Privacy Policy — Felis

Operated by: THE PAPER PREP PTE. LTD. (Singapore), trading as The Paper Prep ("we", "us", "our") Effective date: 30 October 2026 Contact: aaron@thepaperprep.com

1. What this platform is

We operate a messaging platform that connects WhatsApp Business accounts to our systems via Meta's WhatsApp Business Platform (Cloud API), so that businesses can receive, store, organise and reply to WhatsApp messages from their customers. The first business using the platform is The Paper Prep, a tutoring business in Singapore. Other businesses ("Client Businesses") may in future use the platform for their own customer messaging; for those businesses we act as a data processor / data intermediary and they remain responsible for their customers' personal data as the data controller / organisation under the Singapore Personal Data Protection Act 2012 (PDPA).

2. Personal data we collect

Through the WhatsApp Business Platform we receive and store:

• Message content — text and media captions of WhatsApp messages sent to or from a connected business number, including messages sent from the WhatsApp Business app (mirrored to us by Meta under Coexistence) and, where the account owner chooses to share it during onboarding, up to six months of prior 1-to-1 chat history.
• Phone numbers — the WhatsApp numbers of the business and of the individuals messaging it, and WhatsApp profile names where provided.
• Message metadata — message IDs, timestamps, message type, delivery and read statuses, and the WhatsApp Business Account and phone number identifiers needed to route messages to the correct business.
• Account/administration data — names and email addresses of the business users who administer the connection, and the access tokens/identifiers required to operate the API connection (stored securely, never in message data).

We do not collect data from individuals who have never messaged a connected business number, and we do not access anyone's personal WhatsApp account.

3. Why we collect it (purposes)

• To operate the messaging service: receive, archive, display, organise and reply to customer messages on behalf of the business.
• To provide features the business requests, such as enquiry triage, lesson or appointment reminders, and follow-ups.
• To maintain the security, integrity and auditability of the service (including the raw webhook archive used to rebuild message records).
• To comply with Meta/WhatsApp platform policies and applicable law.

We do not sell personal data, and we do not use message content for advertising or for training general-purpose AI models.

4. Legal basis / PDPA

We collect, use and disclose personal data with the consent of the individuals concerned (given when they choose to message a business on WhatsApp) and as otherwise permitted under the PDPA. Client Businesses are responsible for obtaining any additional consent needed for the messages they send (including opt-in for marketing/template messages).

5. Who we share data with

• Meta / WhatsApp — all messages necessarily pass through Meta's WhatsApp Business Platform, which is the transport for the service. Meta processes data under its own terms and policies.
• Service infrastructure — the hosting providers we use to run and store the platform (servers and databases under our control), bound by confidentiality and security obligations.
• The Client Business itself — for data relating to its own customers.
• Authorities — only where required by law.

We do not share personal data with other third parties for their own marketing.

6. Storage and security

Data is stored in databases controlled by us (currently a local/owned archive; production hosting under the business's own accounts), protected by access controls, encrypted transport (HTTPS), and credential management that keeps API tokens and app secrets out of source code. Access is limited to people who need it to operate the service.

7. Retention

Message archives are kept for as long as the business needs them for customer service, record-keeping and legal purposes. As a default, message content and metadata are retained for 24 months after the last interaction, then deleted or anonymised, unless the business instructs otherwise or the law requires longer retention. Raw webhook payloads are retained on the same schedule as the messages derived from them.

8. Your rights (PDPA)

Individuals may, in respect of their personal data:

• request access to personal data we hold about them;
• request correction of inaccurate data;
• withdraw consent to our collection/use of their data (which may mean the business can no longer message them through this platform);
• request deletion of their data (see Section 9).

Requests can be made to aaron@thepaperprep.com. We will respond within a reasonable time, and within 30 days where the PDPA requires it. Where the data belongs to a Client Business's customers, we will refer or relay the request to that business as controller.

9. Data deletion

To have your personal data deleted from this platform:

1. Email aaron@thepaperprep.com from, or stating, the WhatsApp phone number the messages were sent from, and say you want your WhatsApp message data deleted.
2. We will verify the request relates to that number, delete the message content, metadata and archived payloads associated with it from our systems, and confirm completion by email/WhatsApp.
3. Deletion from our systems does not delete copies held by Meta/WhatsApp or in the business's own WhatsApp Business app; those are governed by WhatsApp's own deletion tools and policies.

Businesses disconnecting from the platform can request a full export and/or deletion of their tenant's data on the same contact.

10. Children

Our tutoring services are used by parents/guardians and students. We process students' data only as provided by parents/guardians or schools in the course of arranging tuition, and Client Businesses are responsible for having the necessary consents.

11. Changes

We may update this policy; the current version will be published at this URL with a new effective date.

12. Contact

Data Protection contact: aaron@thepaperprep.com The Paper Prep, Singapore.