Privacy Policy
Last updated: October 19, 2026
1. Introduction
HeyBirdy.ai ("HeyBirdy", "we", "us", "our") is an AI-powered customer service and conversational automation platform. HeyBirdy.ai is operated by Shoppertise Sdn Bhd (201301034266 (1064096-H)), a company incorporated in Malaysia ("Shoppertise").
We are committed to protecting and respecting your privacy. This Privacy Policy ("Notice") explains how we collect, use, disclose, and protect personal data when you:
- visit our website;
- communicate with us;
- use the HeyBirdy.ai platform; or
- otherwise interact with our services.
We process personal data in accordance with the Personal Data Protection Act 2010 of Malaysia, as amended ("PDPA"). Where other data protection laws apply to you or to particular processing, such as the General Data Protection Regulation (EU Regulation 2016/679) ("GDPR"), the UK GDPR, the Singapore Personal Data Protection Act 2012, the Indonesia Personal Data Protection Law, or the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), we also meet their requirements for that processing.
2. Roles and Responsibilities
2.1 Data Controller and Processor
In most cases, HeyBirdy acts as a Data Processor on behalf of our business clients, who are the Data Controllers for personal data processed through the HeyBirdy.ai platform.
HeyBirdy acts as a Data Controller for:
- contact and account information of our clients and prospects;
- data collected through our website and marketing activities; and
- administrative and operational data necessary to operate our business.
3. Personal Data We Process
3.1 Information Provided by Our Clients
The categories of personal data processed through the HeyBirdy.ai platform are determined by our clients and may include:
- names;
- business contact details (email address, telephone number);
- message content exchanged via supported communication channels;
- conversation metadata (timestamps, routing decisions, escalation status);
- SOPs, policies, and structured knowledge uploaded by clients.
3.2 Information Collected Directly from You
When you interact with our website or contact us, we may collect:
- name;
- job title;
- company name;
- email address;
- telephone number;
- device and browser information;
- IP address and approximate location data.
3.3 Cookies and Similar Technologies
We use cookies and similar technologies to:
- operate and secure our website and platform;
- analyse usage and performance; and
- improve user experience.
We use the following analytics tools:
| Tool | Where it runs | What it collects | How long it is kept |
|---|---|---|---|
| Google Analytics 4 (Google) | Our website, including the help centre, and the HeyBirdy.ai dashboard | Pages visited, device and browser type, approximate location, and actions such as searches. Email addresses and phone numbers typed into a search are removed before anything is sent. | 14 months |
| Microsoft Clarity (Microsoft) | Our website, including the help centre, and the HeyBirdy.ai dashboard | Session recordings, clicks, scrolling and heatmaps. In the dashboard, recordings can include what is shown on screen, such as contact names, phone numbers and message content. | Recordings up to 30 days; heatmaps up to 13 months |
Analytics tools run only on our production website and dashboard. Essential cookies that keep you signed in and protect the platform cannot be switched off without stopping the service from working.
When you visit our website, including the help centre, or our signup page, a cookie notice lets you accept or reject analytics cookies. If you reject them, Google Analytics and Microsoft Clarity stop running on that site and we delete the cookies they have set on our domain. We keep your choice for 6 months in a cookie named hb_consent, which records only that choice. You can change your choice at any time with the Cookie Settings link at the bottom of each page.
You can also block or delete cookies through your browser settings, stop Google Analytics with the Google Analytics opt-out browser add-on, and stop Microsoft Clarity by blocking cookies from clarity.ms.
4. Purposes and Legal Bases for Processing
Under the PDPA, we process personal data with your consent or where the PDPA otherwise permits it, and we give notice of the purposes in this Notice. Where the GDPR applies, we rely on the legal bases below.
We process personal data for the following purposes and legal bases:
| Purpose | Legal Basis |
|---|---|
| Providing and operating our services | Performance of a contract |
| Processing data on behalf of clients | Performance of a contract |
| Responding to enquiries and communications | Legitimate interests |
| Improving platform reliability and security | Legitimate interests |
| Website analytics and performance | Legitimate interests or consent |
| Compliance with legal obligations | Legal obligation |
We do not use client conversation data to train general-purpose AI models without explicit client consent.
