LEGAL

Privacy Policy

How Upside describes its handling of personal data.

Published document · review required

This is the existing policy text, dated 1 July 2026. Some product, provider and pricing references reflect the older service. It must be reconciled with the current offer before launch.

1. Overview

Upside ("Upside", "we", "us") provides an AI marketing platform for food & beverage businesses in Malaysia, including WhatsApp-based customer messaging, campaign generation, and business analytics. This Privacy Policy explains what personal data we collect from restaurant owners, their staff, and their customers when using Upside, why we collect it, and the choices available to you. This policy is drafted with regard to Malaysia's Personal Data Protection Act 2010 ("PDPA") — see also our separate PDPA Notice for a Malaysia-specific summary of your rights.

2. Information we collect

We collect information in three broad categories:

  • Account & business data — business name, owner contact details, menu, pricing, and booking information supplied when you set up Upside for your restaurant.
  • End-customer data — names, phone numbers, and message content from diners who message your restaurant's WhatsApp number, plus booking and order history needed to answer them.
  • Usage data — pages visited, features used, and device/browser information, collected automatically to keep the product working and to improve it.

3. How we use this information

We use personal data to operate the Upside service: to generate and send WhatsApp replies and campaigns on your behalf, to power Business Brain's understanding of your restaurant, to produce your weekly CMO strategy, to bill your subscription, and to provide customer support. We do not sell personal data to third parties.

4. WhatsApp messaging

Upside connects to the WhatsApp Business Platform (operated by Meta) to send and receive messages on your restaurant's behalf. Message content, delivery status, and metadata are processed to generate accurate, on-brand replies and to measure campaign performance. Customers messaging your business number are subject to WhatsApp's own terms in addition to this policy.

5. Cross-border data transfers

Some processing takes place outside Malaysia. In particular:

  • DeepSeek — select AI language-model requests may be routed to DeepSeek's infrastructure to generate reply drafts and campaign copy. Only the data necessary to produce a response is sent, and it is not used by DeepSeek to train models serving other customers under our agreement with them.
  • Supabase — our primary application database and file storage are hosted on Supabase's cloud infrastructure, which may store data in regions outside Malaysia.
  • Meta — WhatsApp Business Platform messaging is processed via Meta's infrastructure, subject to Meta's own data handling terms.

Where personal data is transferred outside Malaysia, we take reasonable steps to ensure it receives a standard of protection comparable to the PDPA, including contractual safeguards with our processors.

6. Data retention

We retain business and customer data for as long as your Upside subscription is active, plus a limited period afterward to comply with accounting and legal obligations. You may request earlier deletion as described in "Your rights" below.

7. Your rights

Subject to the PDPA, you may request access to, correction of, or deletion of your personal data, and may withdraw previously given consent to processing. Restaurant owners can also request a copy or deletion of their end-customers' WhatsApp conversation data. To exercise any of these rights, contact us using the details below.

8. Security

We use industry-standard technical and organisational measures — including encryption in transit, access controls, and regular review of our processors' security practices — to protect personal data against unauthorised access, loss, or misuse.

9. Children's privacy

Upside is a business tool intended for restaurant owners, staff, and adult customers. We do not knowingly collect personal data from children, and end-customer messaging is expected to occur in the context of ordinary restaurant bookings and enquiries.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "last updated" date at the top of this page.

11. Contact us

Questions about this Privacy Policy or your personal data can be sent to support@upside.com.my, or via our Contact page.