Watchpost Terms of Service

Key points

This summary is for convenience; the numbered clauses are the contract.

1. Who we are

1.1 These Terms of Service ("Terms") are a contract between you and XYZ Sdn Bhd, a company incorporated in Malaysia, Company Registration No. 202601000000, of Malaysia ("Watchpost", "we", "us"), identified as the Companies Act 2016 (s.30) and the Consumer Protection (Electronic Trade Transactions) Regulations 2024 ("CPETTR", reg. 3) require.

1.2 Contact us at [email protected], or through our Contact page, for support and complaints, legal notices (subject "Legal notice"), our Data Protection Officer (subject "Privacy") and security reports (subject "Security"). Full disclosures are in clause 33.

2. Definitions

3. Acceptance and electronic contracting

3.1 You accept these Terms by ticking the acceptance box or clicking "I agree" at sign-up or checkout, by continuing with Google Sign-In where the sign-up screen states that doing so accepts these Terms, or by accepting a Workspace invitation. A contract made this way is valid under the Electronic Commerce Act 2006 (ss.6, 7 and 9) and the Contracts Act 1950 (s.10). If you accept for an organisation, you confirm that you have authority to bind it.

3.2 We record the version you accepted, the time, a shortened form of your IP address and your browser type as evidence of the contract (Electronic Commerce Act 2006 s.13) and of consent (Personal Data Protection Regulations 2013 ("PDP Regulations") reg. 3), and keep these records as clause 26.6 states. You agree to receive notices, invoices and receipts electronically (Electronic Commerce Act 2006 s.3).

3.3 The AUP, the Refund Policy, the DPA (where clause 20.3 applies), the Sub-processors page, the Platform Disclosures (so far as they state commitments and obligations) and each order confirmation form part of these Terms. The Privacy Policy, Cookie Policy and Data Deletion Instructions are notices under PDPA s.7 (and GDPR Arts. 13–14 where they apply) and are not changed by these Terms. The VDP governs security research.

3.4 If these documents conflict, this order applies, highest first: the SCCs or UK Addendum where the DPA incorporates them; the DPA, for personal data in Customer Content; these Terms; the AUP, the Refund Policy and the Platform Disclosures; an order confirmation. Each Platform's own terms prevail over our summaries of them (clause 15.3). Where Watchpost documents give different periods for deleting the same data, the shorter period applies.

4. Eligibility

4.1 Age. You must be at least 18 years old (Contracts Act 1950 s.11; Age of Majority Act 1971). We do not accept consent from minors (PDP Regulations reg. 3(3)) and close any Account we learn belongs to a person under 18.

4.2 Business use. The Service is for businesses, agencies, sole traders, creators and organisations acting for business or professional purposes. You confirm that you are not acquiring it for personal, domestic or household purposes. If you are nonetheless a "consumer" under the Consumer Protection Act 1999 (s.3) or the law of your own country, clause 29 protects your non-excludable rights.

4.3 Where you are. Customers anywhere in the world are welcome. You may not use the Service if we previously terminated you for breach, if sanctions law prohibits us from dealing with you, or if our payment processor's rules prohibit or restrict your business. Customers in the EU, the UK or Singapore also receive the protections in clause 20 and the DPA.

5. Your Account and security duties

5.1 You may sign up with an email address and password or with Google Sign-In. You must verify your email address before using a Workspace and keep your information accurate and current, so that we can keep personal data accurate (PDPA s.11).

5.2 Keep your password and two-factor authentication ("2FA") codes confidential, and never share an Account; each Member needs their own. 2FA is available to everyone and is mandatory for Workspace Owners.

5.3 You are responsible for activity through your Account unless it results from our failure to protect the Service with reasonable care. Tell us immediately at [email protected] if you suspect that an Account or Connected Account is compromised. We may require you to sign in again before sensitive actions such as changing your email or password, disconnecting a Connected Account, changing billing or deleting a Workspace or Account.

5.4 Support access. Our authorised staff may access your Workspace only to resolve a support request that you or another Member made, to investigate a security incident or misuse, or to comply with the law. They use that access only for that purpose and never to publish on your behalf. Our staff read Google User Data only with your affirmative agreement for the specific data (for example, when you ask us to check a YouTube upload), or where reading it is necessary for security or to comply with the law (Google API Services User Data Policy, Limited Use).

6. Workspaces, Members and the Workspace Owner

6.1 Each business or agency works in a Workspace. On sign-up we create one and you become its Workspace Owner.

6.2 Roles. Viewers can view. Editors can also connect and disconnect Connected Accounts, manage client folders ("Customers") and media, and create and schedule posts; where a Workspace requires approval, their posts publish only once approved. Admins can also approve posts, manage Members other than the Workspace Owner and change settings. The Workspace Owner can also manage billing (and make an Admin a Billing Manager), delete the Workspace and transfer ownership.

6.3 Invitations. We send invitations only at your instruction. By inviting someone, you confirm that you may give us their email address and that you will tell them their data is processed under the Privacy Policy (PDPA s.7; GDPR Art. 14 where it applies). An invitee becomes a Member on accepting the invitation and these Terms.

