EazyBiz360

EazyBiz360 Privacy Policy

Effective 15 October 2026

EazyBiz360 is a web application for Malaysian home-service businesses. It is operated by KCRP SOLUTION, a sole proprietorship registered in Malaysia (SSM 202003023102) (“we”, “us”). This policy explains what personal data EazyBiz360 handles, why, who else processes it, how long it is kept and the choices people have. It is written with the Personal Data Protection Act 2010 (PDPA) of Malaysia in mind.

1. Who is responsible for the data

  • Business Customers are the businesses that use EazyBiz360 to run their work: bookings, customers, invoices and quotations (PDF), staff schedules, payroll and, optionally, WhatsApp. A Business Customer decides what data about its own customers (“end customers”) and staff goes into EazyBiz360 and what it is used for. For that data, the Business Customer is the data controller (data user under the PDPA) and we process it on its behalf and on its instructions.
  • For the accounts people use to sign in, and for running, securing and supporting EazyBiz360 itself, we are the data controller.

2. The data we handle

Account data

For each person given access by a Business Customer: name, phone number, login username (and e-mail address where one is used), role (for example owner, manager or staff) and the team they belong to. Passwords are stored only as secure hashes by our authentication provider.

Business data entered by users

What the Business Customer and its staff type or upload: end customers’ names, phone numbers and addresses; bookings and job details; invoices, quotations and payments; job photos; staff schedules, leave and payroll records; notes.

WhatsApp module data (only if the Business Customer connects WhatsApp)

The WhatsApp module connects a business’s own WhatsApp number through Meta’s WhatsApp Business Platform (Cloud API), using Embedded Signup with Facebook Login for Business. When it is connected we receive and store:

  • messages and media exchanged with the business’s WhatsApp number, and their delivery and read status;
  • the contact’s WhatsApp profile name and phone number;
  • referral information Meta attaches when a chat starts from a click-to-WhatsApp ad: the ad’s ID and headline and Meta’s click ID;
  • the business’s WhatsApp Business Account ID and phone number ID, and an access token for that account, which is stored encrypted in Supabase Vault and is never shown in the app.

Facebook Login for Business is used only to obtain the authorization code that lets the business connect its WhatsApp Business Account. We do not read the person’s friends, posts or any other Facebook profile data.

Technical data

Server and error logs (such as IP address, browser type, time and the page requested), kept for security and troubleshooting. If a user turns on notifications, the browser’s push subscription for that device. EazyBiz360 sets only the cookies it needs to work: the sign-in session, the chosen language and the last company code used to sign in. It uses no advertising or analytics cookies.

3. Why we use it

  • to provide EazyBiz360: sign-in, bookings, schedules, invoices and quotations, payroll and the other features the Business Customer uses;
  • to show WhatsApp chats in the business’s inbox and send the replies its staff write;
  • to send the automatic WhatsApp messages the Business Customer has switched on, such as booking reminders, follow-ups and repeat-service reminders;
  • if the Business Customer turns the AI on, to tag chats and draft replies (section 4);
  • if the Business Customer turns it on, to report that an ad-originated enquiry became a lead or a purchase to Meta’s Conversions API. Each report carries only the event type, its time, the business’s WhatsApp Business Account ID, Meta’s own click ID and, for a purchase, its value. It never includes names, phone numbers or message text;
  • to keep EazyBiz360 secure, prevent abuse, and investigate problems;
  • to answer support requests.

We do not sell personal data, and we do not use it for advertising or to build profiles of people.

4. AI features

AI is off unless the Business Customer turns it on. When it is on, the text of WhatsApp messages in a chat and the business’s own service and price list are sent to Anthropic (the Claude API) to tag the chat (for example its stage and the services asked about) and to draft replies. The customer’s name and phone number are not included. Anthropic’s commercial terms state that API data is not used to train its models. AI drafts are suggestions; the Business Customer decides how they are used and remains responsible for what is sent.

5. Who processes the data for us

We use these service providers, each bound by its own terms and data-protection commitments:

  • Supabase: database, sign-in and file storage, hosted in the Singapore region (Supabase, Inc. is a US company).
  • Vercel: application hosting, in the Singapore region (Vercel Inc. is a US company).
  • Anthropic: AI processing for businesses that turn the AI on (United States).
  • Meta Platforms: the WhatsApp Business Platform, which carries WhatsApp messages for businesses that connect WhatsApp.

Because of this, personal data may be stored or processed outside Malaysia, including in Singapore and the United States. We use these providers only for the purposes above and rely on their contractual and security safeguards to protect the data to a standard comparable to the PDPA.

6. When we disclose data

Apart from the providers above, we disclose personal data only when the law requires it, for example to a court or a government authority. We first check that the request is lawful and disclose only the minimum that is required.

7. How long we keep it

  • Raw WhatsApp webhook events (the copies of what Meta sends us) are deleted automatically by a daily job 30 days after they are processed. The messages themselves stay in the business’s inbox. The few events that could not be processed are kept until we fix or resolve them.
  • Business records are kept while the Business Customer’s account is active.
  • They are deleted when the Business Customer asks, or within a reasonable period after the account closes, except records the law requires us or the business to keep (for example invoices and other tax records).

8. How we protect it

  • all traffic is encrypted in transit (HTTPS/TLS);
  • row-level security in the database keeps each company’s data, and each team’s within it, apart;
  • WhatsApp access tokens are stored encrypted and are never sent to the browser;
  • access within a business is limited by role, and important changes are recorded in an audit log.

No system is perfectly secure, but we work to protect data and will act promptly if a problem occurs.

9. Your rights and choices

  • You can ask to access or correct your personal data, ask for it to be deleted, or withdraw consent.
  • WhatsApp: replying STOP (or “unsubscribe”, “berhenti” or “退订”) as the whole message stops that business’s automatic follow-ups, repeat-service reminders, review requests and campaign messages to you, and cancels any already scheduled. Messages about a booking you have already made, such as a reminder the day before, and documents such as an invoice may still be sent; ask the business if you want those to stop too.
  • If you are a customer of a business that uses EazyBiz360, please contact that business first, since it controls your data. You can also contact us and we will pass your request on and help it respond.

To make a request, write to kcrp.solution@gmail.com. We may need to confirm your identity first. See also How to delete your data.

10. Children

EazyBiz360 is a business tool and is not directed at children.

11. Changes to this policy

If we change this policy we will update this page and its effective date, and tell Business Customers about significant changes in the app or by message before they take effect.

12. Contact

KCRP SOLUTION (SSM 202003023102), Malaysia. E-mail: kcrp.solution@gmail.com.