Privacy Notice

Version 2026-10-17 · Last updated 17 October 2026 · Questions: gwadmin@w3jdev.com

1. Who we are

Bijou AI ("Bijou", "we") is a service of W3J LLC, a limited liability company organised in Wyoming, USA, operated from Malaysia. This notice explains how we handle personal data under Malaysia's Personal Data Protection Act 2010 as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA"), and, where it applies, the EU General Data Protection Regulation ("GDPR").

Contact and Data Protection Officer: gwadmin@w3jdev.com. Use this address for every privacy question or request.

2. Our role: controller or processor

• Controller (data user) for our own data: people who visit this website, fill in our forms, book a call with us, or open a Bijou account.
• Processor for the businesses that use Bijou ("Customers"). When you message a business that uses Bijou on WhatsApp or Telegram, that business decides why and how your messages are used. We process them on the business's behalf and instructions. Contact that business first about your data; we will help it respond.

3. What we collect

From website visitors and leads

• What you type into our forms or demo chat: name, email, phone, company, industry, message.
• Booking details if you book a call through Cal.com.
• Usage data: pages viewed, clicks, device, browser and approximate location from IP address (see Cookies).

From Customers (account holders)

• Account and business details: business name, email, phone, industry, login credentials (passwords are handled by our authentication provider and never stored in plain text).
• Records of your acceptance of these terms (time and version).
• Knowledge base content, FAQs, documents and settings you upload.
• Billing data handled by Stripe. We do not store full card numbers.

From people who message a Customer's business

• Phone number or Telegram ID, display name, the messages exchanged, timestamps, and any details you share in the chat (for example a booking request).
• Notes Bijou creates to do the job: conversation summaries, lead tags (for example hot, warm, cold), escalation records and the reasons the AI gave for a reply.

Giving us your contact details on a form is voluntary, but without them we cannot reply to you. Customers must give account details to use the service.

4. Why we use it

• To provide the service: reply to customers on a business's behalf, book appointments, hand chats to staff, send alerts (contract with the Customer; GDPR Art. 6(1)(b)).
• To reply to your enquiry and follow up about Bijou (your consent or our legitimate interest in answering you; GDPR Art. 6(1)(a)/(f)). You can opt out of marketing at any time.
• To bill Customers and keep accounts (contract and legal obligation).
• To keep the service secure and working: logs, abuse prevention, debugging (legitimate interest).
• To understand how the website is used (consent where required).

We do not sell personal data.

5. AI and your data

• Bijou uses third-party large language models to draft replies. The message, recent conversation history and the business's knowledge base text are sent to the model provider to generate a reply. See Sub-processors.
• We do not use conversation data to train our own or shared AI models.
• Some fallback routes (for example free model routes through OpenRouter) may be operated under terms that allow the provider to log requests. We are removing such routes from customer conversations; until that is complete they are used only when the primary model is unavailable.
• AI can make mistakes. Read our AI Disclosure for how Bijou is supervised.

6. How WhatsApp is connected

Bijou currently connects to a business's own WhatsApp number as a linked device using an open-source connector that we host. This is not the official WhatsApp Business Platform (Cloud API). Messages still travel through WhatsApp's own systems, which are governed by WhatsApp's terms and privacy policy. WhatsApp may restrict numbers that use unofficial connections; our Terms explain this risk to Customers.

7. Who we share it with

• The service providers listed on our Sub-processors page, under contract and only for the purposes above.
• The Customer whose business you messaged (it controls that conversation).
• Authorities, where the law requires it.
• A buyer or successor, if the business is reorganised or sold, under the same protections.

8. Transfers outside Malaysia

Some providers process data outside Malaysia, including in Singapore, the United States, China and other countries (see Sub-processors). Under section 129 of the PDPA as amended, we transfer personal data only where the destination has substantially similar protection, or where another lawful basis applies (for example your consent, or the transfer is needed to perform a contract with you). For EU personal data, we rely on safeguards such as the European Commission's Standard Contractual Clauses where a provider offers them. Ask us for details of the safeguard for a specific provider.

9. How long we keep it

• Conversation data: for as long as the Customer's account is active, unless the Customer deletes it earlier. After an account is closed we delete or anonymise it within 90 days, unless the law requires us to keep it.
• Leads and enquiries to Bijou: up to 24 months after our last contact, unless you ask us to delete them sooner.
• Billing records: as long as tax and accounting law requires.
• Automated retention limits are being built. Until they are, deletion is carried out on request (see Your rights).

10. Security and breaches

We use encryption in transit (TLS), encryption at rest provided by our database host, row-level separation of each Customer's data in our database, access controls, and secret management for credentials. No system is perfectly secure.

If a personal data breach occurs, we will notify the Personal Data Protection Commissioner of Malaysia as soon as practicable and within 72 hours of becoming aware of it, and notify affected individuals within 7 days where the breach is likely to cause significant harm, as the PDPA requires. Where we act as processor, we will tell the affected Customer without undue delay so it can meet its own duties (including under GDPR Art. 33 and 34).

11. Your rights

Under the PDPA you can ask to access your personal data and to correct it, withdraw consent, ask us to stop processing for direct marketing, and ask us to transmit your data to another data user (data portability). Under the GDPR you also have the rights to erasure, restriction, objection and portability, and to complain to your local supervisory authority.

How to make a request: email gwadmin@w3jdev.com from the email address or with the phone number the request is about. We will verify your identity before releasing or deleting anything, and reply within 21 days (PDPA) or one month (GDPR). If the data belongs to a Customer's conversation, we will pass your request to that business and help it respond.

You can complain to the Personal Data Protection Commissioner of Malaysia (pdp.gov.my) or, in the EU, to your national data protection authority.

12. Cookies and analytics

This website uses Google Analytics and PostHog to measure visits and improve the site, and stores small items in your browser (for example to remember that you dismissed a banner). You can block these with your browser settings or an ad/tracker blocker; the site still works.

13. Children

Bijou is a business service and is not directed at children. Customers must not use Bijou to target children.

14. Changes and language

We will post changes here and update the version date. Material changes will be notified to Customers by email. A Bahasa Malaysia version of this notice is being prepared; email us to receive it. If the versions differ, the version in the language you prefer will be explained to you on request.