6.4 The Workspace Owner is the responsible party. The Workspace Owner, and the organisation it acts for, is the Customer for the Workspace. It alone is liable for the Workspace's Fees. It must ensure that every Member complies with these Terms, the AUP and the Platform Terms, and it decides who may connect accounts, approve posts and manage billing. Members' instructions within their roles are the Customer's instructions to us. Each Member is also personally bound by these Terms when using the Service, but a Member other than the Workspace Owner is not liable for the Workspace's Fees.

6.5 We act on our records of who the Workspace Owner is. Ownership transfers only through the Service, unless the Workspace Owner is unreachable or has died, or the organisation is dissolved; we may then act on reasonable documentary evidence of authority. A post approved by a Member with the required role is published as approved.

7. Free Trial, use without a Subscription, and Subscription

7.1 Use without a Subscription. Without a Subscription, including after the Free Trial ends, you can keep setting up and scheduling: create a Workspace, connect Connected Accounts, build a media library, compose and schedule posts, invite Members and use the calendar, approval and client-folder features, within the Plan Limits ("Unsubscribed Access").

7.2 Paid to publish. Outside the Free Trial and without an active Subscription, a Workspace does not publish posts or sync analytics. Scheduled posts stay "Scheduled" with a "Subscription required" label. When a Subscription becomes active, future posts publish as scheduled. Posts whose time has passed are marked "Missed (no subscription)", are never published late and can be rescheduled with one click.

7.3 A Subscription is activated immediately on successful payment. It covers one Workspace and all its Members, who do not pay individually. A Member of several Workspaces is covered by the Workspace they are acting in.

7.4 Reaching a Plan Limit does not delete Customer Content but prevents adding more. The Subscription has no limit on the number of posts, subject to fair use (AUP clause 11A) and to Platform Limits. Where a Platform charges us for each use (currently only X), that charge is passed on to you. X is switched off in the Service for now, and nothing is charged for it. Before we switch on any such charge, we will give at least 30 days' notice under clause 10. Once it applies, we show the charge per post, SST included, before you schedule an affected post, and bill it as a separate line on your monthly invoice. Free Trial. Every Account gets one free trial of 30 days, with no card needed. It starts when the Account creates its first Workspace; Workspaces it creates later get no new trial. During the Free Trial the full plan works, including publishing, analytics syncing, 10 Connected Accounts and 5 seats. At day 30, if the Workspace has no Subscription, publishing and analytics syncing pause and nothing is deleted. Setting up and scheduling stay available (clause 7.1), and publishing and analytics syncing resume when the Workspace Owner or a Billing Manager subscribes at RM69 per Workspace per month, SST included. Subscribing during the Free Trial starts billing that day, and the Free Trial does not run on after it. Because no card is taken for the Free Trial, nothing is charged automatically when it ends. We email you when the Free Trial starts, when 7 days are left, when 1 day is left and when it ends. A Free Trial cannot be obtained again by creating new Accounts (AUP clause 8.3). Refund Policy clause 3.8 repeats these conditions.

8. Fees, billing and payment

8.1 Price. The Subscription costs RM69 per Workspace per month, billed monthly in Malaysian Ringgit (MYR). There is one Subscription plan. The price includes SST (clause 9.1), and the checkout price is the full amount payable (CPETTR, Schedule; Consumer Protection Act 1999 s.12).

8.2 Order process. Checkout shows an order summary and lets you correct input errors before you confirm (CPETTR reg. 4). We then send, without undue delay, a confirmation of the plan, price, tax, billing cycle and the version of these Terms you accepted. To correct an error after you confirm, contact [email protected] (clause 8.8).

8.3 Payment processor. Payments are processed by our payment processor through its secure payment forms and pages. It acts as our service provider, and also as an independent controller for its own fraud-prevention and compliance checks, which its own privacy policy governs. We never receive or store your full card number or security code. Of your payment details, we keep only the payment processor's customer reference, the card brand, the last four digits and the expiry date, together with the invoices and billing details described in clause 8.6.

8.4 Saved card and automatic renewal. By subscribing with a card, you authorise us, through our payment processor, to charge your default saved card at the start of each monthly billing period until you cancel. Charges appear on your card statement with a description that includes Watchpost. You can manage cards on your Billing page or in our payment processor's secure billing portal. The Billing page shows when a saved card is close to expiry, and we email your billing contacts 7 days before each renewal with its date and amount.

8.5 Monthly billing by card only. Subscriptions are billed monthly and paid by card. There is no other billing period and no other payment method.

8.6 Billing contacts. A Billing Manager may add billing email addresses and a billing name, address and tax identifier, and confirms that it may give us those details. Invoices, receipts, payment-failure notices and renewal reminders go to all billing contacts.

8.7 Invoices. We issue electronic invoices and receipts through our payment processor, showing our company name and registration number (Companies Act 2016 s.30). Once we are registered for service tax, they will contain the particulars required by the Service Tax Act 2018 (s.21) and the Service Tax Regulations 2018 (reg. 10). Where e-Invoicing applies (Income Tax Act 1967 s.82C), give us your tax and registration details if you want an e-Invoice in your name; otherwise your purchase may appear in a consolidated e-Invoice.

