Privacy policy

This policy explains how Vibe Projection PLT ([LLP registration no.]), trading as Hiro (“Hiro”, “we”) handles personal data. It is written to meet Malaysia's Personal Data Protection Act 2010 (as amended) and, for clients and visitors in Australia, the Privacy Act 1988 and the Australian Privacy Principles.

Two kinds of data

• Data about you as a website visitor, prospect or client contact (for example when you book a demo). Here we decide how the data is used.
• Data about your clients that Hiro handles while working for your business (their enquiries, messages, quotes and invoices). Here your business decides and is responsible for having a lawful basis and giving its own clients notice; we process the data only on your instructions, under a data processing agreement we sign with every client.

What we collect about you

• What you give us: your name, business name and type, city, WhatsApp number, email and anything you write to us.
• Messages you exchange with us on WhatsApp or email.
• Basic technical data from your visit (such as browser type and pages viewed), kept to what the site needs to work and improve.

What Hiro handles for clients

To do its job, Hiro reads the WhatsApp conversations on the number you connect (and, if you connect them, Instagram and email), drafts replies and documents, and stores the conversations, contacts, drafts and your team's decisions in your own database.

• Official connection: messages reach Hiro through Meta's WhatsApp Business Platform. Meta processes them under its own terms and privacy policy.
• Quick Connect (linked device): Hiro is linked to your WhatsApp account as a linked device, so it can see the chats that a linked device can see, including chats that are not about your business. We use only business conversations, never read or use personal chats on purpose, and you can unlink Hiro at any time from WhatsApp → Linked devices. We store the link's session keys encrypted, separately from your data, and delete them when you unlink or leave. Quick Connect is not provided or approved by Meta; see our terms for what that means for your number.

How we use it

• To reply to you, arrange a demo and, if you become a client, set up and run Hiro for you.
• To send invoices and service messages.
• To tell you about Hiro, only where the law allows and always with an easy way to stop.

We don't sell personal data. We don't use your clients' data for anything except running your desk, and we never use it to message anyone on our own behalf.

Who we share it with

We use a small number of service providers to run Hiro, each bound to protect the data:

• Meta (WhatsApp Business Platform), for clients on the Official connection.
• Anthropic (Claude API), to draft replies and documents. Data sent through the API is not used to train its models.
• Our hosting and database providers. [PLACEHOLDER: name them, e.g. Vercel and Supabase, and their regions.]
• Your accounting software (for example Bukku), when you connect it.

Some of these providers process data outside Malaysia or Australia. We only use providers with appropriate safeguards, and we tell clients where their data is stored.

How long we keep it

We keep prospect data for up to [PLACEHOLDER: 24] months after our last contact, and client data for as long as we work together plus any period the law requires. Clients can ask us to return or delete their data when they leave.

Security

Each client's data is kept in its own database, access is limited to the people who need it, and secrets and session keys are stored encrypted and separately from the data. If a breach affects your data, we'll tell you and the authorities as the law requires.

Your rights

You can ask to see the personal data we hold about you, correct it, or stop us using it for marketing. Australian residents can also complain to the Office of the Australian Information Commissioner, and Malaysian residents to the Personal Data Protection Commissioner, if they're not satisfied with our answer.

Contact

Email hello@hirocrew.com. [PLACEHOLDER: postal address and the name of our data protection officer, if one is required.]