1. Overview

ST Comp Holdings Sdn. Bhd. ("ST Comp Holdings", "we", "us", or "our") builds and operates messaging and CRM software that connects to the WhatsApp Business Platform, Facebook Messenger and Instagram on behalf of our clients. When a client connects one of those business accounts to one of our products, we sync and store data on their behalf so their team can reply to customers, keep conversation records, and run their business workflows.

This page explains exactly what that data is, how to ask us to delete it, and what happens once you do. It applies to our clients and to any individual whose data has been synced into our systems through one of our clients.

2. What Data We Store

Depending on which of our products is in use, we may hold the following data synced from the WhatsApp Business Platform, Facebook Messenger and Instagram:

• •Contacts: phone numbers, platform account identifiers, display names, and profile details of people who have messaged the connected business account
• •Chat history: message content, timestamps, delivery and read status, and message direction for conversations with the connected business account
• •Media: images, documents, audio, and other files sent or received in those conversations
• •Account and connection data: the WhatsApp Business account ID, phone number ID, Facebook Page and Instagram account IDs, and access tokens used to keep the integration running
• •Derived records: notes, tags, labels, assignments, and other CRM records added to a contact or conversation by the business using our software

3. How to Request Deletion

We handle deletion requests by email. There is no form to fill in and no account required.

So we can find the right records and confirm you are entitled to request their deletion, please include:

• •The phone number the data relates to, in full international format, or the Messenger or Instagram account name
• •The business or organisation you dealt with, if you are a customer rather than one of our clients
• •Whether you want everything deleted, or only a specific part of it — for example your chat history but not your contact record

We may contact you to verify your identity before acting on the request. This protects you: it stops someone else from deleting your records, and it stops us from deleting the wrong person's data.

4. What Happens Next

• •Acknowledgement within 3 business days. We confirm we have received your request and tell you if we need anything else from you.
• •Deletion within 30 days. Once verified, we delete the data from our production systems, including contacts, chat history, and stored media.
• •Backups within 90 days. Encrypted backups are rotated on a fixed cycle, so deleted data is purged from backups as that cycle completes. It is not restored or reused in the meantime.
• •Written confirmation. We email you once the deletion is complete, confirming what was removed.

5. Deleting Everything at Once

If you are a client and you want to end the integration entirely, you have two options, and you can use both:

• •Disconnect at the source. Remove our app's access from your Meta Business account settings. This stops any new data from syncing to us immediately.
• •Email us to delete what is already stored. Disconnecting stops the flow but does not by itself erase what we already hold, so send us a deletion request as described above.

6. What We May Need to Retain

We delete as much as the law allows. In a small number of cases we must keep limited records even after a deletion request — for example invoices and transaction records that Malaysian tax and company law requires us to retain, or data we are required to preserve for an active legal claim or regulatory investigation.

Where this applies, we tell you specifically what was retained and why, we keep only the minimum required, and we delete it once the retention obligation ends. Retained records are not used for any other purpose.

7. Service Providers

We use service providers to operate the software, listed in section 7 of our Privacy Policy. They include cloud hosting, message delivery, and a language-model provider that receives the text of a message in order to generate a suggested reply.

When we delete your data we delete it from our own systems and from the databases those systems run on. We do not retain message content for any purpose after deletion, and we do not use it to train models. Where a provider holds a transient copy from processing a message, we instruct its deletion under our agreement with them.

8. A Note on Your Own Devices

Deleting data from our systems does not delete the same messages from WhatsApp, Messenger or Instagram themselves, from Meta's servers, or from the phones of the people who sent or received them. To remove messages there, use the platform's own controls or contact Meta directly.

9. Contact Us

Deletion requests, and any question about them, go to the address below. It is monitored by our team.

For how we handle personal data more broadly, see our Privacy Policy. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.