8.8 Billing disputes. Contact [email protected] promptly if you think a charge is wrong. We may suspend Subscription features while a chargeback is open. If it is resolved in our favour, you remain liable for the Fees for any period in which those features were provided.

9. Taxes

9.1 Information technology and digital services are taxable services under the Service Tax Act 2018. The RM69 monthly price includes SST. Until XYZ Sdn Bhd is registered for service tax, no service tax is charged and RM69 is the full price. Once we are registered, the price stays RM69.00 including service tax at the prevailing rate (at 8%, RM63.89 plus RM5.11 SST), and invoices show the tax separately. Registration does not change what you pay. If a change in the tax rate or the law would change the amount you pay, we will give notice under clause 10 (or, if the change takes effect sooner, as much notice as is practicable), and you may cancel before the new amount applies.

9.2 Taxes in your own country (for example, VAT or GST under a reverse-charge rule) are your responsibility. If you must withhold tax, you will pay an additional amount so that we receive the full Fees.

10. Price changes

10.1 We may change the Fees on at least 30 days' notice by email to the Workspace Owner and billing contacts and in the Service. The new price applies from your first renewal after the notice period, never to a period already paid. If you do not accept it, you may cancel before it takes effect.

10.2 Promotional prices apply only for the period and on the conditions stated when offered (Trade Descriptions Act 2011 s.17).

11. Failed payments and suspension of publishing

11.1 If a renewal payment fails, our payment processor retries it over several days, and we email your billing contacts and show an "Update card" banner in the Service.

11.2 Publishing and analytics syncing continue for 7 days after the renewal first fails, or for any longer period shown on your Billing page ("Grace Period"). If payment has not succeeded by then, clause 7.2 applies: due posts are held, posts whose time passes are marked "Missed (no subscription)" and analytics syncing pauses. Everything else keeps working, and we do not delete Customer Content because of non-payment.

11.3 When payment succeeds, Subscription features resume; you must reschedule missed posts. If payment keeps failing, the Subscription may be cancelled after the final retry, and you can subscribe again at any time. If a renewal is never paid and the Subscription ends, we do not pursue the unpaid renewal amount (Refund Policy clause 3.5). We charge no late-payment fee.

12. Cancellation and refunds

12.1 A Billing Manager may cancel at any time on the Workspace's Billing page, in our payment processor's secure billing portal, or by emailing [email protected] from their registered address. If you are a consumer, you may also cancel by any clear words or conduct (Consumer Protection Act 1999 s.63). The Subscription renews automatically each month until cancelled. Cancelling stops the next renewal: the Workspace keeps its Subscription features until the end of the paid month, and you can resume the Subscription before then (Refund Policy clause 4).

12.2 No refunds. There is no refund or partial refund for the current month after you cancel, and no pro-rata refund for part of a month or for unused time or features. We refund only charges made in error, for example a duplicate charge or an invoice paid after the Workspace was deleted (Refund Policy clauses 6 and 11). This does not affect any right to a refund that the law of your country gives you and that cannot be excluded.

12.3 Cancelling does not delete your Workspace; when the paid month ends, it keeps Unsubscribed Access (clause 7.1). Deletion is a separate step (clause 26).

13. Complimentary access

13.1 We may grant a Workspace complimentary Subscription features (for example, for support, partners or testing) for a stated period without Fees; these Terms apply in full. Complimentary access ends at its stated expiry, on 14 days' notice, or immediately for breach, after which clause 7.2 applies.

14. Acceptable use

14.1 You must comply with the AUP. In summary, you must not use the Service to: (a) publish content prohibited by clause 17; (b) send spam, or market to anyone who has asked you to stop (PDPA s.43; Communications and Multimedia Act 1998 s.233A when in force); (c) infringe intellectual property (Copyright Act 1987; Trade Marks Act 2019); (d) buy, sell or artificially inflate engagement; (e) breach a Platform's automation rules, such as X's ban on duplicate multi-account posting and automated replies; (f) scrape Platform data or collect personal data unlawfully (PDPA s.130); (g) circumvent Platform rate limits; (h) operate a business that our payment processor prohibits or restricts; (i) introduce malware, or access the Service or another Workspace without authority (Computer Crimes Act 1997), except under the VDP; (j) resell the Service without our written agreement; or (k) make misleading statements about the Service or a Platform (Trade Descriptions Act 2011).

14.2 A person decides what is published. We publish only what an authorised Member has scheduled or approved, including recurring posts and queue slots a Member has set up. We do not alter captions, descriptions or settings after approval beyond the technical formatting a Platform requires. You must not configure the Service to publish or engage on a Platform without a person's decision (Meta Developer Policies 1.7; YouTube API Services Developer Policies III.C).

14.3 Anyone may report misuse, or content published through the Service, to [email protected]. We may hold or remove content, suspend under clause 25, disclose information where the law requires (PDPA s.39) and cooperate with a Platform's investigation.

