Privacy Notice

Effective 24 September 2026 · Operated by Inter Forward Trading

This notice explains how Inter Forward Trading (“we”, “us”) handles personal data when operating Tegur, a WhatsApp Business Platform tool. It is written to meet the Malaysian Personal Data Protection Act 2010 (as amended in 2024), Meta’s platform requirements and Google’s API Services User Data Policy.

1. Who we are

Inter Forward Trading is a business registered in Malaysia (registration 201503184654 (002450783-W)) at No. 30, Jalan 2/116B, Kuchai Entrepreneurs Park, Off Kuchai Lama, 58200 Kuala Lumpur, Malaysia. We are the data controller for Tegur. Contact: markalex91@gmail.com.

2. What Tegur does

Tegur lets an account holder send WhatsApp messages from a business phone number using Meta’s WhatsApp Business Platform (Cloud API), and read and reply to the responses. The same number can keep working in the WhatsApp Business app on the account holder’s phone. Tegur is used by us and by property negotiators we invite; it is not open to the public.

3. Information we process

Account holders (people who sign in to Tegur)

• Email address and a password (stored only as a hash by our authentication provider).
• WhatsApp Business Account and phone number identifiers issued by Meta, and the access token Meta issues for them (stored encrypted).
• A log of actions taken in the account (for example sends, template changes, sign-ins), kept for security and audit.

Contacts (people an account holder messages)

• Phone number and, where the account holder has recorded them, name and property details such as a building or unit reference.
• The content of messages sent to and received from the contact, including any media they send, together with delivery and read status.
• The contact’s replies to outreach, including whether they have asked not to be contacted.

Facebook and WhatsApp connection data

When an account holder connects a number through Meta’s Embedded Signup, Meta returns the resulting WhatsApp Business Account and phone number identifiers. Tegur does not store Facebook profile information and does not exchange or keep the Facebook authorization code from that flow.

Technical records

We keep logs of our requests to Meta’s API and Meta’s responses (which can include message template text and delivery events), plus standard web server and security logs.

4. Google user data (Google Contacts)

An account holder can connect a Google account’s Contacts to Tegur, so that the contacts in Tegur and the contacts on their phone stay the same. This happens only after the account holder presses “Connect Google Contacts” in Tegur and approves it on Google’s own screen. Connecting is optional and Tegur works without it. The connection belongs to one Tegur login. There is no “Sign in with Google”: connecting Google Contacts does not change how anyone signs in to Tegur.

Tegur’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Tegur asks Google for

• Permission to see and edit the contacts in the connected Google account.
• The basic Google permission that tells Tegur which Google account is connected, such as its email address. Tegur uses it only to identify the connected account.

The account holder chooses the direction

When connecting, the account holder picks a sync direction: Both ways, Only Tegur to phone or Only phone to Tegur, and can change it later. Before the first sync, and before any change of direction that would write something, Tegur shows a Preview of what will change, and nothing is written until the account holder presses Start sync. An account holder who does not want their personal phone contacts copied into Tegur can choose Only Tegur to phone.

What Tegur copies from Google into Tegur

Only when the direction is Both ways or Only phone to Tegur:

• Every Google contact that has a phone number, including personal contacts and not only property owners. Each one becomes a contact in Tegur.
• For each of them: the first name and last name exactly as saved in Google, the phone numbers, and one email address.
• Google contacts with no phone number are skipped and not copied.
• Tegur does not copy addresses, photos or any other field.
• When a name or email changes, Tegur records where the change was made and what it replaced.

In every direction, Tegur reads the Google contacts to match them with contacts already in Tegur by phone number, so that nobody is duplicated, and remembers which Google contact belongs to which Tegur contact. In Only Tegur to phone, nothing else from Google is added to Tegur.

What Tegur writes to the Google account

Only when the direction is Both ways or Only Tegur to phone, and only for:

• people who reply on WhatsApp (any message or button except “Don’t contact”);
• contacts the account holder types into Tegur by hand;
• unknown senders, once the account holder gives them a name in Tegur;
• anyone the account holder adds with “Add to phone”.

For those people Tegur writes only the first name, last name, email address and phone number, and only once it has both a name and a number. It never writes opt-outs, contact status, message history, the name Tegur uses to greet someone, or addresses. Each Google contact Tegur writes also carries a Tegur reference number in a field the Contacts app does not show, so that Tegur can recognise it later; the reference says nothing about the person. In Both ways, a name or email changed in Tegur is changed on the Google contact too. Tegur deletes a Google contact only as a result of something the account holder does in Tegur, such as deleting the matching contact.

