Privacy Policy

Collabicle Global Technology is the data controller for the information described here.

Company

Collabicle Global Technology

Address

8, Jalan Tebing Tiga 8/8C, Seksyen 8, Shah Alam 40000, Malaysia

Contact

privacy@collabicle.com

Data about our customers. When a business signs up, we hold the account and organization details it gives us — names, email addresses, and the work it creates in Collabicle: documents, notes, tasks, messages, tables and files. We are the controller of that data.

Data about our customers' customers. When a business connects a channel such as WhatsApp or email, the conversations its own customers send it pass through Collabicle. That business decides what is collected and why; we process it on their instructions. If you are the customer of a business that uses Collabicle and you want your conversation deleted, that business is who decides — we will point you to them, and act on their instruction.

A business can connect its own WhatsApp Business Account to Collabicle. When it does, we receive from Meta, for that business only:

• a business-scoped user ID for each person who messages that business — an identifier Meta issues that is unique to that business and cannot be used to identify the same person elsewhere
• the sender's phone number and WhatsApp profile name, where WhatsApp provides them— a person using a WhatsApp username may reveal neither
• the content of messages sent to that business, including images, documents and voice notes
• the business's own WhatsApp account details — phone numbers, display name, quality rating, message templates — and an access token that lets us act for that business

We use it for one thing: delivering those conversations to the business they were sent to, and letting that business reply. We do not use message content to train models, do not sell it, and do not use it for advertising.

A business can also connect its own Facebook Pages and the Instagram professional accounts linked to them, so that its staff can publish posts from Collabicle and answer the direct messages people send to those Pages and accounts. The business chooses which Pages and accounts to share, in Meta's own sign-in window. When it does, we receive from Meta, for that business only:

• for each Page it shared: the Page's ID, name, category and profile picture, and which tasks the person who connected it may perform on that Page
• for an Instagram account linked to one of those Pages: its ID, username, name and profile picture
• an access token for each, which lets us publish to it on that business's instruction
• after a post is published, the ID that Facebook or Instagram gave it, and whether each account accepted the post
• for each person who messages one of those Pages on Messenger, or one of those Instagram accounts: an ID Meta issues for that business only, their name and profile picture where Meta provides them, and the content of their messages, including images and other attachments

We use it for two things: publishing the posts that business's own staff write, to the accounts they chose, at the time they chose; and delivering the direct messages people send to those accounts to that business, with the business's replies sent back — written by its staff or, where the business switches it on, by one of its AI agents within Meta's 24-hour reply window. We never message anyone who has not written first. We do not read a Page's or an Instagram account's followers, comments, other posts or insights. We do not read anything from the personal Facebook profile of the person who connected it, and we do not use Facebook Login to sign anyone in to Collabicle. We do not sell any of it and do not use it for advertising.

A business can connect its own TikTok account so that its staff can publish to it, answer the comments its posts receive, and see how those posts performed. The business authorises this in TikTok’s own consent screen and chooses which account to connect. When it does, we receive from TikTok, for that account only:

• the account’s identifier, display name, username and profile picture, and its follower and post counts
• the account’s own posts, and the performance figures TikTok reports for them
• the comments left on those posts, and for each commenter the display name and profile picture TikTok provides
• an access token, which lets us act on that account on the business’s instruction
• after a post is published, the identifier TikTok gave it and whether it was accepted

We use it for one thing: running that business’s own TikTok presence inside Collabicle. We do not read any account that has not authorised us, we do not scrape TikTok, and we do not sell, share or license what we receive, use it for advertising, or use it to train models.

A business can connect a LinkedIn Page it administers, so that its staff can publish to it, read the comments its posts receive, and see how those posts performed. The business authorises this through LinkedIn’s own sign-in window. When it does, we receive from LinkedIn, for that Page only:

• the Page’s identifier, name and logo, and which administrator role the person connecting it holds on that Page
• an access token, which lets us publish and read on that business’s instruction
• the identifier of each post we publish, and whether LinkedIn accepted it
• the comments and reactions those posts receive, and for each commenting member the name, headline and profile picture LinkedIn shows beside the comment
• Page and post statistics — followers, views, clicks, reactions, comments and video views

We show that information to the business whose Page it is, so it can reply and see how its posts did. We do not build a profile of a LinkedIn member, do not combine what we see across Pages, and do not use it for advertising, for sale, or to train models. We hold a commenting member’s details only for as long as we are showing that comment to the Page’s administrators, and when a business disconnects a Page we stop retrieving its data and delete the stored access token.