14.4 Fair use. Posting is unlimited for normal business use. You must not use the Service in a way that risks a Platform restricting our application for other customers, including by sending the same content to many accounts on the same Platform at once, publishing at volumes no person reviews, or repeatedly triggering a Platform's spam or limit protections. AUP clause 11A sets out what we check and the steps we take: normally a heads-up first, then a temporary slow-down of up to 14 days, and suspension of publishing under clause 25 only as a last resort. Each step comes with notice by email and in the Service, the reason and how to appeal (AUP clause 15). Our checks only flag activity for a person to review and do not read the meaning of your posts. Posts that fall due while publishing is suspended are never published late (clause 25.3). These steps do not limit what we may do for Serious Breaches (AUP clause 14.3).

15. Connected Accounts and Platform Terms

15.1 Your authorisation. By connecting a Connected Account, you authorise Watchpost to act on your behalf through the Platform's API, within the permissions you grant: to publish what you schedule, retrieve profile information, posts and analytics, refresh tokens and take the Google Business Profile actions you specifically instruct (currently, publishing posts). We request only the permissions your features need. You can revoke access at any time in the Service or in the Platform's settings.

15.2 Your warranties. You warrant that you own, or are authorised to manage, every Connected Account in your Workspace; that for a Client's account you hold the Client's written authorisation to connect it and to publish and act for it (including Google Business Profile posts and, if we offer them, review replies and answers); and that you will keep that authorisation while the account is connected.

15.3 Platform Terms bind you. When you use a Platform through the Service, you must comply with its Platform Terms, which govern where they are stricter than these Terms. The Platforms' own documents prevail over this summary and over our Platform Disclosures.

15.4 Platform risk. We do not control the Platforms. A Platform may at any time change its API, limits or pricing, require audits, revoke tokens, suspend our application, restrict your content or withdraw a feature, so features may be delayed, limited or discontinued. We will use reasonable efforts to adapt and to tell you of material restrictions. We are not responsible for a Platform's acts, omissions, outages, policies, decisions or API changes, and a Platform's acts do not make Fees refundable (clause 12.2).

15.5 Token health. We refresh tokens automatically where possible. If a token expires or is revoked, the Connected Account shows "Needs reconnection", we notify you in the Service and by email, and its posts are held, not lost, until you reconnect.

15.6 Platform-required deletion. We delete or refresh Platform Data on the timelines the Platforms require, as the Data Deletion Instructions and Platform Disclosures set out. In particular: (a) when you disconnect a Connected Account in Watchpost, its tokens are deleted immediately and its other Platform Data within 24 hours; (b) when you revoke our access in a Platform's settings, its Platform Data is deleted within 7 days of the revocation; (c) while connected, YouTube API data older than 30 days is refreshed or deleted, and Google Business Profile content older than 30 days is deleted; (d) X content is deleted or modified within 24 hours of a written request from X or the account owner; (e) all TikTok data is deleted if TikTok ends our access; and (f) Meta data deletion requests are handled as the Data Deletion Instructions describe. These deletions are standing instructions under the DPA. Removing a Connected Account revokes and deletes its tokens and, after a warning, holds its scheduled posts.

15.7 No secondary use. We use Platform Data only to provide the Service to you. We do not sell it, use it for advertising, build profiles from it or train artificial-intelligence models with it, and no person reads Google User Data except as clause 5.4 allows (Meta Platform Terms s.3; Google API Services User Data Policy; X Developer Agreement).

16. Your Content: ownership and licence

16.1 You keep all intellectual property rights in your Customer Content.

16.2 Licence to us. You grant us a non-exclusive, worldwide, royalty-free licence to host, copy, re-encode, transcode, resize, strip metadata from, preview, display to your Members and transmit your Customer Content, solely to provide the Service to you and deliver it to the Platforms you select, on your instructions. The licence ends when the content is deleted, subject to clause 26.6. Anyone with a post preview link you share can view that preview, and add review comments to it, until you delete the post. Content you publish is then held by the Platform under its own terms; deleting it in Watchpost does not remove it from the Platform.

16.3 Your warranties. You warrant that: (a) you hold all rights needed for your Customer Content, including music, images, video and third-party trade marks; (b) you have any consent required from people who appear in it (PDPA ss.6–7), including explicit consent for sensitive personal data (PDPA s.40) and a parent's or guardian's consent for a minor (PDP Regulations reg. 3(3)); (c) it complies with the law, the AUP and the Platform Terms; and (d) you apply accurate commercial-content, paid-partnership and AI-generated labels where required.

16.4 We do not review Customer Content before publication, but we may review, hold or remove it in response to a complaint, a Platform or legal request, or a reasonable belief that it breaches these Terms.

16.5 You may use exports and reports from the Service for your business and your Clients. We show each Platform's metrics as that Platform reports them, and we label the figures we calculate ourselves, such as engagement rates, best-time suggestions and insight sentences (YouTube API Services Developer Policies III.E.3). We may use feedback you send us without identifying you.

17. Prohibited content

17.1 You must not create, schedule or publish through the Service content that: (a) is child sexual abuse material or sexualises a minor; (b) is or promotes financial fraud or a scam; (c) is obscene or indecent; (d) threatens or harasses any person; (e) incites violence or terrorism; (f) induces a child to harm themselves; (g) promotes ill-will or hostility, including on grounds of race, religion or descent; (h) promotes dangerous drugs; (i) is false, menacing or grossly offensive and intended to annoy, abuse, threaten, harass or defraud (Communications and Multimedia Act 1998 s.233); (j) infringes another person's intellectual property, privacy or personal data rights; or (k) breaches a Platform's community guidelines. Items (a) to (h) follow the harmful content categories in the First Schedule to the Online Safety Act 2025.

