1. About this policy
HEDESU is operated by Workbeat Technologies Sdn. Bhd. (1422325-A) (“HEDESU”, “we”, “us”, or “our”). This policy explains how we handle personal information when you visit our website or use our accounts, workspaces, tickets, communications, knowledge base, and connected services.
For account administration, billing, security, and our own support enquiries, we determine how information is used. When an organization uses HEDESU to manage its customers, staff, or conversations, that organization generally determines the purposes for processing its workspace data, and we process that data on its behalf to provide the service. Its own privacy notices may also apply.
Our Terms of Service describe the conditions for using HEDESU.
2. Information we collect
- Account and contact information: names, email addresses, phone numbers, organization details, account preferences, and login credentials. Account passwords are stored as hashes.
- Workspace content: membership and permissions, customer contacts, tickets, tasks, messages, comments, attachments, knowledge-base articles and versions, tags, statuses, and settings supplied through the service.
- Billing information: billing contacts, plan selections, invoices, transaction references, and payment status. Payment providers process payment details; HEDESU does not store full payment-card numbers.
- Technical information: IP addresses, browser and device information, access times, session information, and diagnostic or security logs generated when the service is used.
- Connected-service information: information received from integrations an organization enables, including the WhatsApp information described below.
Information may come from you, your organization and its authorized users, people communicating with that organization, or connected providers. If required account or service information is not supplied, we may be unable to provide the relevant feature.
3. How we use information
We use information to provide and maintain HEDESU, authenticate users, route conversations, manage tickets and knowledge-base content, enable collaboration, and operate integrations requested by customers. We also use it to administer subscriptions and payments, provide support and service notifications, diagnose problems, improve service performance, protect accounts, prevent abuse, and meet legal obligations.
Where applicable law requires a basis for processing, we rely on the basis appropriate to the activity, such as performing an agreement, complying with legal obligations, legitimate business interests where permitted, or consent where required.
4. WhatsApp Business integration
When an organization connects WhatsApp Business, HEDESU processes information needed to operate that connection. Depending on the features used, this includes:
- WhatsApp Business Account identifiers, business phone numbers and their identifiers, business display names, Meta app identifiers, and integration credentials such as access tokens and app secrets.
- Contact names, WhatsApp identifiers and phone numbers, incoming and outgoing message content, and shared media or attachments.
- Message identifiers, timestamps, delivery and read statuses, message templates, and template approval information.
We use this information to verify and manage the connection, send and receive business messages, associate conversations with contacts and tickets, manage templates, display message status, and troubleshoot delivery. Messages and related information are exchanged with Meta/WhatsApp and, where the organization uses an intermediary messaging provider, that provider.
Information received through WhatsApp may be visible to authorized members of the connected workspace. Meta and other connected providers handle information under their own terms and privacy policies. Disconnecting WhatsApp stops use of that connection but does not automatically delete information already stored in HEDESU; see Data deletion requests.
6. Spark and AI features
When Spark or other AI features are enabled and used, relevant prompts, conversation content, attachments, knowledge-base material, and workspace context may be sent to AI service providers to generate responses, retrieve information, summarize content, or perform configured assistance. The information processed depends on the feature, its configuration, and the user’s access.
HEDESU may retain AI conversations, outputs, and operational records to provide those features and support their operation. Processing by an AI provider is governed by the applicable service arrangements and provider policies. Avoid submitting information that you are not authorized to share.
8. Security and international processing
We use safeguards appropriate to the service, including password hashing and role-based access controls. Secure connections help protect information in transit. No method of transmission or storage can guarantee absolute security; users should protect their credentials and contact us about suspected unauthorized access.
Our hosting and service providers may process information outside your country, including outside Malaysia. When information is transferred internationally, we take steps required by applicable law and use appropriate contractual or other safeguards where required.
9. How long information is retained
We retain information for as long as reasonably needed to provide the service, support customer instructions, maintain security, resolve disputes, and meet legal, accounting, or contractual requirements. The appropriate period depends on the type of information, its purpose, the organization’s settings and instructions, and applicable obligations.
Closing an account or disconnecting an integration does not necessarily erase every record immediately. Some information may need to be retained for legal obligations or legitimate operational reasons, and backup copies may remain until they are removed through the backup lifecycle. Where retention is required, use of the retained information is limited to the relevant purpose.
10. Your choices and rights
Depending on applicable law, you may request access to or correction of your personal information, deletion, restriction of processing, or other available rights. You may also withdraw consent where processing relies on consent; this does not affect processing already carried out lawfully. Some requests may affect our ability to provide a feature.
Contact support@help.hedesu.com to make a request or raise a concern. For information controlled by your organization, contact its workspace administrator as well. We may need to verify your identity and coordinate with the organization before acting. You may also raise a concern with the relevant data-protection authority where applicable.
11. Data deletion requests
You can request deletion of personal information held in HEDESU, including information received through WhatsApp, by emailing support@help.hedesu.com with the subject “HEDESU data deletion request”.
- Provide the email address or phone number associated with the information, the organization or workspace name if known, and a description of the information you want deleted.
- For WhatsApp information, identify the relevant phone number and business you contacted so we can locate the records. Do not send passwords, access tokens, or unnecessary sensitive documents.
- We will verify the request as appropriate and, where the organization controls the information, coordinate with its authorized administrator.
We will assess and respond to the request in accordance with applicable law. We will delete information where required and explain any relevant limitations, including legal retention obligations. Deleting HEDESU records does not delete copies independently held by your organization, Meta/WhatsApp, or other recipients; requests concerning those copies should be directed to the relevant party.
12. Children’s privacy
HEDESU is a service for organizations and is not directed at children under 13. We do not knowingly invite children under 13 to create accounts. If you believe a child has provided personal information without appropriate authorization, contact us so we can assess the information and take appropriate action.
13. Changes to this policy
We may update this policy as the service or our practices change. The date above identifies the latest update. Where required, we will provide additional notice of material changes or obtain consent before applying them.
14. Contact us
For privacy enquiries, rights requests, or concerns, contact:
Workbeat Technologies Sdn. Bhd. (1422325-A)
Operator of HEDESU
Email: support@help.hedesu.com