Privacy Policy

Last updated: 27 October 2026

This Privacy Policy explains how Vondris Sdn. Bhd. (“Vondris”, “we”, “us”) collects, uses, stores, shares and protects personal data when you visit vondris.io, use the Vondris WhatsApp front desk service (the “Service”), or message a business that uses Vondris. It also explains how we handle data we receive from Google APIs and the limited events we report to Meta.

1. Who we are

Vondris Sdn. Bhd. is a company incorporated in Malaysia (registration no. [SSM NO.]), with its registered address at [REGISTERED ADDRESS]. Vondris provides a WhatsApp front desk for businesses such as beauty salons, spas, aesthetic clinics and physiotherapy centres. An AI assistant answers the business’s WhatsApp messages, answers common questions, books appointments into the business’s calendar and sends reminders. Staff record attendance and payments, so the business can see which enquiries and ads lead to visits and revenue.

We process personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (as amended) and other laws that apply to us.

2. Our role

• Customers and website visitors. For data about the businesses that sign up for Vondris (and their staff) and about visitors to our website, Vondris decides how the data is used and is responsible for it.
• People who message a business. When you message a business that uses Vondris, we process your data on behalf of that business, under its instructions and our agreement with it. The business is responsible for that data. If you have questions about how a business uses your data, please contact the business directly; we will help them respond.

3. Data we collect

From our customers (businesses and their staff)

• Account details: name, work email, phone number, business name and address, role, login credentials.
• Business configuration: opening hours, services, prices, practitioners, booking rules and knowledge-base content you give us.
• Billing details: billing contact and transaction records. Card payments are handled by our payment provider; we do not store full card numbers.
• Connected accounts: data from services you choose to connect, such as WhatsApp Business (through Meta) and Google Calendar (see section 4).
• Support communications and feedback.

From people who message a business

• WhatsApp number and profile name.
• Messages exchanged with the business, whether answered by the AI assistant or by staff, including chat history the business chooses to bring in when it connects.
• What you tell the assistant, such as your name, the service you want, preferred times and any message for staff.
• Appointment details (date, time, service, practitioner), and your replies to reminders.
• Attendance and the amount paid, as recorded by the business’s staff.
• If you started the chat from a Facebook or Instagram ad: the ad referral information Meta provides, such as the ad identifier and a click identifier.
• Your choices about receiving promotional messages (opt-in and opt-out).

From website visitors

• Information you send us, for example by email.
• Technical data such as IP address, browser type, pages viewed and referring site, collected through server logs by our website host.

4. Google user data

A customer can connect a Google account so the assistant can book appointments into the customer’s Google Calendar. This section explains exactly what we do with that data.

What we access

• Your basic Google account information (email address) to identify the connected account.
• The list of calendars you choose to use for bookings.
• Free/busy times and events on those calendars, so the assistant offers only times that are actually available.

How we use it

• To check availability when someone asks for an appointment.
• To create, update or cancel calendar events for appointments booked, moved or cancelled through Vondris.
• To show you the bookings Vondris has made in your Vondris dashboard.

We use Google user data only to provide and improve these user-facing booking features. We do not use it for advertising, we do not sell it, and we do not use it to determine creditworthiness or for lending. Google user data is never included in the events we report to Meta (section 5).

How we store it

• OAuth tokens are encrypted at rest and used only by our booking service.
• For events we create, we store the event ID and booking details needed to manage that appointment. For other events, we read availability when needed and do not keep copies of event titles, descriptions or attendees beyond short-lived caching.

How we share it

• Available time slots are passed to the AI language model service that runs the conversation (see section 7), only so the assistant can offer those times.
• We do not transfer Google user data to anyone else except as required by law, to protect security, or as part of a merger or acquisition with your prior consent.

Human access

Our staff do not read your Google user data unless you ask us to for support, it is needed for security purposes or to comply with law, or it has been aggregated and anonymised for internal operations.

AI model training

We do not use data obtained through Google Workspace APIs, including Google Calendar, to develop, improve or train generalised artificial intelligence or machine learning models.

Disconnecting and deletion

You can disconnect Google Calendar at any time in your Vondris settings, or revoke access at myaccount.google.com/permissions. When you disconnect, we delete your Google OAuth tokens immediately and delete any other stored Google user data within 30 days, unless we must keep it to comply with law. Events already created in your calendar stay in your calendar.

