Privacy notice

IceCEO is an assistant that reads a business owner’s email and WhatsApp, sorts what matters, and drafts replies for them to approve. It is provided by Iceberg AI Solutions (“we”, “us”). This notice explains what personal data we handle, why, and the choices you have, in line with Malaysia’s Personal Data Protection Act 2010 (PDPA) as amended in 2024.

There are two kinds of people in this notice. Clients are the people who sign up and connect their mailbox or WhatsApp. Correspondents are the people who write to a client. For a client’s own account we decide how data is used. For the content of a client’s mail and chats, we act on the client’s instructions and process it only to provide the service to them.

• Account details: your name, email address, workspace name, the people you invite, and your settings.
• Your mailbox: the messages, attachments, senders and recipients in the mailbox you connect, read over IMAP and sent over SMTP with the app password you give us. We do not use Google or Microsoft sign-in to reach your mail.
• Your WhatsApp: messages in the chats and groups you allow, read by a small program that runs on your own computer and keeps your WhatsApp Web session there. Your WhatsApp login never leaves that computer.
• Your calendar and contacts: meetings and names drawn from your mail, used to suggest meeting times and recognise who matters to you.
• What you do in the product: which replies you approve, edit or reject, so future drafts sound more like you, and a log of every action taken for you.
• Billing: your plan, invoices and payment status. Card and bank details are entered with our payment provider and never reach us.
• Devices: if you turn on notifications, the address your browser gives us to deliver them.

• To sort your messages, write the morning and evening brief, and draft replies for you.
• To send a reply only when you approve it, or when a rule you set yourself allows it.
• To learn your writing style from the mail you have already sent.
• To bill you, keep the service secure, fix faults, and answer you when you contact us.

We do not sell personal data, show advertising, or use your mail or chats to train AI models, ours or anyone else’s.

To read and draft, the text of a message is sent to our AI provider, Anthropic, which processes it and returns the result. Under its commercial terms Anthropic does not train its models on this data. The AI cannot send anything by itself: every reply goes through rules you control, and by default you approve each one.

We use a small number of providers, each only for the part of the service they run:

• Supabase, our database, hosted in Singapore.
• Vercel, which runs the application, in Singapore.
• Anthropic, the AI that reads and drafts, in the United States.
• Billplz, our payment provider, in Malaysia.
• Apple, Google or Mozilla, only to deliver notifications to a browser you switched them on in.

Because Supabase, Vercel and Anthropic are outside Malaysia, your data is transferred abroad. We choose providers that protect it to a standard comparable to the PDPA, and we transfer only what each one needs. We disclose personal data to anyone else only if the law requires it.

• Message and attachment text is encrypted with AES-256, using a key that belongs to your workspace alone.
• Mailbox passwords are encrypted before they are stored.
• Each workspace can see only its own data, enforced in the database itself. Our support staff see a workspace’s health and billing, not its messages. Only a named administrator can open message content, only to fix a problem, and every look is written to that workspace’s own audit log, where you can see it.
• If a breach puts your data at risk, we will notify the Personal Data Protection Commissioner and, where the law requires, you, within the time the PDPA sets.

Message and attachment text is kept for 365 days unless you choose a shorter period in Settings. After that the text is deleted automatically every day; the date, sender and subject stay so your history still makes sense.

If you delete your workspace, everything in it is erased, including the encryption key, so any copy left in a backup can no longer be read. Invoices are kept as long as tax law requires.

• See and correct your data, and export it, by writing to us.
• Disconnect a mailbox or WhatsApp at any time from Settings.
• Pause the AI, or stop any contact from ever being read or drafted for.
• Delete your workspace and all of its data from Settings.
• Withdraw consent, which ends the service because we cannot run it without the data.

A correspondent who wants to know what a client holds about them should ask that client first; we will help the client answer. We reply to every request within 21 days.

Write to navien@icebergaisolutions.com. If we change this notice in a way that matters, we will tell clients by email before it takes effect. See also our terms.