17.2 We may refuse to publish or remove such content, notify the Platform or the authorities where required, and suspend or terminate the responsible Account or Workspace.

18. Intellectual property

18.1 The Service, including its software, design, text, trade marks and documentation, belongs to us or our licensors (Copyright Act 1987; Trade Marks Act 2019). We grant you a limited, non-exclusive, non-transferable, revocable right to use the Service under these Terms. You must not copy, modify, sell, reverse engineer or decompile it except as the law permits, or use our name or marks without permission. Open-source components are licensed under their own terms.

18.2 Watchpost is independent and is not approved, certified or endorsed by, or affiliated with, any Platform unless we say so in writing; passing a Platform's review or audit is not an endorsement. You must not describe Watchpost otherwise (Trade Descriptions Act 2011 s.16).

19. Third-party services

19.1 The Service relies on the Platforms (clause 15), Google Sign-In and service providers in these categories: our payment processor (clause 8), our email delivery provider, our backup storage provider, an error-monitoring service and our network and security provider. The Sub-processors page lists their categories; the current list of named providers is available on request at [email protected]. We give Workspace Owners at least 30 days' notice of a new or replacement Sub-processor, with a right to object (clause 20.3). Where you deal with a third party directly, its terms govern and we are not responsible for it. We remain responsible for our Sub-processors as the DPA provides.

20. Personal data and the Data Processing Agreement

20.1 Privacy Policy. We process personal data as the Privacy Policy describes. It is issued in Bahasa Malaysia and English (PDPA s.7(3)).

20.2 Our two roles. For Account Data we are the data controller (PDPA s.4; GDPR Art. 4(7)). For personal data in Customer Content, including Platform Data about your Clients, audiences and commenters, we are your data processor (PDPA s.4; GDPR Art. 28; a "data intermediary" under SG PDPA s.4(2)), and you are the controller (or, as an Agency, your Client's processor). The Platforms are independent controllers, not our Sub-processors.

20.3 The DPA applies automatically to every Workspace whose Customer Content includes third parties' personal data, which in practice means every Agency and most businesses. It covers our processor duties (PDPA ss.5(1A) and 9; GDPR Art. 28(3); SG PDPA ss.24–25); Sub-processors, with at least 30 days' notice of a new or replacement Sub-processor, a right to object and, if an objection cannot be resolved, a right to cancel the affected Subscription with immediate effect, with no further charges; security; breach notification to you within 48 hours; help with data subject requests and with your own breach notifications; audits; deletion; and transfer safeguards for EU, UK and Singapore customers (SCCs, UK Addendum, SG PDPA s.26).

20.4 Your duties as controller. For personal data in your Customer Content, you must have a lawful basis (PDPA s.6); give the notices required by PDPA s.7 (and GDPR Arts. 13–14 where they apply), including that you use Watchpost and the Platforms; obtain any necessary consents; not collect personal data unlawfully (PDPA s.130); and answer your data subjects' requests, with our help under the DPA. An Agency warrants that each Client has authorised it to engage us and to accept the DPA.

20.5 Security. We protect personal data with measures appropriate to its sensitivity (PDPA s.9; Personal Data Protection Standard 2015), including encryption of tokens at rest, encryption in transit, Workspace isolation, 2FA, security logging and encrypted backups, with an encrypted off-site copy.

20.6 Breaches. (a) Customer Content. If a personal data breach affects personal data we process for you, we will notify you without undue delay and within 48 hours of becoming aware of it (DPA clause 8), so that you can decide on and make the notifications the law requires of a controller. We will not notify regulators or data subjects in your name unless the law requires it. (b) Account Data. Where we are the controller, and where the law requires it, we will notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours, and affected individuals within 7 days after that (PDPA s.12B); the competent EU or UK authority within 72 hours (GDPR or UK GDPR Art. 33); and the Singapore Personal Data Protection Commission within 3 calendar days of assessing a breach as notifiable (SG PDPA s.26D). (c) The Workspace Owner's email address is your breach contact unless you name another.

20.7 Where data is processed. We store the Service's data on servers we operate or control. Data is encrypted in transit, and our backups are encrypted at rest. Our service providers and the Platforms you connect may process personal data in other countries. We transfer personal data abroad only as PDPA s.129 permits; for EU and UK data, under GDPR Chapter V and the UK transfer rules, using the SCCs and the UK Addendum; and for Singapore data, as SG PDPA s.26 requires; in each case as the DPA describes. Where the law requires us to appoint a representative in the European Union or the United Kingdom, we will publish its details here. Until then, contact us at [email protected].