How Tegur uses it

• Only to provide the Google Contacts feature the account holder sees in Tegur: keeping Tegur’s contacts and the Google account’s contacts the same, and letting the account holder see, message and manage those contacts in Tegur like any other contact.
• We do not sell it, use it for advertising or to show ads, or pass it to advertising platforms or data brokers. We do not use it to assess credit-worthiness or for lending.
• We do not share it with anyone else, except the providers in section 7 that run Tegur, and only as far as Tegur’s features need (for example, Meta carries a WhatsApp message the account holder chooses to send), or where the law requires it.

Who at Inter Forward Trading can see it

• In Tegur, contacts from Google are visible only to the login that connected them. Each login sees only its own data, enforced in the database.
• Our administrator has technical access to the database but does not read an account holder’s Google contact data unless the account holder asks us to for support, it is needed for security (for example, investigating a fault or abuse), or the law requires it.
• The automated assistants we operate (section 7) use Google contact data only to provide Tegur’s features to the login it belongs to, such as drafting a reply the account holder sees in Tegur.

Where it is stored and how it is protected

• In Tegur’s database, hosted by Supabase in Singapore, with the rest of Tegur’s data (section 8).
• The keys Google issues so that Tegur can reach the contacts are stored encrypted in Supabase Vault.

How long it is kept, and how to stop it

• A contact copied from Google becomes an ordinary Tegur contact and is kept the same way as other contacts (section 9). Deleting it on the phone does not delete it from Tegur; Tegur marks it as no longer on the phone.
• An account holder can remove Tegur’s access at any time in their Google Account at myaccount.google.com/permissions. Tegur can then no longer read or change that account’s contacts. Removing access does not by itself delete anything Tegur already holds, and contacts Tegur added to the Google account stay there as the account holder’s own.
• To have data copied from Google deleted from Tegur, follow our data deletion page; we respond within 30 days.

The people in the contacts

The people in a connected Google account have not given their details to us directly. As with any contact an account holder adds (section 5), the account holder is responsible for having a lawful basis to keep and use their details in Tegur. Those people have the rights in section 10, including asking for their details to be deleted.

5. Where the information comes from

Contact details are uploaded or entered by the account holder, who is responsible for having a lawful basis to message those people. Message content comes from the account holder and from the contacts themselves. Connection identifiers and delivery events come from Meta. If an account holder connects Google Contacts, contact details can also come from that Google account (section 4).

6. Why we process it

• To send the messages an account holder asks to send, and to show and organise the replies.
• To honour opt-outs: a contact who asks not to be contacted is suppressed from further outreach.
• To enforce Meta’s rules, such as the 24-hour customer service window and approved message templates.
• To keep the service secure, to investigate problems, and to keep an audit trail.

We rely on the account holder’s instructions and our legitimate interest in operating the service. Where consent is required for outreach, obtaining it is the account holder’s responsibility.

7. Who receives it

We do not sell personal data and do not use it for advertising.

8. International transfers

Our database and stored media are hosted by Supabase in Singapore. Meta, Vercel and Google operate infrastructure in other countries. Personal data processed through Tegur is therefore stored and handled outside Malaysia by those providers under their own safeguards.

9. How long we keep it

• Messages and delivery records are kept while the account is active, so that conversation history stays intact.
• Opt-out records are kept for as long as needed to keep honouring the opt-out.
• Audit records are kept as an append-only log and identify people only by internal identifiers.
• Deleting a contact removes their details; message history may remain without the link to that contact.
• The binding between a WhatsApp phone number and the Tegur account that connected it is permanent by design, to prevent a number being taken over by another account.

10. Your rights

Under the Personal Data Protection Act 2010 you may ask to access or correct personal data we hold about you, and you may withdraw consent to further messages. If you receive a message from a Tegur user and do not want more, reply saying so or use the “Don’t contact me” option where offered; that number is then suppressed. To request deletion, follow the steps on our data deletion page. Write to markalex91@gmail.com for anything else; we respond within 30 days.

11. Security

Access tokens are stored encrypted. Each account can only see its own data, enforced in the database. All traffic uses HTTPS. Access by our staff and assistants is logged.

12. Children

Tegur is a business tool and is not directed at anyone under 18.

13. Changes

We will update this page when our practices change and revise the effective date above. Material changes will also be announced to account holders.

14. Contact

Inter Forward Trading, No. 30, Jalan 2/116B, Kuchai Entrepreneurs Park, Off Kuchai Lama, 58200 Kuala Lumpur, Malaysia. Email: markalex91@gmail.com. Website: https://www.interforwardtrading.com.