How your data is stored: chats, contacts, notes and local backups stay on your computer or chat platforms by default. If you use cloud backup, the backup scope is also stored in private Cloudflare R2 storage and our server keeps recovery-point and file indexes. Content submitted to AI features passes through our server to the AI provider.
1. Who is responsible
Transfomind, a software studio in Malaysia, develops BlackCat SCRM and is responsible for the personal data described here. We follow Malaysia's Personal Data Protection Act 2010 (PDPA). Contact: hello@transfomind.com.
2. What stays on your computer
These are stored on the computer where BlackCat runs by default. Business data and local archives are also uploaded when you choose to use cloud backup:
- your chat accounts' sign-in sessions and the chats shown inside the app;
- contacts, recipient lists, message templates, quick replies and conversation notes;
- local chat backups and the .blackcat files you create;
- your app settings, translation settings and, if you add one, your own AI API key.
The chats themselves belong to the chat platforms you sign in to, under their own privacy policies.
3. What our server records
To run your plan, our license server keeps:
- Your login: username, a scrambled (hashed) password, your plan, expiry date, extra accounts and any notes our team adds about your purchase.
- Your devices: a device ID, the computer's name, the app version and when it was last used, so we can apply your plan's computer limit and check that updates install.
- AI usage: for each AI request, the time, feature, model, amount of text processed (tokens), cost and points used, and your points history.
- Contact and billing details you give us when buying a plan, such as your name, email or phone and payment records.
The AI relay does not retain messages, translations or AI replies as chat history. If you choose cloud backup, it stores locally archived chats and saved photos/videos/other attachments, notes, AI knowledge bases and source files, contacts, bulk templates and recipient lists. Our server keeps recovery-point indexes, tenant ownership and storage accounting; content chunks and a copy of each recovery-point index are stored in private Cloudflare R2. Platform sessions, BlackCat login tokens, proxy passwords and API keys in runtime configuration are excluded.
Cloud backups use encrypted connections and access controls tied to your BlackCat customer account. This is not end-to-end encryption with a key held only by you. Data may be processed outside Malaysia. Each computer retains its latest 24 recovery points, with up to 100 per customer. After a recovery point is deleted, files no longer referenced by any point can be cleaned after at least one day. Disabling automatic backup stops future uploads but does not delete existing recovery points.
4. AI features and translation
- AI features (AI translation, AI replies, knowledge-base learning and the assistant): the text and images needed for the request, which may include customer messages and your knowledge-base material, are sent through our server to a third-party AI model provider and the result is returned to you. The provider may process it outside Malaysia, including in the United States. We pass it on only to produce the result. If you use your own API key, the request goes directly from your computer to that provider under your own agreement with it.
- The AI assistant on this website (the "Ask AI" button): the questions you type, the earlier messages of that chat and the page you are on are sent to a third-party AI model provider to write the answer. We do not store the conversation on our server; it is kept in your own browser for 24 hours so it carries across pages, and "Start over" clears it. To limit abuse we keep a one-way hash of your IP address for up to an hour. Please don't type passwords, bank details or other sensitive information into the chat.
- Google and Lingva translation are called directly from your computer; the text you translate is sent to those services under their own terms.
5. Why we use your data
- to sign you in, apply your plan and limits, and count AI points;
- to provide AI features you ask for;
- to deliver updates, keep the service secure and fix problems;
- to bill you and answer your questions;
- to meet legal requirements.
We don't sell your personal data or use it for advertising.
6. Your customers' data
When you use BlackCat to talk to your customers, you decide how their personal data is used, and you are responsible for having a lawful basis and giving them any notice the law requires. For data that passes through our server for AI features, we act on your instructions only.
7. Sharing
We share data only with service providers who help us run BlackCat (such as the AI model provider and hosting), when the law requires it, or with your consent. Each provider may use it only for the service it provides to us.
8. How long we keep it
- Login and device records: while your plan is active and for up to 12 months after it ends, unless you ask us to delete them sooner.
- AI usage and points records: up to 24 months, for billing and support.
- Billing records: as long as Malaysian tax and accounting rules require.
9. Security
Passwords are stored hashed, connections to our server are encrypted, and access to the admin side is limited to our team. No system is perfectly secure, so please keep your password and your computer safe; local backups are only as safe as the computer and folder you keep them on.
10. Your rights
Under the PDPA you may ask to access or correct your personal data, ask us to limit how we use it, or withdraw consent (which may mean we can no longer provide the service). Email hello@transfomind.com and we'll reply within 21 days.
11. Children
BlackCat is a business tool and is not meant for anyone under 18.
12. Changes
We may update this policy and will change the date at the top. For important changes, we'll tell you in the app or by message.