20.8 Rights, marketing and cookies. You may exercise your rights of access, correction, withdrawal of consent, objection to processing likely to cause damage or distress, stopping direct marketing and data portability (PDPA ss.30, 34, 38, 42, 43 and 43A) and, where the GDPR, UK GDPR or SG PDPA applies, the further rights the Privacy Policy describes (including erasure and restriction). If you are in another country, you keep the rights your local law gives you, and you may contact us to use them. Use the Service's self-service tools or write to [email protected]. You may also complain to the Personal Data Protection Commissioner or another regulator named in the Privacy Policy. Marketing emails need your opt-in and carry an unsubscribe link (PDPA s.43). We set only strictly necessary cookies; on billing pages, our payment processor may set its own fraud-prevention cookies. The Cookie Policy lists each one.

21. Availability, maintenance, Beta Features and no guarantee of posting success

21.1 Availability and maintenance. We do not promise uninterrupted or error-free operation; any availability figures we publish are targets, not guarantees. We may suspend the Service for planned maintenance, normally announced at least 48 hours ahead and scheduled outside Malaysian business hours where possible, and for emergency maintenance without notice.

21.2 Timing. Our scheduler checks for due posts every 60 seconds, and the Platform then processes the upload. Posts normally publish within minutes of their scheduled time, but Platform processing, especially of video, can take longer.

21.3 No guarantee of posting success, reach or metrics. Publication depends on the Platform accepting the content and on your Connected Account being authorised and in good standing. We do not guarantee that a post will publish, stay published or achieve any reach, engagement or business result. Analytics depend on what each Platform provides; we show "last updated" and "not available" states rather than inventing figures. If a post fails, we show the Platform's error with a "Fix and retry" action. When a Platform Limit is reached, the post waits and is published automatically when the Platform allows it. The Service shows it as waiting, with the reason and the expected time, and tells you in the Service (and by email, at most once a day for each kind of limit). If it still cannot be published within 72 hours after its scheduled time, or another period shown in the Service, we mark it as failed with the reason so that you can reschedule it.

21.4 Suggestions, not decisions. Best-time suggestions and insight sentences are statistical observations from your own data, not advice. They make no decision with legal or similarly significant effect on anyone (PDPA Automated Decision-Making and Profiling Guideline 2026; GDPR Art. 22 and UK GDPR Arts. 22A–22D where they apply).

21.5 Beta Features. Features labelled beta, preview or experimental ("Beta Features") are for evaluation, may change or be withdrawn at any time, may carry extra terms and are excluded from availability targets. We still apply reasonable care.

21.6 Changes to the Service. We may add, change or remove features. If a change materially reduces the core functionality you pay for, we will give the Workspace Owner at least 30 days' notice, and you may cancel the Subscription with immediate effect, with no further charges.

22. Warranties and disclaimer

22.1 We warrant that we will provide the Service with reasonable care and skill (Consumer Protection Act 1999 s.53) and substantially as described on our website, comply with applicable law (including Data Protection Law) in providing it, and not knowingly introduce malicious code.

22.2 Except for clause 22.1, guarantees implied by law that cannot be excluded, and anything else expressly stated in these Terms, we give no other warranty, condition or representation about the Service, to the fullest extent the law allows. We do not warrant that the Service will meet all your requirements or achieve any result.

23. Limitation of liability

23.1 What we do not limit. Nothing in these Terms limits or excludes liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) wilful misconduct; (d) your obligation to pay the Fees; (e) the indemnities in clause 24, which are limited only as clause 23.5 provides; or (f) anything that cannot be limited or excluded by law, including under the Consumer Protection Act 1999 (ss.6 and 24D).

23.2 Excluded losses. Subject to clauses 23.1 and 23.4, neither party is liable to the other, in contract, tort (including negligence), under statute or otherwise, for: loss of profits, revenue, business or anticipated savings; loss of goodwill; loss of followers, reach or engagement; a Platform's suspension of a Connected Account; or indirect or consequential loss. Loss of Customer Content is excluded only to the extent you could have avoided it by using the export tools we provided.

23.3 Cap. Subject to clauses 23.1 and 23.4, each party's total liability arising out of or in connection with these Terms, for all claims in any 12-month period, is limited to the greater of: (a) the Fees paid for the affected Workspace in the 12 months before the event giving rise to the first claim; and (b) RM500.

23.4 Why these limits are fair, and consumers. The limits reflect that the Service costs RM69 a month and depends on Platforms we do not control; a higher limit is available by written agreement. Liability for negligence is limited, not excluded. If you are a consumer under the Consumer Protection Act 1999, clauses 23.2, 23.3 and 23.5 apply only so far as Part IIIA of that Act allows, and do not exclude or restrict our liability for negligence where s.24D would make that unfair. Nothing here shortens a limitation period under the Limitation Act 1953 (Contracts Act 1950 s.29).

23.5 Indemnity cap. Each party's total liability under clause 24 is not subject to clause 23.3, but is limited, for all claims in any 12-month period, to the greater of: (a) RM100,000; and (b) three times the Fees paid for the affected Workspace in the 12 months before the event giving rise to the first claim. This limit does not apply to your indemnity under clause 24.1(c), which the DPA leaves unlimited (DPA clause 16.2), or to an indemnity claim arising from fraud, wilful misconduct or content prohibited by clause 17.1(a) to (i).

