Privacy Policy

10xstation is a product of GainWells Global Sdn. Bhd. (“10xstation”, “we”, “us”), a company registered in Malaysia. Our address is Vista Tower, The Intermark, 348 Jalan Tun Razak, 50400 Kuala Lumpur, Malaysia. You can contact us about anything in this policy at hello@10xstation.com.

We handle personal data in two different roles:

• As a controller for data about visitors to app.10xstation.com, people who use our contact form or email us, our client businesses and their staff (for example, console accounts), and the data needed to set up and manage a Page or WhatsApp number connection. We decide how and why this data is used.
• As a processor for the conversations between a client business and its customers on Messenger, Instagram and WhatsApp. The client business is the controller of those conversations. We process them only on its instructions, to deliver messages between it and its customers.

If you sent a message to a business that uses our service, that business is responsible for your conversation. You can contact the business directly, or contact us and we will help (see Your rights).

Website visitors and enquiries

• Contact form: your name, email address, the channels you select and the message you write. We send a confirmation to the email address you give us.
• Emails you send us: your email address, name and whatever you choose to include.
• Technical data: our servers record standard request information such as IP address, browser type, the page requested and the time. These logs never contain message content. Cloudflare Turnstile processes device and browser signals to check that a form submission comes from a person.

Client businesses and their staff

• Business contact details such as names, work email addresses and the business name, which we receive from the business when we agree to provide the service.
• Console account details for authorised staff, including a hashed version of the password (we never store passwords in readable form).
• Client accounts: when you sign up or are invited to a workspace, your name, email address, business name, a hashed password, your role (owner or member), and when you signed in.
• Subscriptions and payments: your plan, billing period, trial and renewal dates and subscription status. Payments are processed by Stripe: your card details go directly to Stripe and are never seen or stored by 10xstation. Stripe shares with us the billing name, email, address and the last four digits and expiry of the card so we can show them in your account and on invoices.

Data from the Meta Platform

When a business connects its Facebook Page and linked Instagram professional account, or its WhatsApp Business number, we receive data from Meta Platforms. This is described in detail in the next section.

Sources

We collect data directly from you (for example, through the contact form or email), from client businesses, and from Meta Platforms, Inc. and its affiliates (including WhatsApp) when a business connects its Page, Instagram account or WhatsApp number and when people message that business.

Our messaging integration uses Meta’s APIs. A person who is an admin of a business’s Facebook Page signs in with Facebook Login for Business and chooses which Pages and business assets to grant to 10xstation. A business connecting WhatsApp does so through Meta’s WhatsApp Embedded Signup, in the same way. We then process the following data from the Meta Platform.

WhatsApp Business Platform data

A business can connect a number it already uses in the WhatsApp Business app (known as coexistence), or a new number used only through the API. For WhatsApp we process:

How we use it

We use Meta Platform data solely to deliver messages between the client business and its customers:

• forwarding incoming messages to the client business’s own system;
• sending the client business’s replies and, on its instruction, its WhatsApp template messages through Messenger, Instagram or WhatsApp; and
• showing the conversation to the client business’s authorised staff; and
• publishing the posts and stories the client business wrote and scheduled, to its own Page or Instagram account, at the time it chose.

Connection data is also used to set up, maintain and remove the connection (for example, to subscribe the Page or WhatsApp Business Account to our webhooks, manage message templates, start the contact and chat history sync a business chose to share, and unsubscribe on disconnection).

What we never do with it

• We never sell it.
• We never use it for advertising, marketing or profiling, including our own marketing.
• We never message anyone except on the client business’s instruction.
• We never use it to train AI models.
• We never share it with anyone other than the client business that owns the Page, Instagram account or WhatsApp number, and the sub-processors listed below that host and run the service.
• We never publish anything the client business did not write and schedule itself, and we do not read or manage ads, access Page insights, or read personal Facebook profiles.

The Meta permissions we request, and the reason for each, are listed on our Messaging Integration page. We handle Meta Platform data in line with the Meta Platform Terms and Developer Policies, and WhatsApp data in line with the WhatsApp Business terms and policies that apply to it.

We process personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA). Where the EU or UK General Data Protection Regulation applies to you, the bases below are our lawful bases under it.