The Collabicle extension for Chrome saves web pages, highlighted text and screenshots to your organization’s Bookmarks. It acts only when you use it: when you press Save, it sends the page’s address, title and description, the address of its preview picture (which Collabicle then copies from the site), the text you selected or the screenshot you took, and any tags and note you added, to your own Collabicle organization — nowhere else. When you open it on a page, it also asks your organization whether that page is already saved, which sends the page’s address but keeps nothing. It signs in through your existing Collabicle session in that browser and keeps no password or token of its own. On your device it remembers only your name and email, the organizations you can save to, and which one you last used; a right-click save waits there briefly until you open the extension, and is gone when the browser closes. Nothing it reads is sold, used for advertising, or shared beyond the people in your organization.

Collabicle includes AI agents that work inside a business's own organization. A model sees only what the business's own configuration gives that agent access to, it runs on that business's instruction, and providers we route to are not permitted to train on it. Where an agent can take an action that matters, a person approves it first.

A business can let its agents answer the conversations it receives — on WhatsApp, Facebook Messenger, Instagram, email or web chat. When it does, the conversation an agent is answering is sent to the AI model provider that agent runs on, and the agent's reply is sent back in the same conversation. A person in the business can take over at any time.

When a playbook in Engage is answered by an agent, the comment, the post’s caption, the replies under it, the commenter’s first name and, where the playbook allows it, their earlier comments on the business’s accounts are sent to the AI model provider that agent runs on, so it can write one public reply. It reads only the notes, pages and files the playbook pins. A person approves it first unless the playbook says otherwise, and nothing it writes is posted if it would put an order number, contact details or a link in public — or a price, unless the playbook allows prices in public.

When you set up an organization, what you tell us about your business, and what we read about it from your website and other public sources, is kept with that setup. Collabicle’s operators can read it, together with what setup made from it, to see where setup goes wrong and fix it. They do not see the email addresses of the people you invite, and none of it is sold or used for advertising.

Cloudflare, Inc. hosts everything. All application compute and storage — Workers, D1, R2, KV and Queues — runs on Cloudflare, with stored data held in its Asia-Pacific region. Cloudflare is a processor acting on our instructions.

We also use Stripe for payments and an email provider for the messages Collabicle sends. Neither receives WhatsApp conversation content, nor anything we receive from Meta, TikTok or LinkedIn about a connected account.

AI model providers. Each agent runs on a model the business chooses from those Collabicle offers, reached through Cloudflare's AI Gateway: Cloudflare (Workers AI), Anthropic, OpenAI, Google and Groq. The provider of an agent's model receives what that agent is given to work with — including, when the agent answers a business's conversations, those messages — acting on our instructions and not permitted to train on it. A photo a customer sends over WhatsApp is described once, when it arrives, by a vision model on Cloudflare Workers AI, through the AI Gateway, so the agent can read it.

To decide which of its tools an AI agent needs for a request, Collabicle sends the words a person wrote to that agent — the message and the one before it — to TypeSafe, through Cloudflare's AI Gateway. For Front desk, Collabicle sends TypeSafe the customer's own latest message and the one before it (from an email, only the new words they wrote — not the subject, quoted earlier mail or a signature) and, only once Collabicle switches this on, which it has not yet done, their latest photo, to pick which of the business's playbooks answers. Where a business uses Engage, Collabicle also sends TypeSafe each new public comment or mention on the business's connected accounts, with the caption of the post it was left under, to choose which of the business's playbooks and labels fit it; and, when someone in the business tests a playbook's description, the public comments from the last seven days that reached its playbooks, and, for Front desk, customers' first messages from the last seven days. While a business is being set up, Collabicle may also send TypeSafe the business's own public pictures from its website and profiles (its logos), to tell which one is its logo. TypeSafe states that it retains none of it. It never receives the agent's or the business's replies, earlier quoted mail, files, or anyone else's words.

We do not sell personal data, and we do not share it for advertising.

Work a business creates in Collabicle is kept while its account is open. When an account is closed we delete its data within 90 days, except where we must keep records longer — billing records for tax purposes, and records of requests from public authorities, which we keep for seven years.

We review every request from a public authority for its legality before disclosing anything, disclose only the minimum necessary, challenge requests we believe unlawful, document every one, and tell the affected customer wherever we are not legally prohibited from doing so.

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Write to privacy@collabicle.com and we will reply within 30 days.

For deletion specifically, including data received from Meta, see how to request data deletion.

When this policy changes materially we will tell account holders by email before the change takes effect. The date at the top always reflects the current version.