5. AI Processing and Safeguards
HeyBirdy.ai processes data in accordance with client-configured rules, SOPs, and policies. Our AI systems:
- operate within parameters defined by clients;
- support human-in-the-loop escalation workflows; and
- do not autonomously make decisions beyond configured rules.
Clients retain ownership of all data processed through the platform.
6. Data Sharing and Subprocessors
We share personal data only with the service providers we need to run HeyBirdy.ai. They act as our subprocessors:
| Provider | Purpose | Personal data involved | Location |
|---|---|---|---|
| IPServerOne | Hosting of our application servers and databases | All platform data | Malaysia |
| Meta Platforms | WhatsApp Business Platform (Cloud API), to send and receive messages | Phone numbers, names, message content and media | Global |
| OpenAI | AI replies, summaries and search | Message content and knowledge uploaded by clients | United States |
| Google (Gemini) | AI replies, summaries and search | Message content and knowledge uploaded by clients | Global |
| Anthropic (Claude) | AI replies, summaries and search | Message content and knowledge uploaded by clients | United States |
| Stripe | Subscription billing and payments | Billing contact details and payment information (card details are held by Stripe, not by us) | Global |
| SparkPost | Transactional email | Email addresses and email content | United States |
| Cloudflare | Domain name service, content delivery, security and bot protection | IP addresses and request data | Global |
| Google (Analytics) | Website and dashboard analytics | Usage data, see section 3.3 | Global |
| Microsoft (Clarity) | Website and dashboard analytics | Session recordings, see section 3.3 | Global |
All subprocessors are subject to contractual data protection obligations consistent with applicable data protection laws. We may change our subprocessors from time to time; when we do, we will update this list and the "Last updated" date at the top of this Notice.
7. International Data Transfers
Our platform is hosted in Malaysia. Some of our subprocessors listed in section 6 process personal data outside Malaysia. When personal data is transferred outside Malaysia, we do so in accordance with section 129 of the PDPA, for example where the recipient is bound to protect it to a standard comparable to the PDPA. Where the GDPR applies, we use the European Commission's Standard Contractual Clauses or another transfer mechanism the GDPR recognises.
8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Notice, comply with legal obligations, and resolve disputes. Upon termination of services, client data is deleted or returned in accordance with contractual agreements.
9. Your Rights
Subject to applicable law, you may have the right to:
- access your personal data;
- request correction or deletion;
- restrict or object to processing;
- request data portability; and
- withdraw consent where processing is based on consent.
Requests may be submitted by contacting us at [email protected].
9.1 Deleting Your Data
If you messaged a business that uses HeyBirdy.ai, for example on WhatsApp, that business decides what happens to your conversation, because it is the data controller. Please ask the business first. If you cannot reach it, email [email protected] with the phone number you used and the name of the business, and we will pass your request to the business or act on it as the law allows.
If you are a HeyBirdy.ai customer, a workspace administrator can remove contacts and conversations in the dashboard, which takes them out of the workspace. To have your data permanently erased, or to close your workspace and erase its data, email [email protected] from the email address on the account.
Once we have confirmed a request, we erase the personal data concerned within 30 days, including messages, contacts, media and the AI knowledge and search indexes built from them. Copies in our backups are overwritten within 90 days. We will confirm by email when the erasure is complete. Where the law requires us to keep certain records, such as invoices, we keep only those records and only for that purpose.
10. Children's Data
Our services are not directed to individuals under the age of 18, and we do not knowingly collect personal data from children.
11. Security
We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption, and monitoring.
12. Changes to This Notice
We may update this Notice from time to time. Changes will be posted on this page with an updated revision date.
13. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at:
Email: [email protected]
Appendix A – California Residents
This Appendix applies to California residents under the CCPA and CPRA.
We do not sell personal data. California residents have the right to access, delete, and limit the use of their personal data, and the right to non-discrimination for exercising these rights. Requests may be submitted to [email protected].