Privacy Policy
What we collect, why we hold it, how long we keep it, and what you can ask us to do with it.
1. Who we are
Boka is an AI receptionist that answers calls and messages on behalf of businesses in Malaysia. In this policy “we” means Boka and “you” means whoever is reading it, whether you are our customer or someone who has called one of them.
Our Data Protection Officer can be reached at privacy@boka.my.
2. Two kinds of people, two different roles
This matters more than it sounds, because it decides who you should ask for what.
- Our customers — the businesses that subscribe to Boka. We decide how their account data is handled, so for that data we are the data user under the PDPA.
- Callers and messagers — members of the public contacting one of those businesses. That business decides why it is collecting your details; we process them on its instructions, as a data processor acting for it.
In practice: if you rang a business and want your recording deleted, that business is the right first stop. Ask us and we will act on their instruction, or pass your request to them and tell you we have done so.
3. What we collect
From our customers
- Business name, address, and the phone numbers you route to us.
- Names, email addresses and roles of the staff you give dashboard access to.
- Billing details and payment records. Card numbers are held by our payment processor, never by us.
- Usage records — call counts, minutes, and what each call resulted in.
From callers and messagers
- Your phone number, and your name if you give it.
- An audio recording of the call, where the business has recording switched on. You are told this at the start of the call, before you say anything substantive.
- A written transcript and a short summary of the conversation.
- Appointment details — what you booked, when, and any note you asked us to pass on.
- A record of previous contact with that same business, so the assistant can recognise you next time rather than starting from nothing.
We do not ask for identity-card numbers, bank details or health information, and the assistant is instructed never to request them. If you volunteer something like that mid-conversation it may end up in the transcript, which is one reason transcripts are access-controlled and deleted on the schedule below.
4. Why we hold it
- To answer the call and book the appointment — the thing you rang for.
- To show the business a record of what was said, so nothing is lost.
- To recognise returning callers and avoid making you repeat yourself.
- To bill our customers accurately for the minutes they used.
- To investigate faults and improve accuracy, particularly for Bahasa Malaysia and mixed-language speech.
- To meet our legal obligations, including record-keeping and tax.
5. Call recording and consent
Where a business has recording enabled, the recording notice is announced automatically at the start of every call, in the business’s primary language, before the assistant does anything else. It is not left to the AI to remember.
If you would rather not be recorded, say so and the assistant will take a message for the business to call you back instead. You can also ask the business directly to delete a recording of your call.
6. Who else sees it
We do not sell personal data, and we do not use call recordings or transcripts to train publicly available AI models. We share data only with:
- The business you contacted. It sees the transcript, summary and booking, because that is the entire point of the service.
- Our processors — cloud hosting, telephony, speech-to-text, text-to-speech, the AI model provider, and payment processing. Each is bound by contract to process data only on our instructions.
- Authorities, where we are legally required to disclose. We will tell the affected business unless we are prohibited from doing so.
7. Where it is stored
Call recordings and transcripts are stored in Malaysia or Singapore, encrypted at rest and in transit. Some processors operate infrastructure outside Malaysia; where personal data is transferred abroad we rely on contractual protections requiring a standard of care no lower than the PDPA.
8. How long we keep it
- Recordings — deleted automatically on the retention period set by the business, by default 90 days.
- Transcripts, summaries and bookings — kept for the life of the business’s account, since that is its own customer record.
- Billing and usage records — kept for seven years, as tax law requires.
- After an account closes — customer data is deleted within 90 days, except where we must keep it by law.
9. Your rights
Under the PDPA you may ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct anything inaccurate;
- delete data we no longer have a reason to keep;
- stop processing that is causing you damage or distress;
- withdraw a consent you previously gave.
Email privacy@boka.my. We aim to respond within 21 days. We may ask you to verify your identity first — otherwise the request itself becomes a way to extract someone else’s data. Where the data belongs to one of our customers’ records, we will route your request to them and confirm that we have.
10. Security
Access is restricted to staff who need it, each business’s data is isolated at the database level so one customer cannot read another’s, and data is encrypted in transit and at rest. No system is perfectly secure; if a breach occurs that poses a significant risk, we will notify the affected businesses and the Commissioner within 72 hours of becoming aware of it.
11. Children
Boka is sold to businesses and is not directed at children. We do not knowingly seek personal data from anyone under 18. A child may of course ring a business that uses Boka; those details are handled as any other caller’s, and a parent or guardian may ask for their deletion.
12. Changes
We will update the date at the top when this policy changes, and tell our customers by email before anything material takes effect.
13. Complaints
Come to us first — privacy@boka.my. If we cannot resolve it, you may complain to the Personal Data Protection Commissioner of Malaysia.
Questions about this document: privacy@boka.my.