Privacy Policy

Last updated: 19 October 2026

In short

We collect what we need to run your account and the channels you connect, and nothing more.
We do not sell your personal data and do not use it for advertising.
You can export or delete your data yourself in Profile › Privacy & data.
Marketing e-mail is off unless you turn it on, and you can turn it off at any time.

1. Introduction

This Privacy Policy explains how AMS – Artificial Media System ("AMS", "we", "us") collects, uses, shares and protects personal data when you use our website and platform (the "Service"), and the choices you have. We handle personal data in line with the Personal Data Protection Act 2010 of Malaysia (PDPA) and, where they apply to you, other data-protection laws.

AMS plays two roles. For your own account data we decide how it is used (we are the data user / controller). For messages and details of your customers that reach you through connected channels, you decide how they are used and we process them on your behalf (we are the processor). Section 3 and the Terms explain this further.

2. Information we collect

Account information

Name, e-mail address, password (stored only as a one-way hash), optional profile picture, and your preferences (notifications, marketing e-mail).

Connected social media and messaging accounts

When you connect accounts such as Facebook, Instagram, Threads, TikTok, WhatsApp, Telegram or YouTube, we receive and store the access tokens and profile identifiers needed to post content and to read or send messages on your behalf through each platform's official API. Tokens are stored per campaign and used only for the actions you ask for.

Messages and customer data

If you use the shared inbox, we store messages received from and sent to your customers through connected channels (including TikTok direct messages), together with the sender's platform identifier, display name and any media they send. The AI assistant uses these messages and the knowledge base you upload to draft or send replies.

Content you create

Posts, captions, images, videos, schedules and knowledge-base documents that you upload or generate in AMS.

Usage and technical data

Log data such as IP address, browser type, pages used and error reports, collected to keep the Service secure and working. On our public blog we count page visits in aggregate.

Communications and consent records

Messages you send to support or through the contact form, and a record of when you accepted our Terms and when you switched marketing e-mail on or off (the date, the version shown and where it was done).

Notifications

We keep the in-app notifications we create for you (for example a failed post or a new customer message) so they appear in your notification bell.

3. How we use information

to provide the Service: publish and schedule posts, deliver the inbox, run the AI assistant;
to create, secure and maintain your account, and to verify your identity;
to send service messages such as e-mail verification, password reset, alerts you have chosen and security notices;
to send marketing e-mail only if you have opted in;
to respond to support requests, detect abuse and fix errors;
to meet legal obligations and to establish or defend legal claims.

We do not sell personal data and do not use it for advertising. We do not use your customers' messages for any purpose other than providing the Service to you.

4. Third-party platforms

Connecting a channel means data flows between AMS and that platform as you direct. Each platform's own privacy policy applies to what it does with data. Our use of data from a platform is limited to what its API terms permit.

5. YouTube and Google API Services

YouTube API Services

AMS uses YouTube API Services to let you upload videos to your own YouTube channel. By connecting YouTube you are also agreeing to be bound by the YouTube Terms of Service, and your use of YouTube is governed by the Google Privacy Policy.

What we access: we request only the youtube.upload scope (upload videos to your channel), plus your basic Google profile name so we can show which account is connected. We do not read your videos, comments, subscribers, analytics or any other channel data.

What we store: the OAuth access and refresh tokens for the channel you connect, the connected account's display name, and the ID and link of videos that AMS uploaded for you. Tokens are stored per campaign, used only to upload the videos you choose to publish, and never shared with third parties or used for advertising.

Revoking access and deleting data: you can disconnect YouTube at any time in AMS under Settings → Social, which revokes the token at Google and deletes the stored credentials immediately. You can also remove AMS from your Google Account at myaccount.google.com/permissions. To request deletion of other data we hold about your YouTube connection, contact us at the address below; we will delete it within 30 days. If you revoke access, we stop using the tokens and delete any YouTube API data we hold within 30 days.

AMS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. AI providers

To generate text, images and video and to power the customer-service assistant, we send the relevant prompts, messages and media to AI service providers (currently including OpenAI, Anthropic and Google). They process this data to return results to us under their business or API terms, and we do not permit them to use it to train their models where their terms offer that option. Do not submit information to AI features that you are not allowed to share.

We share personal data only with: infrastructure, hosting and e-mail delivery providers that help us run the Service; the AI providers in section 6; the social platforms you connect; professional advisers; and authorities where the law requires. These parties may use the data only to provide their service to us. If AMS is involved in a merger or sale, data may transfer to the successor under this policy.

8. International transfers

Some of our providers are located outside Malaysia, so your data may be processed in other countries. Where that happens we take steps to make sure it is protected to a standard consistent with this policy and with the PDPA.

9. Retention, export and deletion

While your account is open we keep your data so the Service works.
Export: you can download a copy of your personal data in Profile › Privacy & data.
Deletion: you can delete your account in the app. Your name, e-mail, password, picture and connected-account credentials are removed or anonymised, and you are removed from every campaign. Campaigns you own must be deleted or handed over first. Content inside a campaign remains with that campaign and its owner.
Disconnecting a channel deletes its stored tokens.
Backups and records: copies in backups are overwritten on the normal backup cycle. We may keep limited records (for example consent history) where needed for legal reasons or to resolve disputes.

10. Your rights

Under the PDPA you may ask to access and correct your personal data, withdraw consent, and ask us to limit its use. Many of these you can do yourself in the app. For anything else, contact us (section 15). We will reply within the time the law requires. You also have the right to complain to the Personal Data Protection Commissioner of Malaysia.

11. Marketing e-mail and notifications

Marketing e-mail is off by default. You can switch it on or off at registration, in Profile, or with the unsubscribe link in every marketing message. Service messages and security notices are not marketing and will still be sent. You choose which alerts appear in the app and which are also e-mailed, in Profile › Notifications.

12. Cookies and local storage

We use browser storage (such as local storage) to keep you signed in and to remember settings like your theme and language. We do not use advertising or cross-site tracking cookies. Our public blog counts visits in aggregate.

13. Security

We use measures such as encrypted connections, hashed passwords, access controls and role-based permissions. No system is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and tell us right away if you suspect a problem.

14. Children

The Service is not meant for anyone under 18 and we do not knowingly collect their personal data. If you think a child has given us data, contact us and we will delete it.

15. Changes to this policy

We may update this policy. For material changes we will tell you in the app (you may be asked to agree again) and change the date at the top of this page.

16. Contact us

For privacy questions or to use your rights: [email protected], or the contact form on our website.