24. Indemnity

24.1 By you. You will indemnify XYZ Sdn Bhd and its directors, employees and contractors against third-party claims, and the resulting losses, damages, costs and reasonable legal fees, to the extent they arise from: (a) your Customer Content; (b) a breach of the AUP or Platform Terms by you or your Members, including a Platform's claim or cost-recovery demand against us; (c) your breach of clause 20.4 or the DPA; or (d) your breach of the law. Your indemnity is reduced to the extent that we caused the claim. It does not cover fines or penalties imposed on us, which each party bears itself (DPA clause 16.3).

24.2 By us. We will defend you against a third-party claim that the Service as we provide it (excluding Customer Content, Platforms and third-party services) infringes a Malaysian copyright or trade mark, and pay the damages finally awarded or agreed. We may instead modify the Service or, if that is not reasonably possible, end the affected Subscription with immediate effect, with no further charges.

24.3 Process. The indemnified party must notify the other promptly, let the indemnifying party control the defence and settlement, cooperate at the indemnifying party's cost and mitigate its loss. No settlement may admit fault for, or bind, the indemnified party without its consent.

25. Suspension

25.1 We may suspend all or part of the Service for an Account, Workspace, Connected Account or post if: (a) we reasonably believe these Terms, the AUP or the Platform Terms have been breached; (b) a Platform, regulator, court or law-enforcement body requires it; (c) there is a security risk; (d) Fees are unpaid after the Grace Period (publishing and analytics syncing only); or (e) we suspect fraud or a chargeback is open.

25.2 We will act proportionately, tell you the reason and what to do (unless the law or a Platform prevents us), and lift the suspension once the issue is resolved. If a suspension not caused by you lasts more than 7 consecutive days, you may cancel the Subscription with immediate effect, with no further charges.

25.3 No late publishing. While publishing is suspended, due posts are held, not deleted, and they are never published late without your instruction. When the suspension ends, or once a held post is 24 hours overdue, we mark it as not published, with the reason, so that you can reschedule the posts you still want. For unpaid Fees, clause 7.2 applies instead.

26. Term, termination, data export and deletion

26.1 These Terms apply from acceptance until your Account and every Workspace you own have been deleted or terminated.

26.2 By you. You may delete your Account in your settings, and a Workspace Owner may delete a Workspace, after signing in again if asked. Deleting a Workspace stops its renewals and ends its Subscription, with no refund for the current month; a renewal charged after you asked for the deletion is refunded as a charge made in error (Refund Policy clause 4.5). You cannot delete your Account while you own a Workspace that has other Members: transfer its ownership or remove those Members first. Workspaces you own alone are deleted with your Account. Cancelling a Subscription is covered by clause 12. The Data Deletion Instructions explain every deletion route.

26.3 By us. We may terminate these Terms, an Account or a Workspace: (a) for a material breach not remedied within 14 days of notice; (b) immediately on notice, for a serious breach (such as prohibited content, fraud, a security threat or unlawful collection of personal data) or where a Platform or an authority requires it; (c) on at least 30 days' notice, if an Account and every Workspace it owns have been inactive for 24 months with no active Subscription (PDPA s.10; Personal Data Protection Standard 2015); or (d) on at least 60 days' notice, if we stop providing the Service.

26.4 Effect. On termination the Subscription ends, scheduled posts are not published, Members lose access and we revoke and delete Connected Account tokens. No Fees are charged after termination. If we terminate without your breach, or you terminate for our material breach, the Subscription ends with immediate effect, with no further charges. Fees already paid are not refunded, except as clause 12.2 provides.

26.5 Export and the 14-day Export Window. While your Account exists, you can download your data yourself in Settings: a machine-readable file (JSON) covering your Account and the Workspaces you own, including the posts you wrote, with an archive of the media you uploaded, within the size limits the Service shows (PDPA s.43A). You can also export analytics as CSV. A Workspace Owner may ask us at [email protected] for an export of all of a Workspace's Customer Content. When a Workspace or Account is deleted or terminated, a 14-day Export Window starts. During it, the deletion can be cancelled as the Data Deletion Instructions explain, and the Workspace Owner may ask us for an export, including after a termination by us. The Connected Accounts of a deleted Workspace are disconnected at once, and their Platform Data (including analytics) is deleted on the clause 15.6 timelines, which can be shorter than the Export Window: export analytics before you delete. We shorten this window only where a Platform or the law requires earlier deletion.

26.6 Deletion. When the Export Window ends, we permanently delete the Workspace's Customer Content and the Account Data from live systems. Copies in our encrypted backups are deleted as the backups rotate: daily backups within 35 days and monthly backups within 12 months. Until then they stay encrypted and are not used, and if we ever restore a backup, we delete again the data that had been deleted. We keep only: (a) billing and transaction records, for 7 years after the end of the financial year (Income Tax Act 1967; Companies Act 2016), which also meets the 3-year CPETTR record duty; (b) records of acceptance and consents, for 7 years after the Account closes; (c) security logs, for the period stated in the Privacy Policy; (d) anonymised statistics; (e) data needed for a legal claim or obligation; (f) support, complaint and emailed rights-request records, for 3 years after the matter closes, and records of requests made in the Service (data exports, Account deletions and Meta deletion confirmation codes), for 12 months after they are completed; (g) the personal data breach register, for at least 2 years; (h) a marketing suppression record, for as long as needed to honour your opt-out; and (i) records of fair-use reviews and the steps we took, for 3 years after the matter closes. Shorter Platform-required timelines (clause 15.6) prevail.

