Privacy Policy

Last updated: 8 October 2026

This Privacy Policy describes Our policies and procedures on the collection, use, and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

1. Definitions

The following definitions shall have the same meaning regardless of whether they appear in singular or in plural:

You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.
Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Twocents.ai Sdn. Bhd. (Registration No. 202501041019 (1642428-K)), a company incorporated in Malaysia under the Companies Act 2016, with its registered address in Kuala Lumpur, Malaysia.
Platform / Service refers to Waaris.ai (including the website accessible from https://waaris.ai, web application, mobile applications on Apple App Store or Google Play Store, and related services) owned and operated by Twocents.ai Sdn. Bhd.
Affiliate means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority.
Account means a unique account created for You to access our Service or parts of our Service.
Service Provider means any natural or legal person who processes data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service, or to assist the Company in analyzing how the Service is used.
Third-Party Service means any services or content (including data, information, products, or services) provided by a third party that may be displayed, included, or made available by the Service.
Personal Data is any information that relates to an identified or identifiable individual:
- For purposes of Malaysia's PDPA 2010, Personal Data means any information in respect of commercial transactions that is being processed wholly or partly by means of equipment operating automatically, or is recorded in a filing system.
- For purposes of Singapore's PDPA 2012, Personal Data means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which the organization has or is likely to have access.
- For purposes of the GDPR / UK GDPR, Personal Data means any information relating to an identified or identifiable natural person.
- For purposes of the CCPA / CPRA, Personal Data means any information that identifies, relates to, describes, or could reasonably be linked with a Consumer or household.
Cookies are small files placed on Your computer or mobile device by a website, containing details of Your browsing history on that website.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (e.g., page visit duration).
Data Controller / Data User, for statutory purposes, refers to the Company as the legal entity determining the purposes and means of processing Personal Data.

2. Collecting and Using Your Personal Data

2.1 Types of Data Collected

Personal & Testamentary Data

While using Waaris.ai, We may ask You to provide Us with personally identifiable information and estate planning details, which may include:

Account & Identity Data: First name, last name, identification/NRIC/passport number, date of birth, gender, marital status, email address, phone number, and residential address.
Estate & Testamentary Data: Asset descriptions, estimated asset/property values, bank account details, insurance policies, liabilities/debts, net worth calculations, and uploaded estate documents or property titles.
Third-Party Personal Data: Names, contact details, and identification numbers of your appointed Executors, Guardians, Witnesses, and Beneficiaries. (You confirm that you have obtained the consent of such third parties prior to providing their information to Us.)

Usage Data & Cookies

Usage Data is collected automatically when using Waaris.ai and may include IP addresses, browser types, device identifiers, pages visited, time spent, and diagnostic data. We use session and persistent Cookies for platform functionality, security, and analytics.

2.2 Use of Your Personal Data

The Company may use Personal Data for the following purposes:

To Provide and Maintain Our Service: Generating wills, trust documentation, asset schedules, and estate summaries through Waaris.ai.
To Manage Your Account: Providing access to different functionalities of the Service and enabling document retrieval and editing.
Performance of a Contract: The development, compliance, and undertaking of purchase contracts for products, items, or services You have purchased on Waaris.ai.
Communications: Contacting You by email, telephone calls, SMS, or equivalent electronic communications regarding security updates, service announcements, or informative updates.
Marketing & Promotions: Providing You with news, special offers, and general information about services we offer, unless You have opted out of such communications.
Customer Care: Managing Your support requests to Us.

Data Sharing Situations:

With Service Providers: Cloud infrastructure providers, payment processors, customer support systems, and security vendors under strict confidentiality obligations.
For Business Transfers: In connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of our business.
With Affiliates: Requiring those affiliates to honor this Privacy Policy.
With White-Label Customers: We may share Your personal information with our White-Label Customers ONLY if You signed up to the Service as their client.

2.3 Retention of Your Personal Data

The Company will retain Your Personal Data for as long as necessary to provide You with our Services or to perform our business or commercial purposes for collecting Your Personal Data. In some cases, we retain Personal Data for longer periods if doing so is necessary to comply with our legal obligations, resolve disputes, collect fees owed, or as permitted or required by applicable law. We may further retain information in an anonymous or aggregated form where that information would not identify You personally.

