Privacy Policy

1. Who We Are

LeadZap is operated by Digital Vibe Resources, a business registered in Malaysia (SSM: 202403082654 / 003589301-V). LeadZap receives TikTok Lead Generation form submissions through the TikTok connection you authorise, sends WhatsApp alerts to subscribers, and saves leads to private Google Sheets hosted on subscribers' behalf.

For data protection matters, contact us at hello@digitalvibe.my.

2. Personal Data We Collect About Subscribers

We collect the following personal data from our subscribers (the businesses and individuals who use LeadZap):

• Full name and business name
• WhatsApp number (to send lead alerts and account messages)
• Email address (for account, billing and service communications, and to share your Leads sheet with you)
• Your answers on the sign-up form (for example, whether you run TikTok Lead Generation ads), terms acceptance and marketing consent choice
• Payment records (date, amount, payment reference and status). Card and bank details are handled by our payment gateway, Billplz — we do not receive or store them
• Service usage data (for example, number of leads received, date of last lead, subscription status and expiry date)
• The contents of any emails you send us

Our sign-up form uses Cloudflare Turnstile to protect against spam and bots. Turnstile may process technical information such as your IP address and browser details for this purpose.

3. How We Use Subscriber Data

• To provide the LeadZap service, including sending lead alerts to your WhatsApp and saving leads to your sheet
• To set up and manage your account, including trial, payments, renewals, reminders, account on hold and closure
• To send service messages by WhatsApp and email (lead alerts, payment reminders, receipts, monthly lead reports and account notices)
• To respond to support requests and investigate delivery issues
• To keep business and financial records and comply with Malaysian law
• If you opted in, to tell you about other Digital Vibe Resources products and offers. You can opt out at any time by emailing hello@digitalvibe.my

We do not sell your personal data or share it with others for their own marketing.

4. Your Leads' Data (Our Role as Data Processor)

When someone submits your TikTok lead form, TikTok sends that person's details (for example, their name, phone number, email address and the campaign name) to LeadZap. LeadZap then sends you a WhatsApp alert and saves the lead to your private Google Sheet.

For your leads' personal data, you are the data user (data controller) and LeadZap acts as a data processor on your behalf. We process your leads' data only to deliver it to you, store it in your sheet, and keep the records described in section 7. We do not contact your leads, sell their data, or use it for any other purpose.

Your TikTok connection. When you click "Connect with TikTok" and press Allow, TikTok gives LeadZap a secure access token and the ID and name of your ad account. We store these in a restricted system and use them only to receive your leads. LeadZap does not create or edit your ads and does not spend your advertising money. You can disconnect at any time in TikTok for Business (user settings, Authorized apps) or by contacting us, and we then stop receiving your leads.

As the data user, you are responsible for:

• Including a clear privacy and consent notice in your TikTok lead forms
• Using your leads' data only for the purposes you told them about
• Handling your leads' requests to access, correct or delete their data (we will help where it relates to data in your sheet)
• Complying with the PDPA and any other applicable data protection laws

5. Who Can Access Your Leads Sheet

• Each subscriber has a separate Google Sheet. Sheets are set to restricted access and are shared only with your sign-up email address, as view-only. You can view and download your leads, but you cannot edit the sheet
• No other subscriber and no outside party is given access to your sheet
• The sheet is owned by LeadZap's Google account. Our administrator accesses it only when necessary to operate, maintain or support the service, or when required by law
• Opening your sheet requires signing in to a Google account linked to your sign-up email address

6. Service Providers and International Transfers

We use the following service providers to run LeadZap. Personal data passes through or is stored by them, and some of them store data on servers outside Malaysia (for example, in the European Union or the United States):

• TikTok — sends lead form submissions from your campaigns to LeadZap through your TikTok connection
• Make.com (Celonis) — the automation platform that runs LeadZap's workflows; processes subscriber and lead data, with servers in the European Union
• Meta Platforms (WhatsApp Business Platform) — delivers WhatsApp alerts and account messages
• Google (Google Sheets and Google Drive) — stores subscriber records and your Leads sheet
• Billplz — processes payments (FPX, card and DuitNow)
• Our email service provider — sends account and service emails
• Cloudflare — Turnstile bot protection on our sign-up form

We choose reputable providers with their own security measures, and we transfer personal data outside Malaysia only as permitted under the PDPA. By using LeadZap, you acknowledge these transfers. These providers' own privacy policies also apply to the data they handle.

7. Data Retention

• Your leads — stored in your Leads sheet for 12 months from the date each lead is received while your account is active. Leads older than 12 months may be removed. After your account is closed, your sheet remains available to you for 90 days and is then permanently deleted. Please download your own copy — LeadZap is not a data backup service
• Delivery records — records of leads received and alerts sent (such as time, TikTok lead ID and WhatsApp message ID) are kept for up to 12 months to investigate delivery issues
• Leads received for closed or unrecognised accounts — held in a restricted internal log for up to 30 days, so they can be restored to the subscriber's sheet if the account is reactivated, and for troubleshooting. They are automatically deleted after 30 days
• Subscriber account data — kept while your account is active and for up to 12 months after closure, then deleted, unless we must keep it longer by law
• Payment and financial records — kept for 7 years to meet Malaysian record-keeping requirements

8. Data Security

We use reasonable technical and organisational measures to protect personal data, including a one-time connection link for each subscriber, restricted and view-only sharing of Leads sheets, limited administrator access, and reputable platforms with their own security controls.

No internet-based service can be completely secure. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and affected individuals where required, within the timeframes required by the PDPA.

9. Your Rights

Under the PDPA, you may:

• Access the personal data we hold about you
• Correct personal data that is inaccurate, incomplete or out of date
• Withdraw consent to our processing (this may mean we can no longer provide the service)
• Ask us to stop direct marketing, or processing that is likely to cause you damage or distress
• Request a copy of your data in a commonly used format, where the PDPA provides this right

To make a request, email hello@digitalvibe.my from your registered email address. We will respond within 21 days, as required by the PDPA. We may need to verify your identity before acting on a request. If your leads contact us directly about their data, we will refer them to you as the data user and assist you where needed.

10. Cookies and Analytics

The LeadZap website (leadzap.digitalvibe.my) does not currently use advertising cookies or third-party analytics tools. Cloudflare Turnstile on our sign-up form may use technical data solely for security. If this changes, we will update this policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active subscribers by email of material changes at least 14 days before they take effect. The current version is always available on this page.

12. Governing Law

This Privacy Policy is governed by the laws of Malaysia, including the Personal Data Protection Act 2010 (Act 709) and its amendments.

13. Contact Us

• Email: hello@digitalvibe.my
• Business: Digital Vibe Resources (SSM: 202403082654 / 003589301-V)