We share personal data only as follows:

• The client business that owns the connected Page, Instagram account or WhatsApp number receives the conversations with its own customers. We do not share one business’s data with another.
• Meta (including WhatsApp) receives the replies and template messages a client business sends, because they are delivered through Messenger, Instagram and WhatsApp.
• Service providers (sub-processors) that host and run our website and service under contract with us:

We may also disclose information where we are required to by law, for example in response to a valid request from a court or regulator. We do not sell personal data to anyone.

We are based in Malaysia. Our service runs on servers rented from a cloud hosting provider, and some of those servers and our other providers (such as Meta, Stripe and our email provider) may process data outside Malaysia. When personal data is transferred outside Malaysia, we do so only as the PDPA allows and put appropriate safeguards in place, such as contractual commitments from the recipient to protect the data to a standard at least equivalent to the PDPA, and, where the EU or UK GDPR applies, the Standard Contractual Clauses or the UK International Data Transfer Agreement. You can ask us for more information about these safeguards at hello@10xstation.com.

We keep personal data only for as long as we need it:

We use technical and organisational measures appropriate to the data we handle, including:

• HTTPS/TLS encryption for all traffic;
• encryption of access tokens at rest using AES-256-GCM;
• verifying every webhook from Meta using its X-Hub-Signature-256 signature;
• signing every delivery to a client system with HMAC-SHA256 and a secret unique to that client;
• authenticating client API calls with per-client keys and signatures;
• individual staff console accounts with hashed passwords;
• never writing message content to application logs; and
• least-privilege access, both for our staff and for the Meta permissions we request.

No system is completely secure, but we work to protect your data and will act promptly, and notify affected parties and the Personal Data Protection Commissioner where the PDPA requires, if a breach occurs.

Under the PDPA, you have the right to:

• access the personal data we hold about you;
• correction of data that is inaccurate, incomplete, misleading or out of date;
• withdraw consent to our processing of your data, where we rely on consent;
• prevent processing that is likely to cause you damage or distress, and processing for direct marketing;
• data portability, to have data you gave us transmitted to another controller where this is technically feasible; and
• complain to Malaysia’s Personal Data Protection Commissioner at pdp.gov.my. We would appreciate the chance to deal with your concern first, so please contact us.

If you are in the European Union or the United Kingdom, you also have the rights the GDPR gives you, including erasure and restriction, and you can complain to your local data protection authority.

To exercise any of these rights, email hello@10xstation.com. We may need to verify your identity before acting on a request. We will respond within 21 days, as the PDPA requires.

If your request relates to a conversation with a business that uses our service, that business is the controller. We will help it respond, and we will act on its instructions. If you contact us directly, we will handle the request as described in the next section and let the business know.

There are several ways to have data deleted:

• If you connected a Page using Facebook Login, remove the 10xstation app in your Facebook settings. Meta then sends us a data deletion request automatically. We delete the access tokens and all conversation data stored for the Pages you connected, and give you a confirmation code so you can check the status of your request.
• If you messaged a business that uses 10xstation, email hello@10xstation.com with the business name and your Facebook or Instagram name. We will verify the request, delete your messages within 30 days, and tell the business so it can remove its own copy.
• If you messaged a business on WhatsApp, email hello@10xstation.com with the business name and your WhatsApp number. We will verify the request, delete your messages, contact details and profile data within one month, and tell the business so it can remove its own copy.
• If your business connected a WhatsApp number, disconnecting it in your 10xstation account deletes our access tokens for it. You can also remove 10xstation in Meta Business Suite → Settings → Integrations, or in WhatsApp Manager → Partners.

Full instructions are on our data deletion page.

We do not use advertising or analytics cookies. We only use the following, which are needed for the site and service to work:

You can clear cookies and local storage in your browser settings at any time. Blocking the strictly necessary items may stop sign-in, the connection flow or the contact form from working.

Our website and service are intended for businesses and are not directed at children under 13. We do not knowingly collect personal data from children. Some of our client businesses, such as education providers, serve children, but the people who message them are typically parents or guardians. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page. If a change significantly affects how we use personal data, we will take reasonable steps to let our client businesses know.

For any question about this policy or your personal data, contact: