The short version
- Your chats, files, meetings and your agent computer are private to you. Our admin tools show account details and usage, not what you write.
- To do the work you ask for, we send the needed content to AI model providers and, for voice and meeting audio, to a transcription provider. They act for us. We do not use your content to train AI models and we never sell your personal data.
- Nothing is sent from your email or LinkedIn account, and no payment is made, unless you tap to approve it.
- Payments are handled by Stripe. We never see your full card number.
- Our servers are in Malaysia. You can ask for a copy of your data, correct it or delete it at any time by emailing saleh@utilizebot.com. You can delete your whole account yourself in the app (see section 11).
1. Who we are#
UtilizeBot is an AI assistant app run by UtilizeBot Solutions, trading as UtilizeBot, in Malaysia ("we", "us"). This policy explains what personal data we collect when you use the UtilizeBot app (at pa.utilizebot.cloud, in the Android app and in the desktop apps), our public website at utilizebot.si, and related services, and what we do with it.
We are the data user (data controller) for the personal data described here. We follow the Personal Data Protection Act 2010 of Malaysia as amended in 2024 ("PDPA"). If you use UtilizeBot from outside Malaysia, we also aim to meet the good practice of the EU and UK General Data Protection Regulation ("GDPR") where it applies to you.
Our data protection officer can be reached at saleh@utilizebot.com.
This notice is published in English and Bahasa Melayu. If the two versions differ, the English version prevails.
2. What we collect#
We collect only what we need to run the service you use. Depending on the features you use, this includes:
Account and profile
- Your name, email address and password (stored only as a secure hash, never in readable form).
- What you tell the assistant about yourself in your profile, such as how to address you, your language, your time zone and your preferences.
- Notes the assistant keeps so it remembers your preferences and earlier work across chats.
- A phone number, only if you add one for reminders that ring you.
Chats, files and work
- Your messages and the assistant's replies, in your main chat and in the chats of bots you create.
- Files you upload and files the assistant or your bots create for you, such as documents, reports, spreadsheets, images and websites.
- Bots, schedules, missions, reminders and the results they produce.
- Voice messages you record. They are turned into text by our transcription provider and kept in your private folder.
Meeting recordings, transcripts and minutes
If you use Meetings, we keep the recordings you make or upload, their transcripts, the minutes, decisions and action items made from them, and any edits you make. Section 6 explains how we handle recordings.
Templates
Word, PowerPoint, Excel and meeting minutes templates you upload or create, and the facts our checks read from them (for example the file type and layout).
Connected accounts and devices
- If you connect Google or Microsoft mail and calendar, or LinkedIn, we store the access granted when you sign in with that provider, and we read the emails, events or profile details needed for the task you ask for.
- If you connect a smart home hub or your own computer, we store the connection details and the device information needed to show and control your devices.
Your agent computer
Each person gets a private computer in the cloud that the assistant uses to browse and act on websites for you. Its storage holds the files it works on and the browser data of the websites you use there, such as cookies and signed-in sessions.
Device and notification data
If you use the mobile or desktop app, we store a notification token so we can send you push notifications, plus basic device details such as the app version and platform.
Usage in credits
We record how many credits each request uses, which feature used them, and when. Credits measure the real cost of the work the AI does. We use this to show your usage, apply plan limits and run the service.
Payment information
When you buy a plan or credits, Stripe collects your card or online banking details. We receive your name, billing email, plan, payment status, invoice records and a Stripe customer reference. We never receive or store your full card number.
Invite requests, campaign links and support
- If you ask for an invite on utilizebot.si, we keep your email address and how you found us (for example the campaign or the website that referred you).
- If you open a campaign link, we count your visit once a day using a cookie, and note the country your visit comes from. We do not store your IP address for this.
- Messages you send us for support or sales, and our replies.
Cookies and analytics
Cookies that keep you signed in and remember your choices, and, only if you agree on utilizebot.si, analytics and advertising cookies. Section 15 lists them.
Security logs
Our servers record technical data such as IP addresses, browser type and the time of requests, to keep the service secure, stop abuse and fix problems.
Children's data, through parents
If a parent creates a child account in Family, we hold the details described in section 14.
Sensitive data
We do not ask for sensitive personal data such as health information or religious beliefs. If you choose to include it in your chats, files or meetings, we process it only to do what you ask.
3. How we use your data#
- To provide the service: answer your messages, run your bots and missions, operate your agent computer, transcribe voice and meetings, write minutes, build documents on your templates, and send reminders and notifications.
- To act for you in connected accounts, only in the way you ask and approve.
- To manage your account, plan, trial, credits and payments.
- To keep the service and our users safe: secure sign-in, prevent fraud and abuse, enforce our Terms of Service and protect children in Family.
- To support you when you contact us.
- To send service messages, such as sign-in links, receipts, trial reminders and important changes. We send marketing email only if you agree, and you can stop it at any time.
- To understand how our website is used and how well our campaigns work, using analytics only with your consent, and counts of visits and sign-ups.
- To meet our legal duties, such as tax records and answering lawful requests.
4. Our legal bases and your consent#
Under the PDPA we process your personal data with your consent, which you give when you create an account and use the service, and where processing is needed to perform our contract with you, to meet a legal obligation, or as otherwise allowed by law. For people covered by the GDPR, our legal bases are:
- Contract: to provide the service you signed up for, including AI processing, the agent computer, meetings and payments.
- Consent: for analytics and advertising cookies, marketing email, connected accounts and child accounts. You can withdraw consent at any time; this does not affect processing that already took place.
- Legitimate interests: to secure the service, prevent abuse, and understand overall usage, where these interests are not overridden by your rights.
- Legal obligation: to keep tax and accounting records and answer lawful requests.
Giving us your data is voluntary, but without the data a feature needs (for example an email address for an account), we cannot provide that feature.
5. How AI processing works#
UtilizeBot runs on large language models provided by AI model providers. To answer a request, we send the content the request needs to an AI model provider: your message, relevant earlier messages and memory notes, files you attach or ask about, and the results of tools the assistant uses. Voice messages and meeting audio are sent to a transcription provider that turns speech into text.
- These providers act as our data processors: they process your content to return the result to us.
- We do not use your chats, files, recordings or other content to train AI models.
- We do not sell your personal data and we do not use your content for advertising.
- AI can be wrong. Check important output before you rely on it. Our Terms of Service explain this further.
6. Meeting recordings#
- Tell people first. Before your first recording, the app asks you to tell everyone in the meeting that you are recording and to ask if they agree. In some places the law requires this. You are responsible for getting that agreement.
- Transcription. The audio is sent to our transcription provider, which works in a private workspace set up only for UtilizeBot meetings. The transcript comes back to our servers.
- Minutes. AI model providers turn the transcript into minutes, decisions and action items.
- Storage. Transcripts and minutes are stored encrypted. Recordings are kept in a private folder on our servers that only the meetings service can read, outside the space the assistant works in. Only you can open your meetings in the app.
- Deletion. You can delete one meeting or all meetings at any time. The recording, transcript, minutes and actions are removed. An upload you never finish is removed after 7 days.
Speakers appear as "Speaker 1", "Speaker 2" until you name them. We do not create voiceprints or identify people from their voice.
7. Your agent computer and automated actions#
Your agent computer browses websites and acts on them for you, such as reading pages, filling forms and preparing work. It acts only on your instructions or on bots and schedules you set up.
- Sign-ins. When a website needs you to sign in, the app shows a secure sign-in card or lets you take control. Passwords typed into a sign-in card are filled straight into the website; the AI does not see them.
- Approvals. The assistant is built to stop and ask you before sensitive steps. Emails and LinkedIn posts go out only when you tap Send or Post. Payments are handed back to you to complete. Unlocking or opening doors in your smart home needs your approval each time.
- Websites you visit. The websites your computer visits receive the information you or the assistant enter there, under their own terms and privacy policies.
- No decisions about you. We do not use automated processing to make decisions that have legal or similarly significant effects on you.
9. International transfers#
We store your data on our servers in Malaysia. Some of our processors, including AI model providers, the transcription provider, Stripe, Cloudflare, email and push services, may process data in other countries, such as the United States. We transfer data outside Malaysia only as the PDPA allows, for example where it is needed to perform our contract with you, or where the recipient is bound to protect it to a standard similar to the PDPA. We send only the data each task needs, and all transfers are encrypted in transit.
10. How long we keep data#
- Your content (chats, files, bots, meetings, templates, memory notes and your agent computer's storage) stays until you delete it or your account is closed.
- Deleted items are removed from our live systems when you delete them. Copies can remain in our nightly backups for up to 30 days (files for up to 7 days) and are then overwritten.
- When your account is closed, we delete your chats, files, bots, meetings, templates, agent computer and its storage, profile, trial and campaign records and shared links. Usage records are kept without your name. Billing records are kept with your identity removed, except where the law requires us to keep them.
- Billing and credit purchase records (invoices, payments, refunds) are kept for as long as Malaysian tax and company law requires, generally seven years.
- Invite requests are kept until you join, ask us to delete them, or we no longer need them for the waitlist.
