Lakuchat Privacy Policy

Who we are. TF Globe Pte Ltd, Singapore, trading as Lakuchat ("we"). UEN 202223582W. Address 10 Mohamed Sultan Road, #02-01, Singapore 238960.

Data Protection Officer (DPO) and privacy contact: the Data Protection Officer of TF Globe Pte Ltd, privacy@lakuchat.com. This is the contact for all questions and requests in this policy.

From visitors and merchants: name, email, phone, business name and country, login details (password handled by our login provider), plan and billing details (card details are handled by Stripe and never stored by us), device and usage data (pages visited, features used, errors), messages with our support team, consent records, and the waitlist form.

On behalf of merchants (their customers' data): phone number or channel ID and profile name, messages and attachments, delivery details (name, address, phone), orders and payment status, payment screenshots for QR transfers, and anything else a customer chooses to send. We do not want sensitive data (health, ID numbers, card numbers). Please do not send it in chat.

Not collected: we do not receive customers' payment card numbers; payment providers handle them.

Where it comes from: from you when you sign up, use the dashboard or contact us; automatically from your use of our website and Service (device and usage data); from your Stripe billing records; and, for customers' chats, from the customer through WhatsApp or Instagram and from the merchant (catalog, orders).

Do you have to give it to us? Account and billing details are needed to create and run your account; without them we cannot provide the Service. Consent to marketing emails and to analytics cookies is optional and does not affect the Service. Customers who message a merchant choose what they send; the merchant may need delivery details to fulfil an order.

Where the law (for example Indonesia's PDP Law, or Malaysia's PDPA) requires consent, we ask for it and you can withdraw it.

Messages are processed by AI language models run by our sub-processors to write replies. AI answers use the merchant's catalog and rules. Customers are told at the start of a chat that they are talking to an AI assistant and can ask for a person. We do not use customers' chats to train AI models. Our AI provider processes them under its paid-service terms, under which the provider does not use the content to improve its products or train its models; it may keep prompts and responses for a limited time solely to detect and prevent abuse, and may process or cache them in any country where it operates. AI can be wrong; merchants are responsible for what is said in their name.

With the merchant's permission given at sign-up (withdrawable in Settings), authorised staff may view a merchant's account to give support. Access is read-only by default, time-limited, hides phone numbers and addresses unless needed, never shows payment credentials or passwords, and is logged with a reason that the merchant can see. We may also access an account without permission where needed to stop abuse, fraud or a security incident, or to obey the law.

We do not sell personal data.

Our main systems are in Singapore. Some providers process data in other countries (for example Meta, the AI provider, email and monitoring). When data leaves the country where it was collected we rely on the mechanism allowed by that country's law, such as contractual safeguards, an adequacy or equivalent-protection assessment, certifications, or consent where needed. Contact us for details.

Depending on where you live (Malaysia PDPA, Indonesia PDP Law, Singapore PDPA) you may ask to: access your data, correct it, delete it, withdraw consent, restrict or object to processing, receive a copy or have it moved to another controller (data portability), and complain. For merchant account data, contact privacy@lakuchat.com; we aim to reply within 14 days and always within 21 days, or within any shorter time the law sets (and we tell you if the law lets us extend). For your chats with a merchant, contact the merchant, who is responsible; if you contact us we pass it on and help. Reply STOP to opt out of marketing or proactive messages.

Complaints: you may also complain to the data protection authority: Malaysia, the Personal Data Protection Commissioner; Singapore, the Personal Data Protection Commission (PDPC); Indonesia, the personal data protection authority (being set up under Law 27/2022) or the communications and digital ministry.

We use encryption in transit and for sensitive fields at rest, strict separation between merchants, staff multi-factor login, least-privilege access, logging, backups and testing. No system is perfectly secure. If a breach affects you, we tell the responsible merchant promptly (within 48 hours of becoming aware) and, where we are the controller, we notify you and the authorities as the law requires.

The Service is for businesses. We do not knowingly collect children's data. Merchants must not target children or collect their data without lawful consent. If you think a child's data was collected, contact us.

Our website uses cookies and similar tools for essential functions and, with consent where required, for analytics (Google Analytics). We do not use them to identify individuals across sites. You can control cookies in your browser and through the cookie banner.

We will post updates with a new date and, for material changes, tell merchants by email or in the dashboard at least 30 days before.