This policy explains how Gatefold Digital Analytics Sdn. Bhd. (1518988-P), trading as Gatefold ("we", "us"), collects, uses and protects personal data when businesses use the Gatefold CRM (the "Service") and when people visit this website. We follow Malaysia's Personal Data Protection Act 2010 (PDPA).
1. Our role
- For your account: when you sign up or are invited to a workspace, we decide how your account data is used, so we are its data user (controller).
- For your customers' data: the messages, contacts and leads a business keeps in Gatefold belong to that business. We process them only on the business's instructions, to provide the Service. If you messaged a business that uses Gatefold, that business is responsible for your data. Please contact them first; we will help them answer you.
2. What we collect
Account and workspace data
- Name, email address, password (stored only as a secure hash), role and workspace membership.
- Business details you give us, such as company name, currency and billing contact.
Data a business stores in the Service
- WhatsApp conversations: message text, media, timestamps, delivery status, and the contact's phone number and WhatsApp profile name.
- Leads from Facebook and Instagram Lead Ads, Google Ads lead forms and click-to-WhatsApp ads: the fields the person submitted (for example name, phone, email) and which campaign, ad set and ad it came from.
- CRM records the business creates: tags, notes, deals, segments, broadcasts and automation history.
Data from Meta and Google, with the business's permission
- WhatsApp Business Account and phone number IDs, display number, verified name and quality rating.
- Facebook Page IDs and names, and ad account performance (spend, impressions, clicks, leads).
- Access tokens that let the Service act for the business. These are encrypted at rest and never shown in the app.
Technical data
- Server logs (IP address, browser, pages requested, errors) and a session cookie that keeps you signed in. We do not use advertising or cross-site tracking cookies.
3. How we use it
- To provide the Service: send and receive WhatsApp messages, manage message templates, capture and route leads, run the automations and chatbot flows a business sets up, and show reports.
- To keep the Service secure, prevent abuse, and fix problems.
- To support you and tell you about changes to the Service.
- To meet legal obligations.
We do not sell personal data. We do not use a business's data, or data received from Meta, for advertising, to build profiles of people, or to train AI models.
4. Data from Meta platforms
When a business connects WhatsApp, Facebook or Instagram, we receive data through Meta's APIs under the permissions it grants
(such as whatsapp_business_messaging, whatsapp_business_management, business_management,
leads_retrieval and ads_read). We use this data only to provide the features that business has turned on,
in line with Meta's Platform Terms and Developer Policies. When a business disconnects an account or asks us to delete its data,
we delete the related tokens and Meta data as described in our data deletion instructions.
5. Who we share it with
- Meta (WhatsApp Business Platform, Facebook and Instagram APIs), to deliver messages and read leads and ad data for the business.
- Google (Google Ads API), only if a business connects Google Ads.
- Service providers who host and run the Service for us, such as cloud hosting, storage and email delivery, under contracts that require them to protect the data and use it only for us.
- Authorities, when the law requires it.
6. Transfers outside Malaysia
Our providers, including Meta, may process data outside Malaysia. When they do, we rely on contractual and technical safeguards so the data stays protected to a standard comparable with the PDPA.
7. How long we keep it
- Account data: while your account is active, then deleted within 30 days of closure unless the law requires longer.
- Business data: until the business deletes it or ends its subscription. We then delete it within 30 days; backups roll off within a further 30 days.
- Server logs: up to 90 days.
8. Security
Data is encrypted in transit (TLS). Access tokens and credentials are encrypted at rest. Each workspace's data is kept separate, and team members only see what their role allows. No system is perfectly secure, but we work to protect your data and will notify affected businesses of a breach as the law requires.
9. Your rights
Under the PDPA you may ask to access or correct your personal data, withdraw consent, or limit how it is processed. Email hello@gatefoldsolutions.com. We reply within 21 days. If your data is held by a business that uses Gatefold, we will pass your request to that business.
10. Children
The Service is for businesses and is not directed at anyone under 18.
11. Changes
We will post any changes here and update the date above. If a change is significant, we will tell account owners by email.
12. Contact
Gatefold Digital Analytics Sdn. Bhd. (1518988-P). Email: hello@gatefoldsolutions.com.