Our notice under Malaysia's Personal Data Protection Act 2010.
We collect the data needed to run your restaurant's WhatsApp AI and marketing — menus, bookings, and customer messages. Some processing runs on DeepSeek, Supabase, and Meta's infrastructure outside Malaysia. You can ask to see, correct, or delete your data, or withdraw consent, at any time via [email protected]. Full detail below.
This notice is issued in accordance with Malaysia's Personal Data Protection Act 2010 ("PDPA"). It applies to personal data collected by Upside on behalf of participating F&B businesses, including data collected via WhatsApp messaging, online bookings, and account setup. It supplements, and should be read alongside, our full Privacy Policy.
Depending on how you interact with Upside, we may collect: name and phone number (from WhatsApp conversations and bookings), message content and timestamps, order and reservation history, and — for restaurant owners — business registration and billing details.
We process this data to respond to enquiries and bookings via WhatsApp AI, to generate marketing campaigns and content tailored to each business, to produce analytics and a weekly CMO strategy, and to administer subscriptions and billing.
Personal data may be disclosed to the following processors strictly to deliver the service:
We do not disclose personal data to third parties for their own marketing purposes.
DeepSeek, Supabase, and Meta may process data on servers located outside Malaysia. Where this occurs, we require contractual safeguards from our processors intended to provide a standard of protection comparable to the PDPA.
Under the PDPA, you have the right to: request access to your personal data; request correction of inaccurate data; withdraw consent to processing at any time; and request that we cease processing where consent is withdrawn, subject to any legal or contractual obligations that require continued processing.
We apply technical and organisational safeguards proportionate to the sensitivity of the data involved, and retain personal data only for as long as necessary to provide the service or as required by law.
To make a PDPA request — access, correction, or withdrawal of consent — email [email protected] with your name and the phone number or account associated with your request. We aim to respond within 21 days.