LeadFlow Privacy Notice

LeadFlow is a product of TechDevX, a business registered in Malaysia with the Companies Commission of Malaysia (SSM).

• Registration no.: 202303139767 (JM0985582-H)
• Email: [email protected]
• Websites: techdevx.com, leadflow.techdevx.com, app.leadflow.techdevx.com

In this notice, "TechDevX", "we", "us" and "our" mean TechDevX. "You" means the person whose personal data we process.

Who is responsible for your data depends on how we got it.

A. We are the data controller for data we collect for our own purposes. This includes:

• visitors to our websites;
• people who fill in our book-a-demo or founding-agency forms;
• people who message our public demo WhatsApp number;
• our customers' account users (the business owner and their staff who log in to LeadFlow), and billing contacts.

Sections 3 to 14 of this notice apply to this data.

B. We are a data processor for data our customers put into LeadFlow about their own leads and customers. For example, when a business uses LeadFlow to receive WhatsApp messages from its customers, that business is the data controller. We process that data only on the business's instructions, under our Terms of Service and data processing terms.

If you are a lead or customer of a business that uses LeadFlow, please contact that business first. Its own privacy notice applies to you. See section 15 for how we help.

From our forms (book-a-demo and founding-agency):

• name;
• company name;
• WhatsApp number;
• email address (optional);
• your message;
• number of agents (a range, such as "1–5");
• how you currently pay commission;
• your consent record: the consent checkbox, the consent version (currently "web-2026-10"), and the date and time you submitted.

From our demo WhatsApp number:

• your WhatsApp number and WhatsApp profile name;
• the messages you send and our replies, including replies written by our AI;
• message dates, times and delivery status.

From LeadFlow account users:

• name, email, phone number, role and team;
• login and security data (such as sign-in times and IP address);
• settings and actions you take in LeadFlow, including the log of AI actions;
• support messages you send us.

From billing:

• billing contact name, business name, email and address;
• plan, invoices and payment status.

Stripe handles card details. We do not store full card numbers.

From website visits:

• technical data such as IP address, browser type, device type, pages viewed and referring site;
• cookie data, if analytics is enabled and you allow it (see section 11).

We do not ask for sensitive personal data (such as health, religious or political information). Please do not send it to us in forms or WhatsApp messages.

• Directly from you, when you fill in a form, message us, sign up or contact us.
• From your employer or business, if they add you as a LeadFlow user.
• Automatically, from your browser or device when you visit our sites.
• From Meta (WhatsApp), which delivers messages to us when you message our number.
• From Stripe, which tells us whether a payment succeeded.

We use your personal data to:

1. reply to your demo or founding-agency request and arrange a demo;
2. answer your WhatsApp messages (our AI answers first, then a TechDevX person follows up, usually within 24 hours);
3. assess whether LeadFlow suits your business and prepare a quote;
4. set up and run your LeadFlow account;
5. bill you and manage payments, refunds and credits;
6. provide support and send service messages (such as security alerts, billing notices and changes to our terms);
7. keep our services secure, prevent fraud and abuse, and fix problems;
8. understand how our websites are used and improve them (only if analytics is enabled);
9. send you news about LeadFlow, but only if you agreed or where the law allows; you can opt out at any time;
10. comply with the law, respond to authorities, and protect our legal rights.

We do not sell your personal data.

Under the PDPA, we process your personal data:

• with your consent — for example, when you tick the PDPA consent box on our forms, message our WhatsApp number, or continue to use our sites after seeing this notice;
• where it is necessary to take steps at your request before a contract, or to perform a contract with you or your business;
• where it is necessary to comply with a legal obligation;
• for other purposes the PDPA permits.

You can withdraw consent at any time (see section 12). Withdrawing does not affect processing that already happened. If you withdraw consent we need to provide a service, we may not be able to continue providing it.

Website forms. Name, company, WhatsApp number, agent count range, commission method and the consent tick are required. Email and your message are optional. If you do not give the required data, we cannot process your request or contact you about a demo.

Demo WhatsApp. Messaging us is voluntary. If you message us, we receive your WhatsApp number and messages. Without them, we cannot reply.

LeadFlow account. Name, email and billing details are required to open and pay for an account. Without them, we cannot provide the service.

Analytics cookies. Voluntary. Refusing them does not stop you using our websites.

When you message our demo WhatsApp number, an AI system replies first. A TechDevX person then follows up, usually within 24 hours. A person can take over at any time.

