Privacy Policy
CX010 Sdn Bhd (“CX010”, “we”, “us” or “our”) provides Customer Brain, a platform that helps businesses connect customer information, understand customer needs and coordinate actions using AI-enabled features. This Privacy Policy explains how we handle personal data through cx010.com, Customer Brain and, during migration, cx.nexphace.com.
1. Who is responsible for your data
For account administration, billing, enquiries and our own business operations, CX010 determines how personal data is used. When a business customer uploads customer databases, connects a sales, messaging or advertising account, or otherwise submits personal data for processing through Customer Brain, that business generally determines the purposes of processing, and CX010 processes that data on its instructions under the applicable service agreement. If your data was submitted by one of our customers (for example, if you messaged or reviewed a shop that uses Customer Brain), contact that business first about its use of your data. We will assist it as required by law and our agreement.
2. Personal data we collect
- Contact and account information, such as your name, email address, telephone number, company name, account credentials and account settings.
- Information you upload or connect, including files, customer databases, contact records, messages, reviews, orders and other business content. The data involved depends on what you and your organisation submit or connect.
- Subscription and transaction information, such as plan details, billing contact, payment status and transaction references. Card payments are processed by Stripe; CX010 does not receive or store full card numbers.
- Technical and usage information, such as IP address, browser and device information, access logs, feature activity and cookie or local-storage identifiers.
- Communications, including enquiries, support requests and feedback.
We obtain data from you, authorised members of your organisation, platforms and services you connect, payment and technical service providers, and activity on our website or platform. Please do not submit sensitive personal data or other high-risk information, including health information, payment-account credentials or government identification documents, unless the relevant feature and service agreement expressly support it and you have the necessary authority.
3. How we use personal data
We use personal data to create and manage accounts; deliver the features and integrations you request; process subscriptions and payments; respond to enquiries and provide support; protect accounts and investigate abuse; diagnose faults and maintain the service; and meet legal, accounting and contractual obligations. Where permitted, we may send product news and marketing communications. You can unsubscribe from marketing messages at any time or contact us to opt out.
Some information is necessary to create an account, process payment or provide requested functionality. If it is not provided, we may be unable to provide that service. Optional information is identified at collection. Where consent is required, we seek it separately; use of the service is not blanket consent to every form of processing.
4. AI processing and action approval
AI-enabled features may analyse submitted content, classify messages and reviews, generate summaries, and draft suggested replies, campaigns or recommendations. To do this, relevant content is transmitted to the AI provider used for the selected feature (see Section 6). Outputs can be inaccurate and should be checked before decisions or external actions are taken.
We do not use Customer Content, including connected-platform data, AI prompts or AI outputs, to train or fine-tune AI models. We use AI provider services that are contracted and configured not to use this content for model training. AI providers may keep data for a limited period for security and abuse monitoring under their terms.
Before Customer Brain carries out any external action, such as sending a reply, launching an advertisement, changing a budget or uploading an audience, it presents the proposed action to an authorised business user for approval. The action is carried out only after that approval and only within its approved scope. Connecting an account or accepting our Terms is not approval for future actions. Customer Brain does not make decisions that produce legal or similarly significant effects on individuals solely by automated means.
Connecting a third-party service authorises the access needed for the features you enable, subject to the permissions shown during authorisation. Its own privacy terms also apply. Review permissions before connecting a service.
5. Data from TikTok, TikTok Shop and other connected platforms, including advertising
A business customer may connect its own TikTok account, TikTok Shop, TikTok advertising account and other supported sales, messaging and advertising accounts (such as Shopee, Lazada, Facebook, Instagram, Meta Ads and Google Ads) to Customer Brain through their official APIs. We access only the data needed for the features the business enables and covered by the permissions it grants. Depending on the integration, this may include:
- Messages: customer service and business inbox conversations, including the sender’s display name, username or platform ID, message content, attachments, timestamps and related order or product references;
- Reviews and ratings: product review text, star ratings, review images, the reviewer’s display name, and the related product, SKU and order identifiers;
- Shop and order information: shop profile, product listings and the order details needed to link messages and reviews to the right order and customer record;
- Advertising information: advertising account details, campaigns, ad groups, ads and creatives, budgets, and aggregated performance metrics such as impressions, reach, clicks, spend and conversions.
How we use it. We use connected-platform data only to provide the enabled features to the business that connected it, and only for purposes permitted by the source platform. These features include a unified inbox, replies, sentiment and topic analysis, suggested replies, linking interactions to customer records, advertising management and reports for that business.
Advertising on behalf of a business. Customer Brain presents each proposed advertising action to an authorised business user for approval before carrying it out. Once a specific action is approved, Customer Brain may, within that approved scope:
- create, edit, pause and report on campaigns, ad groups, ads and budgets in the business’s own advertising account;
- upload a customer audience list selected by the business for matching, targeting or exclusion. Identifiers such as email addresses and phone numbers are normalised and hashed before transmission as the receiving platform requires. Hashed data is still personal data, and the receiving platform handles matching, retention and deletion under its own terms;
- send conversion events (for example, a completed purchase) to the advertising platform so the business can measure ad results, where the business enables this.
The business is responsible for choosing an eligible data source and for providing the notices and obtaining the consents required for advertising and conversion measurement. A business’s instructions do not override source-platform restrictions. We do not use data obtained from TikTok Shop orders, messages or reviews for audience uploads, conversion events or other advertising unless the applicable platform terms and law expressly permit it. Ad spend is charged by the advertising platform to the business’s own advertising account.
