Privacy Notice

Version 2026-10-24 · Last updated 24 October 2026 · Questions: gwadmin@w3jdev.com

1. Who we are

Bijou AI ("Bijou", "we") is a service of W3J LLC, a limited liability company organised in Wyoming, USA. We serve businesses in many countries, and this notice is written to meet the main privacy laws that apply to them and to the people they talk to, including the EU and UK General Data Protection Regulation ("GDPR"), US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and Asia-Pacific laws such as Malaysia's and Singapore's Personal Data Protection Acts ("PDPA"). Where a local law gives you more protection than this notice describes, we follow that law.

Privacy contact: gwadmin@w3jdev.com. Use this address for every privacy question or request.

2. Our role: controller or processor

• Controller for our own data: people who visit this website, fill in our forms, chat with our website assistant, book a call with us, or open a Bijou account.
• Processor (service provider) for the businesses that use Bijou ("Customers"). When you message a business that uses Bijou on WhatsApp or Telegram, that business decides why and how your messages are used. We process them on the business's behalf and instructions. Contact that business first about your data; we will help it respond.

3. What we collect

From website visitors and leads

• What you type into our forms or website chat: name, email, phone, company, industry, message.
• Booking details if you book a call through Cal.com.
• Usage data: pages viewed, clicks, device, browser and approximate location from IP address, collected only with your consent where the law requires it (see Cookies).

From Customers (account holders)

• Account and business details: business name, email, phone, industry, login credentials (passwords are handled by our authentication provider and never stored in plain text).
• Records of your acceptance of our terms (time and version).
• Knowledge base content, FAQs, documents and settings you upload.
• Billing data handled by Stripe. We do not store full card numbers.

From people who message a Customer's business

• Phone number or Telegram ID, display name, the messages exchanged, timestamps, any files or voice notes you send, and any details you share in the chat (for example a booking request).
• Notes Bijou creates to do the job: conversation summaries, lead tags (for example hot, warm, cold), escalation records and the reasons the AI gave for a reply.

Giving us your contact details on a form is voluntary, but without them we cannot reply to you. Customers must give account details to use the service. We do not ask for sensitive data (such as health, religion or financial account details) and Customers must not configure Bijou to collect it.

4. Why we use it

• To provide the service: reply to customers on a business's behalf, book appointments, hand chats to staff, send alerts (performance of our contract with the Customer).
• To reply to your enquiry and follow up about Bijou (your consent, or our legitimate interest in answering you). You can opt out of marketing at any time.
• To bill Customers and keep accounts (contract and legal obligation).
• To keep the service secure and working: logs, abuse prevention, debugging (legitimate interest).
• To understand how the website is used (your consent).

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

5. AI and your data

• Bijou uses third-party large language models to draft replies. The message, recent conversation history and the business's knowledge base text are sent to the model provider to generate a reply. See Sub-processors.
• We do not use conversation data to train our own or shared AI models.
• A fallback model provider is used only when the primary model is unavailable. Some fallback providers' terms allow them to log requests; they are listed on our Sub-processors page.
• Replies are generated automatically. They do not produce legal or similarly significant decisions about you, and you can always ask to speak to a person at the business.
• AI can make mistakes. Read our AI Disclosure for how Bijou is supervised.

6. How WhatsApp is connected

Bijou currently connects to a business's own WhatsApp number as a linked device using an open-source connector that we host. This is not the official WhatsApp Business Platform (Cloud API). Messages still travel through WhatsApp's own systems, which are governed by WhatsApp's terms and privacy policy. WhatsApp may restrict numbers that use unofficial connections; our Terms explain this risk to Customers.

7. Who we share it with

• The service providers listed on our Sub-processors page, under contract and only for the purposes above.
• The Customer whose business you messaged (it controls that conversation).
• Authorities, where the law requires it.
• A buyer or successor, if the business is reorganised or sold, under the same protections.

8. International transfers

Our providers process data in several countries, including the United States, Singapore, China and others listed on our Sub-processors page, so your data may be processed outside the country where you live. When we transfer personal data across borders we use a lawful transfer mechanism, for example:

• for data from the EU, EEA, UK or Switzerland: the European Commission's Standard Contractual Clauses (and the UK Addendum), or an adequacy decision, where available for that provider;
• for data from Malaysia, Singapore and other Asia-Pacific countries: transfers to places with comparable protection, contractual safeguards, or another basis the local law allows (such as a transfer needed to perform a contract with you).

Ask us for details of the safeguard used for a specific provider.

9. How long we keep it

• Conversation data: for as long as the Customer's account is active, unless the Customer deletes it earlier. After an account is closed we delete or anonymise it within 90 days, unless the law requires us to keep it.
• Leads and enquiries to Bijou: up to 24 months after our last contact, unless you ask us to delete them sooner.
• Billing records: as long as tax and accounting law requires.
• You can ask us to delete data sooner at any time (see Your rights).

10. Security and breaches

We use encryption in transit (TLS), encryption at rest provided by our database host, row-level separation of each Customer's data in our database, access controls, and secret management for credentials. No system is perfectly secure.

If a personal data breach occurs, we will notify the competent regulators and affected people within the time limits the applicable law sets (for example within 72 hours of becoming aware of it where the GDPR or Malaysia's PDPA requires it). Where we act as processor, we will tell the affected Customer without undue delay so it can meet its own duties.

11. Your rights

Depending on where you live, you can ask us to:

• access the personal data we hold about you and get a copy (in a portable format where the law provides);
• correct it, or delete it;
• restrict or object to our use of it, including stopping direct marketing;
• withdraw consent you gave us, at any time, without affecting earlier processing;
• know which categories of data we collect and disclose, and opt out of any sale or sharing (we do neither).

We will not treat you differently for exercising these rights.

How to make a request: use our data request page or email gwadmin@w3jdev.com from the email address or with the phone number the request is about. You may use an authorised agent where your law allows it. We will verify your identity before releasing or deleting anything and reply within the time your law sets (for example one month under the GDPR, 45 days under the CCPA, 21 days under Malaysia's PDPA). If the data belongs to a Customer's conversation, we will pass your request to that business and help it respond.

You can also complain to your data protection authority (see Regional information).

12. Regional information

European Union, EEA and United Kingdom

Our legal bases are described in section 4. You can complain to the supervisory authority in the country where you live or work, or in the UK to the Information Commissioner's Office.

United States

In the last 12 months we collected the categories of personal information described in section 3 (identifiers, commercial information, internet activity, and the content of messages) for the purposes in section 4, and disclosed them only to the service providers on our Sub-processors page. We have not sold or shared personal information. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws can exercise the rights in section 11, and can appeal a decision by replying to our response.

Asia-Pacific

For Malaysia, Singapore, Indonesia, Thailand, the Philippines, India, Australia and other countries in the region, we apply the rights and safeguards in this notice and any additional rights your local law gives you. You can complain to your local authority, for example Malaysia's Personal Data Protection Commissioner (pdp.gov.my) or Singapore's Personal Data Protection Commission (pdpc.gov.sg).

13. Cookies and analytics

This website uses Google Analytics and PostHog to measure visits and improve the site. They load only after you choose Accept in our cookie banner; if you choose Decline, they do not run. We also store small items in your browser that the site needs to work (for example your cookie choice). You can change your choice by clearing this site's data in your browser.

14. Children

Bijou is a business service and is not directed at children under 16. We do not knowingly collect their data. Customers must not use Bijou to target children.

15. Changes and language

We will post changes here and update the version date. Material changes will be notified to Customers by email before they apply. This notice is written in English; email us if you would like it explained in another language.