- Security logs are kept for a limited period, as long as needed to protect the service.
11. Deleting your account#
- In the app: open Settings, then Account, then Delete my account. You confirm with your password, or with a 6 digit code we email you.
- Without the app: use the form on our delete your account page, or email saleh@utilizebot.com from the address on your account. We email you a link first to make sure the request is yours.
- 7 days to change your mind. Your account is closed at once and you are signed out everywhere. We email you a link to keep the account, and signing in during those 7 days offers the same choice. After 7 days we delete it for good.
- What we delete: your account and profile, chats and files, bots, missions, meetings, templates, memory notes, your agent computer and its storage, connected accounts, phone and push registrations, published apps, shared links, and the child accounts you made in Family. Groups you own go to their longest standing admin, or are closed (or deleted if nobody else is in them). Your messages in other people's groups stay as "Former member".
- What we keep: usage records without your name, and billing records (invoices, payments, refunds) for as long as Malaysian tax and company law requires, generally seven years, linked to a one-way code instead of your name or email. Copies in our backups are overwritten within 30 days.
- A paid plan is cancelled at Stripe when you ask to delete your account, with no refund for the unused part (Terms, section 10).
Read the details on our delete your account page.
12. How we protect your data#
- All connections to the app and website use HTTPS encryption.
- Passwords are stored as secure hashes. Sign-in attempts are rate limited.
- Each person's agent computer runs separately, on a network that cannot reach our internal systems or other people's computers.
- Your files are kept in your own private space, and our file access checks stop one person from reaching another person's files.
- Meeting transcripts and minutes, and the access tokens for connected accounts, are stored encrypted.
- Uploaded templates are checked in an isolated sandbox, and files with macros, hidden links or other risky content are refused.
- Admin tools run on a separate address, require an admin sign-in, and show metadata, not your content.
- Card details are handled by Stripe and never reach our servers.
No system is completely secure. Please use a strong password that you do not use elsewhere, and tell us at once if you think your account has been misused.
13. Data breaches#
If a personal data breach happens, we act at once to contain it and assess the risk. As the amended PDPA requires, we notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours of becoming aware of a breach that causes or is likely to cause significant harm, and we tell the people affected without unnecessary delay, explaining what happened and what they can do.
14. Children and Family#
UtilizeBot is for adults aged 18 and over. Children can use it only through Family, where a parent or guardian creates and controls their account.
- Parental consent. A parent must agree to our Family terms before creating a child account. We record that consent.
- What we hold. The child's display name, age band, username, and PIN or password (stored as a secure hash), their chats, learning stories and games, and photos or worksheets only if the parent allows them.
- Child-safe content. Child accounts use child-safe instructions, content filters and a second safety review of generated stories and games, with family-friendly content rules. Children do not get the agent computer, meetings, templates, connected accounts, smart home, publishing or billing.
- Parents stay in control. Parents see their child's activity (time used and topics) and safety alerts, can read their child's chats only if they turn that option on, can set limits, pause the account and delete it at any time.
- AI processing. A child's messages are processed by AI model providers in the same way as an adult's, to answer them and to check safety.
- We do not use children's data for marketing, and we do not show children pricing or advertising.
If you believe a child is using UtilizeBot without a parent's consent, email saleh@utilizebot.com and we will delete the account.
15. Your rights#
You have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is inaccurate, incomplete or out of date. You can edit most of it yourself in the app.
- Delete your data. You can delete chats, files, bots, meetings and templates yourself in the app, and delete your whole account in the app or on our delete your account page (section 11).
- Data portability. Ask us to give you your data in a structured, commonly used, machine-readable format, or to send it to another service where that is technically feasible. You can already download your files and export meetings as Word, PDF and other formats in the app.
- Withdraw consent at any time, for example by declining cookies, disconnecting a connected account, or unsubscribing from marketing.
- Limit processing of your data, or object to it, including for direct marketing.
- Complain. If you are not happy with how we handle your data, please contact us first. You can also complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi, www.pdp.gov.my), or to the data protection authority in your own country.
To use any of these rights, email saleh@utilizebot.com from the email address on your account. We may need to confirm your identity. We reply within 21 days, as the PDPA requires, and tell you if we need more time. Requests are free unless they are clearly unfounded or excessive.
17. Changes to this policy#
We will update this policy when our service or the law changes. The version number and effective date at the top show the latest version. If a change materially affects how we use your personal data, we will tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.
18. Contact us#
For any question about privacy or this policy, or to use your rights, contact our data protection officer:
UtilizeBot Solutions, trading as UtilizeBot
Malaysia
Email: saleh@utilizebot.com
See also our Terms of Service.