• To write replies, your messages are sent to an AI provider (see section 9).
• We record every AI reply and action in a log.
• AI replies can be wrong. Nothing the AI says is a binding offer, quote or promise until a TechDevX person confirms it in writing.
• We do not use your personal data to train AI models, and our AI providers' business API terms do not allow them to train their models on it.

We share personal data only as needed for the purposes above. We use these service providers (sub-processors):

We may also disclose personal data:

• to our professional advisers (such as lawyers and accountants);
• to government agencies, regulators, courts or police where the law requires or permits;
• to a buyer or successor if our business is sold or transferred, subject to this notice;
• to anyone else, with your consent.

We will update this list when we add or change a sub-processor.

Our servers are in Singapore. Some providers, including our AI providers, process data in the United States. So your personal data will be transferred outside Malaysia.

We transfer data outside Malaysia only as section 129 of the PDPA allows. For example, where:

• the transfer is necessary to perform our contract with you, or to take steps you asked for before a contract;
• you consented to the transfer; or
• we have taken reasonable precautions and exercised due diligence, such as contracts that require the recipient to protect the data to a standard at least as high as the PDPA.

We transfer personal data outside Malaysia only as the PDPA allows, for example where it is necessary to provide the service you asked for, or where the recipient is bound by protections comparable to the PDPA.

By ticking the consent box on our forms or messaging our demo number, you consent to these transfers.

Our marketing site may use Google Analytics 4 (GA4). GA4 uses cookies to measure visits, such as which pages are viewed and how long visitors stay.

• GA4 runs only when we have enabled it.
• You can refuse or delete cookies in your browser settings. You can also use Google's opt-out add-on: https://tools.google.com/dlpage/gaoptout
• The LeadFlow app uses essential cookies to keep you signed in. These are needed for the app to work.

We do not use advertising cookies.

Under the PDPA, you may:

• Access — ask what personal data we hold about you and get a copy. We may charge a fee allowed by law.
• Correct — ask us to correct data that is wrong, incomplete, misleading or out of date.
• Withdraw consent — ask us to stop or limit processing based on your consent.
• Stop direct marketing — ask us to stop using your data for marketing. Every marketing message will also tell you how to opt out.
• Prevent damage or distress — ask us to stop processing that is likely to cause you substantial damage or distress.
• Data portability — ask us to send your personal data to another data controller, where technically feasible and the data format is compatible.

To use any right, email [email protected] with your request. We may need to check your identity. We will reply within 21 days of receiving your request, as the PDPA requires. If we cannot meet a request, we will tell you why, as far as the law allows.

If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia (https://www.pdp.gov.my).

We keep personal data only as long as needed for the purpose we collected it, and then delete or anonymise it.

We may keep data longer if the law requires it, or to deal with a dispute or legal claim.

We take practical steps to protect personal data from loss, misuse, unauthorised access, change or disclosure. These include:

• encryption in transit (HTTPS);
• separating each customer's data inside LeadFlow;
• role-based access, so users only see what their role allows;
• an audit log of AI actions and key changes;
• limiting staff access to what is needed.

We also use encryption at rest for our database and take daily backups.

No system is completely secure. Please keep your password safe and tell us at once if you think your account is at risk.

If a personal data breach happens, we will act quickly to contain it.

• Where we are the data controller, we will notify the Personal Data Protection Commissioner as soon as practicable, and within 72 hours, where the law requires. If the breach causes or is likely to cause you significant harm, we will tell you without unnecessary delay, and within 7 days of notifying the Commissioner.
• Where we are a data processor for a LeadFlow customer, we will tell that customer promptly and help them meet their own notification duties.

If a business uses LeadFlow to message you or store your details, that business is your data controller. It decides why and how your data is used.

• Please send access, correction or other requests to that business.
• If you contact us, we will pass your request to the business, where we can identify it, and help it respond.
• Your WhatsApp messages to that business may be read and answered by AI, and by people at that business. The same AI providers and transfers described above apply.

Our services are for businesses. They are not meant for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact us and we will delete it.

For data protection questions, contact our data protection contact at [email protected].

We may update this notice from time to time. We will post the new version on this page with a new effective date. If the change is significant, we will tell you by email, in the app or on our website before it takes effect.

This notice is available in English, Bahasa Malaysia and Chinese on our website. If the versions differ, the English version prevails.

TechDevX
Email: [email protected]