Privacy Policy - ClarityERP

ClarityERP is a business management platform (quotations, invoicing, stock, payroll, CRM and a customer messaging inbox) used by businesses ("customers") to run their operations. This policy explains what we collect, why, where it is stored and how it is deleted. It applies to the ClarityERP web application, the ClarityERP online catalog pages, and messages that reach our customers through WhatsApp, Facebook Messenger and Instagram.

1. Who we are

ClarityERP is operated by Brand's Talk Marketing Agency (Malaysia). For anything in this policy, contact us at brandtalk.marketingfirm@gmail.com or through the enquiry form on this website.

2. Two kinds of people

Customers: the businesses (and their staff) who sign up for ClarityERP. They enter their own business data into the system.
End users: the people who deal with our customers, for example a shopper who messages a customer's WhatsApp number, Facebook Page or Instagram account, or who sends an enquiry from a customer's online catalog. We process end-user data on behalf of our customers.

3. What we collect

Data	Where it comes from	Why
Account details: name, email, password (hashed), company name, logo, address, phone, tax and bank details	Entered by the customer at sign-up and in Settings	To run the customer's account and print their documents
Business records: clients, suppliers, products, quotations, invoices, payments, stock, payroll, claims, projects	Entered or uploaded by the customer	The core service
Messages: message text, attachments (photos, documents, voice notes), sender name and platform ID, phone number (WhatsApp), delivery and read status	Received from Meta's WhatsApp Business Platform, Messenger Platform and Instagram Messaging API, and sent by the customer from the inbox	So the customer can read and reply to their own customers in one inbox
Facebook Page, WhatsApp Business Account and Instagram account identifiers and access tokens	Granted by the customer when they connect a channel with Facebook Login or WhatsApp Embedded Signup	To receive and send messages on the customer's behalf
Catalog enquiries: name, phone number, company, message	Submitted by an end user on a customer's online catalog page	Passed to that customer as a lead
Technical logs: request time, IP address, browser type	Automatic	Security and troubleshooting; kept for a short period by our hosting providers

4. How we use data

To provide the features the customer uses. We do not sell data and we do not use customer or end-user data for advertising.
Optional AI features (for example drafting an email or reading a receipt) send the relevant text or image to Anthropic's API to produce the result. This is only triggered by the customer's action.
We only read a customer's data to support them when they ask, or when required to investigate abuse or a security incident.

5. Meta platform data

When a customer connects WhatsApp, a Facebook Page or Instagram, we act as the customer's technology provider. Messages, sender identifiers and attachments received from Meta are stored in the customer's ClarityERP account so the customer can reply. Access tokens are stored encrypted at rest and are never shown in the browser. We use Meta data only to deliver the messaging inbox to that customer and for no other purpose, in line with Meta's Platform Terms and Developer Policies. Message costs charged by Meta are billed by Meta to the customer's own business account.

6. Where data is stored and who processes it

Supabase (database, file storage, serverless functions) in the Singapore region.
Netlify (web hosting and content delivery).
Meta Platforms (delivery of WhatsApp, Messenger and Instagram messages).
Anthropic (AI features, only the content needed for the request).
Lembaga Hasil Dalam Negeri Malaysia (MyInvois) when a customer submits e-Invoices.

These providers process data under their own security commitments and only as needed to run the service.

7. Retention

Customer account and business records are kept for as long as the account is active.
Messages and attachments are kept in the customer's account until the customer deletes the conversation or disconnects the channel and asks for deletion, or until the account is closed.
When an account is closed, its data is deleted within 30 days, except records we must keep by law (for example invoices already submitted to MyInvois).

8. Your rights and how to delete data

Customers can export all their data at any time from Settings → Data Export, edit any record, disconnect a messaging channel in Settings → Preferences, and close their account by contacting us.
End users who messaged one of our customers can ask that customer to delete the conversation, or contact us at the address above. If you remove ClarityERP from your Facebook settings, Meta notifies us and we delete the Messenger and Instagram conversation data tied to your Facebook user. See our Data Deletion Instructions.
We respond to access, correction and deletion requests within 14 days.

9. Security

All traffic is encrypted (HTTPS). Data in the database is isolated per customer with row-level security, so one customer can never read another customer's records. Channel access tokens are only handled by server-side functions. Staff accounts are limited by the module permissions the customer sets.

10. Cookies

The application uses only the session storage needed to keep you signed in and remember interface preferences. The marketing website does not use tracking cookies.

11. Changes

If this policy changes materially we will notify customers in the application and update the date at the top of this page.