2.4 International Data Transfers

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. Twocents.ai Sdn. Bhd. may transfer Personal Data internationally. Where such cross-border transfers occur, the Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy, applicable Malaysian law (PDPA 2010), Singapore law (PDPA 2012), GDPR adequacy requirements, and any other applicable data protection obligations.

3. Malaysia: Personal Data Protection Act 2010 (PDPA)

As a company incorporated in Malaysia, Twocents.ai Sdn. Bhd. is subject to the Personal Data Protection Act 2010 (PDPA 2010) and processes personal data in compliance with its seven Data Protection Principles:

General Principle: Personal data shall not be processed without the data subject's consent, unless a statutory exemption applies.
Notice & Choice Principle: Data subjects are informed of the purposes for which their data is being processed, their right to access and correct personal data, and whether their personal data will be disclosed to any third parties.
Disclosure Principle: Personal data shall not be disclosed for any purpose other than those for which it was collected or with the data subject's consent.
Security Principle: Practical steps are taken to protect personal data from any loss, misuse, modification, unauthorized or accidental access, disclosure, alteration, or destruction.
Retention Principle: Personal data is not kept longer than necessary for the fulfillment of its purpose.
Data Integrity Principle: Reasonable steps are taken to ensure personal data is accurate, complete, not misleading, and up to date.
Access Principle: Data subjects are given access to their personal data and may correct it if it is inaccurate, incomplete, misleading, or not up to date.

To exercise your rights under the PDPA 2010, please contact us at support@twocents.ai.

4. Security of Your Personal Data & Data Breach Notifications

We seek to protect Your Personal Data from unauthorized access, use, and disclosure using appropriate physical, technical, organizational, and administrative security measures based on the type of Personal Data and how we are processing that data. Although we work to protect the security of Your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

In the event of a confirmed personal data breach affecting Your information, We will notify You and relevant regulatory authorities without undue delay and in accordance with applicable statutory reporting deadlines (including notifying the Singapore PDPC where required under Singapore law) via email and/or our Platform notification system.

5. Singapore: Personal Data Protection Act 2012 (PDPA)

If You are accessing our Services from Singapore, or if We process Personal Data of individuals located in Singapore, Your Personal Data will be collected, used, disclosed, and stored in accordance with the Singapore Personal Data Protection Act 2012 (PDPA 2012).

5.1 Consent & Purpose Specification: We collect, use, and disclose Your Personal Data only with Your knowledge and consent (express or deemed by conduct), and solely for the purposes disclosed to You in this Privacy Policy or at the time of collection.

5.2 Accuracy & Protection: We take reasonable efforts to ensure that Personal Data collected by us or on our behalf is accurate and complete, especially if the data is likely to be used to make a decision that affects You or is disclosed to another organization. We implement reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, or disposal.

5.3 Access & Correction Rights: You have the right to request access to Your Personal Data in our possession or control, as well as information about how such data has been used or disclosed within the past year. You may also request corrections to any errors or omissions in Your Personal Data.

5.4 Withdrawal of Consent: You may withdraw Your consent for the collection, use, or disclosure of Your Personal Data at any time by giving reasonable notice to support@twocents.ai. Upon receipt of Your withdrawal request, We will inform You of the consequences of such withdrawal (which may include our inability to continue providing Services to You).

5.5 Do Not Call (DNC) Compliance: We comply with the DNC provisions under the Singapore PDPA. We will not send promotional or marketing text messages or make sales calls to Singapore telephone numbers registered on the DNC Registry without Your clear and unambiguous consent.

To exercise your rights under Singapore's PDPA 2012, or if you have inquiries regarding our Singapore data privacy practices, please contact our Data Protection Officer at support@twocents.ai.

6. European Economic Area (EEA): GDPR Rights

If You are located in the EEA, You have the following rights under the General Data Protection Regulation (GDPR):

Right of Access: Obtain confirmation as to whether or not personal data concerning You is being processed, and access to the personal data.
Right to Rectification: Obtain without undue delay the rectification of inaccurate personal data concerning You.
Right to Erasure ('Right to be Forgotten'): Obtain the erasure of personal data concerning You without undue delay where specified grounds apply.
Right to Restriction of Processing: Obtain restriction of processing of Your personal data.
Right to Data Portability: Receive personal data concerning You in a structured, commonly used, and machine-readable format.
Right to Object: Object on grounds relating to Your particular situation to processing of personal data concerning You.
Rights Related to Automated Decision-Making: Not be subject to a decision based solely on automated processing producing legal effects.