5. Reporting to Meta

A business can choose to let Vondris report results from its Facebook and Instagram ads back to Meta, through Meta’s Conversions API for Business Messaging. This helps Meta measure the business’s ads and show them to people more likely to become customers. It is off until the business turns it on.

• Which chats. Only chats that started from a Facebook or Instagram ad that opens WhatsApp.
• What is sent. The type of event (a qualified enquiry, or a purchase), the time, the amount and currency for a purchase, and the click identifier Meta attached to the chat.
• What is never sent. Treatment or service names, health conditions or other health information, message content, appointment details, or Google user data.
• Consent. The business is responsible for having a lawful basis and any consent required to report these events. For health-related businesses such as clinics and physiotherapy centres, we require the business to obtain consent before reporting is turned on for a customer.
• How Meta uses it. Meta processes these events under its own terms and policies, including the Meta Privacy Policy.

If you don’t want your visit reported, tell the business, or email privacy@vondris.io and we will stop reporting events for your WhatsApp number.

6. How we use data

• To provide the Service: answer messages and questions, book and manage appointments, send confirmations and reminders, follow up on visits, record attendance and payments, show the business its results, and hand conversations to staff.
• Where the business turns it on, to report events to Meta as described in section 5.
• To set up and manage customer accounts, bill for the Service and provide support.
• To keep the Service secure, prevent abuse and fix problems.
• To measure and improve the quality of the Service, for example by reviewing failed bookings with the customer’s permission.
• To communicate with customers about the Service, including service and policy updates. We send marketing only where allowed, and you can opt out at any time.
• To comply with legal obligations and enforce our agreements.

Promotional WhatsApp messages from a business are sent only to people who have opted in, and you can opt out at any time by saying so in the chat.

7. Sharing

We do not sell personal data. We share it only as follows:

A current list of our service providers is available on request from privacy@vondris.io.

8. The AI assistant

• The assistant tells people they are chatting with an AI assistant.
• It answers only from information the business has provided and from the business’s calendar. When it doesn’t know, it takes a message or passes the chat to staff.
• It does not give medical, clinical or financial advice, and does not recommend treatments based on symptoms. Those questions go to the business’s staff.
• Staff can take over any conversation from the WhatsApp Business app.

9. Retention

• Messages and conversation records: kept for the period the business sets in its settings, and by default for 90 days, then deleted.
• Booking, attendance and payment records: kept while the business’s account is active, so it can manage appointments and see its results.
• Events reported to Meta: we keep a record of what we sent, to avoid sending duplicates, for as long as the related booking record.
• Customer account and billing records: kept while the account is active and afterwards as long as needed for legal, tax and accounting purposes.
• When a customer closes their account, we delete or anonymise their customer data within 30 days, unless law requires us to keep it longer. Backups are overwritten on a rolling cycle.

See Data deletion for how to ask us to delete data.

10. Security

We use technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls based on least privilege, logging and monitoring. No system is completely secure, but we work to protect your data and will notify affected customers and the relevant authority of a personal data breach where required by law.

11. International transfers

We host the Service and store customer data in Malaysia. Some of our service providers process data outside Malaysia, for example Meta, which carries WhatsApp messages, and our AI language model provider, which may run in Singapore or elsewhere. When personal data is transferred outside Malaysia, we do so in line with the Personal Data Protection Act 2010, including by using providers in places with comparable data protection laws or by putting appropriate contractual safeguards in place.

12. Your rights

Subject to applicable law, you can ask us to:

• give you access to the personal data we hold about you;
• correct personal data that is inaccurate, incomplete or out of date;
• stop or limit processing, or withdraw consent you have given;
• provide your data in a format that can be transferred to another provider, where applicable;
• delete your personal data where we no longer need it.

Email privacy@vondris.io to make a request. We may need to verify your identity. If your request is about data we process for a business (for example, your chats with a salon or clinic), we will pass it to that business and help them respond. We aim to respond within 21 days.

13. Children

Vondris is a service for businesses and is not directed at children. A business may book appointments for children at the request of a parent or guardian. We do not knowingly collect personal data directly from children for our own purposes.

14. Changes to this policy

We may update this policy from time to time, for example when we add features such as AI voice calls. We will post the new version on this page and update the date at the top. If a change materially affects how we use Google user data or other personal data, we will notify customers before it takes effect and ask for consent where required.

15. Contact

Vondris Sdn. Bhd.
[REGISTERED ADDRESS]
Email: privacy@vondris.io

This policy is provided in English. If it is translated, the English version prevails.