ArmLyst Privacy Policy (EN)

1. Who we are

ArmLyst ("we") is a product of ArmBot Academy (SSM 202603246160), 38-1 Jalan Delima, Pusat Perdagangan Pontian, 82000 Pontian, Johor, Malaysia. We are the data user under Malaysia's Personal Data Protection Act 2010 (PDPA) for personal data handled in connection with the Service. The Service is for business use by people aged 18 and over.

2. Where this policy applies

The ArmLyst Service: website (armlyst.com), app (app.armlyst.com), accounts and paid plans. The waitlist has its own Privacy Notice, which continues to apply to waitlist data.

3. What we collect and where it comes from

1. From you: account and profile information (name, email, company, users and roles); billing and payment information (handled by our payment providers; we do not store full card details); content you upload (sales and ad-spend CSV files; your files may include your customers' email addresses or phone numbers, we do not need names, and we use them only to provide the Service to you); and questions you type into the Ask feature.

2. From connectors, where available: if you connect Meta Ads or Google Ads, we read ad spend data from your account using access credentials you supply, and we store those credentials encrypted (see section 6).

3. Automatically: IP address, browser/device type, log and usage data.

4. From the waitlist: what you gave there (name, email, company, ad platforms, optional details), per the waitlist notice.

We do not sell personal data. We do not use your data to build advertising audiences or retarget you.

4. Why we collect it

(a) Create and manage your account and provide the Service; (b) billing and payments (Billing Terms); (c) answer your questions about your data; (d) security and operation; (e) legal obligations; (f) contact about your account and the Service. No other purpose without telling you and, where required, asking consent.

5. AI processing (the Ask feature)

When you ask a question, we send the text of your question and the aggregated metrics results needed to answer it (which can include your campaign names) to our AI analysis provider. The question text and aggregated results may be processed outside Malaysia. The answer is returned to you in the app. We send these items only to produce the answer. By default, our AI provider does not use the questions and answers sent through its API to train its models. It may keep them for a limited period (up to 30 days by default, longer if content is flagged for misuse).

We keep an audit record of each question asked, for security and support. In that audit copy the question text is masked after 3 months and the Ask audit events are deleted after 24 months. Separately, the questions and answers shown in your Ask chat history are kept until you clear the chat, or until a member or the organisation is deleted. Clearing the chat, or deleting a member or an organisation, also redacts the audit copy immediately.

6. Connectors (Meta Ads and Google Ads), where available

Connectors may not be enabled for every account. Where enabled:

You supply your own access credentials. We store them encrypted and use them read-only, to read ad spend data.
We use the data only to provide the Service to you (for example, to show your spend and answer your questions). We do not sell it and do not use it to build advertising audiences.
You can disconnect a connector at any time. Disconnecting deletes the credential we stored. It does not revoke it with Meta or Google, so also revoke it there if you want access to end. To delete data already synced through a connector, email contact@armlyst.com (see section 8).

Google API Services User Data Policy. ArmLyst's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In line with those requirements, we use Google user data only to provide and improve the user-facing features of the Service you asked for; we do not sell it; we do not use it for advertising; and we do not allow humans to read it except with your consent, for security or abuse investigation, to comply with law, or where it is aggregated and anonymised for internal operations.

Meta platform data. Data we receive from Meta through your own credentials is used only as described above. We do not sell it, and we delete it as described in section 8 when you delete it or ask us to.

7. Who receives it (our processors)

Our AI analysis provider, for the Ask feature (section 5).
Stripe (USD card payments).
Billplz (MYR payments, Malaysia).
Hosting: our servers are hosted by Bluehost in Singapore.
Email delivery: a transactional email service sends our emails to you (for example sign-in verification, invitations and receipts); it sees your email address and the content of those emails.
Meta and Google, as the platforms that hold the ad accounts you connect (we read data from them; we do not send your other data to them).

We do not otherwise disclose personal data except as required by law.

8. How long we keep it, and deleting it

Account and uploaded or synced data: while the account is active, and as needed for law or per the Billing Terms (not deleted for non-payment; a lapsed plan moves to Free). Your data is kept.
Deleting in the app: deletion in the app is a 30-day delete that you can cancel during that period.
Deletion on request: on your request we delete your data from our live systems within 21 days, and from backups 28 days after that.
Connectors: disconnecting deletes the stored credential; data already synced is deleted on request to contact@armlyst.com.
Payment records: kept for 7 years, as accounting and tax require. Card details are held by our payment providers under their own retention.
Technical and usage logs: 7 days.
Ask chat history (your questions and the answers): kept until you clear the chat, or until a member or the organisation is deleted. Ask audit copy: question text masked after 3 months, Ask audit events deleted after 24 months; clearing the chat or deleting a member or organisation redacts the audit copy immediately (section 5).
Waitlist data: per the waitlist notice.

9. Transfers outside Malaysia

Our servers are hosted in Singapore. The question text and aggregated results sent to our AI analysis provider may be processed outside Malaysia, and Stripe may process payment data in the United States.

11. Security

We use technical and organisational measures, including TLS encryption for data in transit, application-level encryption of the credentials you give us for connectors, and access controls. No method is completely secure.

12. Contact

contact@armlyst.com, or ArmBot Academy, 38-1 Jalan Delima, Pusat Perdagangan Pontian, 82000 Pontian, Johor, Malaysia.