26.7 Clauses 1, 2, 3.2, 8.8, 9, 12.2, 15.6, 15.7, 16.5, 18, 20, 23, 24, 26.4 to 26.7 and 28 to 33, and any other clause that by its nature should survive, survive termination.

27. Changes to these Terms

27.1 We may change these Terms. For a material change (for example, to Fees, liability, data protection, termination or your rights), we will give the Workspace Owner and Members at least 30 days' notice by email and in the Service, and ask you to accept the new version in the Service. Non-material changes (corrections, updated legal references, new features that do not reduce your rights) take effect when posted.

27.2 If you do not agree to a material change, you may cancel your Subscription with immediate effect, with no further charges, before it takes effect; continued use after the effective date is acceptance (Electronic Commerce Act 2006 s.3). A change required by law or by a Platform may take effect sooner, with as much notice as is practicable.

28. Governing law and disputes

28.1 These Terms, and any dispute arising out of or in connection with them (including non-contractual disputes), are governed by the laws of Malaysia. Please contact [email protected] first; both parties will try in good faith to resolve the dispute within 30 days. This step does not stop either party from starting proceedings to protect a limitation period, or a consumer from going to the Tribunal for Consumer Claims.

28.2 Optional mediation. Either party may then propose mediation under the Mediation Act 2012, administered by the Asian International Arbitration Centre (AIAC) in Kuala Lumpur under its mediation rules, with costs shared equally. Mediation is voluntary and does not stop either party from going to court (Contracts Act 1950 s.29).

28.3 Courts. Subject to clauses 28.4 and 29, and to the governing-law and forum clauses of the SCCs and UK Addendum where they apply (DPA clauses 12.3, 12.4 and 18.4), the courts of Malaysia at Kuala Lumpur have exclusive jurisdiction.

28.4 Either party may seek urgent injunctive relief in any competent court. Nothing here prevents a consumer from bringing a claim in the Tribunal for Consumer Claims (Consumer Protection Act 1999 s.98), or in another court where the law allows, including the courts of the country where the consumer lives.

29. Consumer rights not excluded

29.1 Nothing in these Terms excludes, restricts or modifies any guarantee, right or remedy under the Consumer Protection Act 1999, the Contracts Act 1950, Data Protection Law or any other law that cannot be excluded by agreement (Consumer Protection Act 1999 s.6). A clause that would otherwise do so applies only as far as the law allows. If you are a consumer outside Malaysia, you also keep the mandatory protections of the law of the country where you live, and Customers in the EU, the UK, Singapore and elsewhere keep any mandatory rights under their local law. Unresolved consumer complaints may be taken to the Ministry of Domestic Trade and Cost of Living (KPDN) or the Tribunal for Consumer Claims.

30. Notices

30.1 To you. We give notices by email to your Account address (and to billing contacts for billing matters) or in the Service. An email is treated as received when it enters the email system you designated (Electronic Commerce Act 2006 ss.20–23).

30.2 To us. Send notices to [email protected]; serve legal process at Malaysia. An email to us is treated as received on the next working day in Kuala Lumpur, except as Refund Policy clause 4.3 provides for cancellations. Notices may be in English or Bahasa Malaysia.

31. General

31.1 Entire agreement. These Terms and the documents in clause 3.3 are the entire agreement about the Service and replace earlier discussions, without excluding liability for fraud.

31.2 Severability. An invalid, unenforceable or unfair clause is read down or severed to the minimum extent necessary, and the rest continues in force (Consumer Protection Act 1999 s.24G).

31.3 Assignment. You may not transfer these Terms or a Workspace without our written consent, except through the "transfer ownership" feature. We may transfer these Terms to an affiliate or a business successor on notice, without reducing your rights. In a merger, acquisition or sale of assets, we transfer Google User Data only with your explicit prior consent (Google API Services User Data Policy).

31.4 Force majeure. Neither party is liable for a failure caused by events beyond its reasonable control (such as natural disaster, epidemic, war, government action or failure of public internet or power infrastructure), if it notifies the other and works to resume. This does not excuse payment.

31.5 Other. Delay in exercising a right is not a waiver. You appoint us as your agent only to publish content and retrieve data for you through Platform APIs; otherwise the parties are independent contractors. Only you and we may enforce these Terms, except that data subjects may enforce the third-party beneficiary rights the SCCs and UK Addendum give them. "Including" means "including without limitation"; a statute includes its amendments and subsidiary legislation.

32. Language

32.1 These Terms are written in English, which is the operative version. If we publish a translation of these Terms and the versions differ, the English version prevails unless Malaysian law requires otherwise. The Privacy Policy is published in Bahasa Malaysia and English as PDPA s.7(3) requires, and states how its two versions relate.

33. Company and contact disclosures

Given under CPETTR (reg. 3 and Schedule) and the Companies Act 2016 (s.30).

34. Change log