Limits on platform-data use. We do not sell platform data, use one business’s data to advertise for another business or for CX010, combine data from unrelated businesses to profile individuals, disclose it to other customers, or use it to train AI models. We share platform data with our service providers only as needed to deliver the enabled feature and as permitted by the applicable platform terms.
Disconnecting. A business can disconnect an integration in Customer Brain or revoke access from the source platform (for example, in TikTok Shop Seller Center or TikTok for Business). After disconnection, we stop collecting new data and stop taking actions through that connection, and we delete previously collected data as described in Section 9. Individuals may contact the relevant business, or us at contactus@cx010.com, for help with access, deletion or advertising-audience requests. Removing a person from an audience already held by an advertising platform must also be done in that platform, which the business can do in its advertising account.
6. Disclosure of personal data
We disclose data as needed to service providers that support our operations, authorised users and administrators within your organisation, connected services you enable, professional advisers, and authorities where legally required. Data may also be disclosed in a lawful corporate restructuring or business transfer, subject to appropriate confidentiality and data protection arrangements. Our main service providers are:
| Provider | Purpose | Main processing location |
|---|---|---|
| Supabase | Database, authentication and file storage | Australia |
| Google Cloud / Firebase | Web hosting and Gemini AI processing | United States and other Google Cloud regions |
| Anthropic | AI processing for selected features | United States |
| Stripe | Payment processing and subscription billing | United States and Singapore |
| Resend | Transactional email delivery | United States |
We will update this list when our providers change. Platforms you connect, such as TikTok, TikTok Shop, TikTok for Business, Shopee, Lazada, Meta and Google Ads, receive the data needed to perform actions you approve through them, such as sending a reply, launching a campaign, uploading an approved audience list or reporting a conversion.
7. Cookies and similar technologies
We use only essential technologies (cookies and browser local storage) to keep you signed in, protect your account and remember settings. These are required for the website and platform to work. We do not currently use analytics tools or advertising pixels on cx010.com or the Customer Brain platform. If we add them, we will update this Policy first and, where the law requires, ask for your consent before activating them.
You can control cookies through your browser settings. Blocking essential technologies may affect sign-in and other functions. Pixels or tags that a business installs on its own website are controlled by that business and covered by its own privacy notice.
8. International transfers
Personal data may be processed outside Malaysia by the providers and in the locations listed in Section 6. Before transferring personal data outside Malaysia, we assess the applicable cross-border transfer requirements under Malaysian law and put in place the arrangements they require, including contractual protections with our providers. Contact us for more information about the relevant locations and safeguards.
9. Retention and deletion
We retain personal data only for as long as needed for the purposes described here and to meet legal obligations. Connected-platform data follows its own deadline below even if it is copied into a customer record, file, AI prompt or output. Where the law or the source platform’s terms require an earlier deadline, that earlier deadline applies.
| Data | Retention |
|---|---|
| Account data, uploaded files and AI records not derived from a connected platform | While the account is active. After termination, you may request an export for 30 days; we then delete the data from active systems within a further 30 days. |
| Connected-platform data (including TikTok, TikTok Shop and advertising accounts), including copies and records derived from it | While needed for the enabled feature. Deleted from active systems within 30 days after disconnection, termination or a verified deletion request, or sooner where law or platform terms require. Requesting an export does not extend this deadline. |
| Audience-upload files and hashed identifiers | Deleted from Customer Brain within 30 days after upload, or sooner where required. Audiences held by an advertising platform are managed in that platform. |
| Security and access logs | Up to 12 months, limited to security and operational needs. |
| Enquiries and support records | Up to 2 years after the matter is closed. |
| Invoices and financial records | 7 years, as required by Malaysian law. |
| Backups | Expire within 30 days after the data is deleted from active systems. Backups are not used for normal operations, and deletions are reapplied if a backup is restored. |
Where we must keep data for a legal obligation or an actual legal claim, we keep only the relevant data, restrict its use and delete it when the reason ends. Contact us about account closure or deletion.
10. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse and disclosure, including encryption in transit, access controls and separation of customer workspaces. No online service is completely secure. Protect your credentials and notify us promptly if you suspect unauthorised access. We will respond to personal data breaches and provide notifications where required by applicable law.
11. Your rights and choices
Subject to applicable law, you may request access to or correction of your personal data, withdraw consent where processing relies on it, restrict direct marketing, and request portability where available. You may also request deletion, which we will assess against legal and contractual obligations. We may verify your identity and explain any applicable limitations or permitted fees. We respond to access and correction requests within the period required by law (generally 21 days). Withdrawal of consent may affect services that depend on that processing.
Send requests to contactus@cx010.com. If you are dissatisfied with our handling of your personal data, you may contact Malaysia’s Personal Data Protection Commissioner or another competent authority.
12. Children
Customer Brain is intended for business use and is not directed to children under 18. If you believe a child has provided personal data directly to us, contact us. Business customers must ensure any data they upload or connect about children is lawfully collected and supported by their agreement with us.
13. Changes and contact
We may update this Policy to reflect changes in the service, our practices or legal requirements. We will update the effective date and provide additional notice of material changes where required. Where a change requires new consent, we will request it.
CX010 Sdn BhdA-5-39, IOI Boulevard, Jalan Kenari 5, Bandar Puchong Jaya,
47170 Puchong, Selangor, Malaysia
Email: contactus@cx010.com