Our legal bases for processing personal data under GDPR include Your consent, performance of a contract, compliance with a legal obligation, and our legitimate interests. To exercise these rights, contact us at support@twocents.ai. You also have the right to lodge a complaint with your local supervisory authority.

7. United Kingdom: UK GDPR

If You are located in the United Kingdom, Your personal data is processed in accordance with the UK GDPR and the Data Protection Act 2018. The rights afforded to you are substantially equivalent to those described in Section 6 above. To exercise your UK GDPR rights or to raise a concern, You may contact us at support@twocents.ai or contact the Information Commissioner's Office (ICO) at https://ico.org.uk.

8. California Residents: CCPA/CPRA Rights

8.1 Your CCPA Rights

If You are a California resident, You have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know: Request information about categories and specific pieces of personal information collected, sources, purposes, and third parties with whom it is shared.
Right to Delete: Request deletion of personal information collected about You, subject to certain exceptions.
Right to Correct: Request correction of inaccurate personal information maintained about You.
Right to Opt-Out of Sale or Sharing: Opt-out of the sale or sharing of Personal Data. We only share Personal Data via Cookies (Device/IP Data and Web Analytics) for advertising purposes and do not sell Your financial, testamentary, or estate data.
Right to Limit Use of Sensitive Personal Information: Subject to applicable statutory exceptions.
Right to Non-Discrimination: We will not discriminate against You for exercising Your CCPA rights.

8.2 Exercising Your CCPA Rights

To exercise the rights described above, send us a request at support@twocents.ai. You may opt-out from sales/sharing by accessing Your Cookie Preferences on our website or implementing the Global Privacy Control (GPC) signal on Your browser.

9. Nevada Resident Rights

If You are a resident of Nevada, You have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. You can exercise this right by contacting us at support@twocents.ai with the subject line "Nevada Do Not Sell Request" and providing Your name and the email address associated with Your account.

10. Detailed Information on Service Providers

Service Providers have access to Your Personal Data only to perform their tasks on Our behalf and are obligated not to disclose or use it for any other purpose.

Google Analytics: Tracks and reports website traffic. You can opt-out by installing the Google Analytics opt-out browser add-on (https://policies.google.com/privacy).
Marketing & Advertisements: We may work with third-party ad networks to serve targeted communications. You may opt-out of email marketing by following unsubscribe instructions in any email or contacting us at support@twocents.ai.

11. Accessing the Service Through White-Label Customers

The Service can also be accessed through our White-Label Customers (such as financial advisors, law firms, or estate planners) who have licensed the Service to apply their brand. Under these circumstances, Twocents.ai Sdn. Bhd. acts as the Data Processor and the White-Label Customer acts as the Data Controller for legal and regulatory purposes.

If You are accessing the Service through a White-Label Customer, they may be able to access, add, edit, and retain information shown on Your portfolio/account, and may suspend or terminate Your account access. Please review the White-Label Customer's own privacy policy for details on how they handle Your data.

12. Children's Privacy

Our Service is intended solely for individuals aged 18 and older. We do not knowingly collect personally identifiable information from anyone under the age of 18. If We become aware that We have collected Personal Data from anyone under 18 without verified parental consent, We take immediate steps to remove that information from Our servers.

13. Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify You of material changes by placing a notice on the Waaris.ai website, mobile App, and/or sending You an email prior to the changes taking effect. Continued use of Waaris.ai after changes take effect constitutes acceptance of the updated policy.

15. Contact Us

If you have questions, comments, or statutory data privacy requests regarding this Privacy Policy or our practices, please contact us at:

Data Protection Officer / Support Team
Entity: Twocents.ai Sdn. Bhd. (Registration No. 202501041019 (1642428-K))
Platform: Waaris.ai
Email: support@twocents.ai
Address: Kuala Lumpur, Malaysia