directly. You are advised to review this Privacy Policy periodically.

This Privacy Policy is written in English. Where we provide a translation, such as the Bahasa Melayu version, it is for your convenience; if the two differ, the English version prevails, except where the law requires otherwise.

9. Your Rights by Country

Depending on where you live, the law gives you the rights below in addition to those in Section 5. We honour them for the people they protect, whether we are your controller or we refer your request to the business that is (Schedule A).

9.1. European Union and European Economic Area

Under the General Data Protection Regulation (GDPR) you have the right to access your data, to have it corrected or erased, to restrict or object to our use of it, to data portability, to withdraw consent at any time, and not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. You may object at any time to direct marketing. The legal bases we rely on are listed in Section 3. You may complain to the supervisory authority where you live or work.

9.2. United Kingdom

The same rights apply under the UK GDPR and the Data Protection Act 2018. You may complain to the Information Commissioner's Office (ICO).

9.3. Malaysia

Under the Personal Data Protection Act 2010, as amended in 2024, you have the right to access and correct your personal data, to withdraw consent, to ask us to stop processing that is likely to cause you damage or distress, to stop direct marketing and, where the Act provides for it, to data portability. This Privacy Policy is available in Bahasa Melayu and English. You may complain to the Personal Data Protection Commissioner.

9.4. Singapore

Under the Personal Data Protection Act 2012 you have the right to access your personal data and information about how it has been used or disclosed in the past year, to have it corrected, and to withdraw consent. Marketing messages to Singapore telephone numbers follow the Do Not Call rules. You may complain to the Personal Data Protection Commission.

9.5. Indonesia

Under Law No. 27 of 2022 on Personal Data Protection you have the right to information about our processing, to access, correct and delete your data and to receive a copy of it, to withdraw consent, to object to decisions based solely on automated processing, and to have processing restricted, subject to the exceptions in that law.

9.6. India

Under the Digital Personal Data Protection Act 2023, as its provisions apply, you have the right to information about the processing of your data, to have it corrected, completed, updated and erased, to have your grievances addressed, and to nominate another person to exercise your rights if you die or become incapacitated. You may take an unresolved grievance to the Data Protection Board of India.

9.7. Japan

Under the Act on the Protection of Personal Information (APPI) you may ask us to disclose, correct, add to or delete the personal data we hold about you, to stop using it or providing it to third parties where the law allows, and for information about the personal data protection system of a foreign country your data is transferred to.

9.8. South Korea

Under the Personal Information Protection Act (PIPA) you have the right to access, correct and delete your personal information, to have its processing suspended, to withdraw consent, and to refuse, or ask for an explanation of, automated decisions that significantly affect you.

9.9. Brazil

Under the General Data Protection Law (LGPD) you have the right to confirmation that we process your data, to access and correct it, to have unnecessary or excessive data anonymised, blocked or deleted, to data portability, to information about whom we share it with and about the consequences of refusing consent, and to withdraw consent. You may petition the National Data Protection Authority (ANPD).

9.10. United States

Depending on the state you live in, including California under the California Consumer Privacy Act as amended by the California Privacy Rights Act, you may have the right to know what personal information we collect, use and disclose, to access, correct and delete it, to limit the use of sensitive personal information, to opt out of its sale, of its sharing for cross-context behavioural advertising and of targeted advertising, and to appeal our decision on your request. We do not sell personal information. If we ever share it for cross-context behavioural advertising, we will say so here first and let you opt out, including through an opt-out preference signal such as Global Privacy Control where the law requires. We will not discriminate against you for exercising these rights, and you may act through an authorised agent.

9.11. Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws, including Quebec's Act respecting the protection of personal information in the private sector, you have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual limits. You may complain to the Office of the Privacy Commissioner of Canada or to your provincial commissioner.

9.12. Australia

Under the Privacy Act 1988 and the Australian Privacy Principles you have the right to access and correct your personal information. We may disclose personal information to recipients outside Australia, in the places described in Section 10 and on our sub-processor list. You may complain to us first and then to the Office of the Australian Information Commissioner (OAIC).

9.13. Other countries

If you live elsewhere, you have the rights your local law gives you. Contact us as Section 12 describes and we will apply them.

10. Where Your Data Is Stored and International Transfers

Your account data, billing records and personal AI conversations are stored at rest in your home region, which follows your country. Short-lived technical data, such as your sign-in session and queued tasks, is held for a limited time in the region that serves your request, which is normally your home region but can be another region, for example while you travel. A Flow's data is stored at rest in the storage region set when the flow was created, even if you are in another country; that region cannot be changed afterwards, and the business that runs the flow is responsible for telling you where it is. Some processing happens elsewhere: payments are processed by Stripe in the United States, emails by Mailgun in the United States, network traffic passes through Cloudflare's global edge, and AI requests are processed by Google Vertex AI through Google's global endpoint, which means the AI processing itself may happen outside your region. Our staff in Malaysia may access data to verify identities and support the Services, and every such access to personal data is logged. Where data moves between countries, we rely on the safeguard listed for each provider at /main/subprocessors — standard contractual clauses, the Data Privacy Framework or, for Malaysian data, a transfer impact assessment — so your data keeps an equivalent level of protection.

11. Artificial Intelligence Features

When you use an AI feature you are talking to an AI system, not a person, and the chat says so. AI answers can be wrong, so check important information.

We do not use your conversations to train AI models. We do not use Google's "Advanced AI" models, whose terms share prompts with the model maker. Google may keep prompts that its safety systems flag for up to 90 days, in the same region, to investigate abuse.

We do not use AI to make decisions about you that have legal or similarly significant effects. Our rules forbid businesses from using Jong AI to decide on hiring, credit, insurance, housing, education, health or public benefits.

12. Contact Us

If you have questions or comments about this Privacy Policy or your data rights, please contact our Data Protection Officer:

Data Protection Officer
Email:
General enquiries:

Our representatives in the European Union and the United Kingdom under Article 27 of the GDPR and of the UK GDPR, and our legal representative under Article 13 of the Digital Services Act, will be designated and named here once appointed.

Schedule A — Flow

This Schedule applies in addition to the sections above when you use an app, website or service flow that a business has built with our Flow product.

When you submit information through a business's flow — a booking, an order, an enquiry, a claim, a form — the business operating that flow is the data controller for the information collected, and acts as the data processor, processing it only to operate the flow on that business's behalf. Each flow shows its own privacy notice, written by the business, describing what that flow collects, why, and where its data is stored; please review it before you submit. The platform-level handling, security, and retention practices in this Privacy Policy continue to apply to that data.

A flow's data is stored at rest in the flow's storage region, which may be in a different country from yours (Section 10). To exercise your rights over data in a flow, contact the business first. If you contact us instead, we refer your request to the business and help it respond.

For Flow data we act as the business's processor under our Data Processing Addendum at /main/dpa.