Privacy policy

Last updated 24 September 2026

Who we are

CustomerDock (customerdock.my) is a customer messaging platform operated by EST SOLUTIONS, a business in Malaysia. Businesses use CustomerDock to receive and reply to messages from their customers across channels such as Telegram, WhatsApp and Facebook Messenger, and to manage the contacts those conversations create. Using CustomerDock is governed by our Terms of service.

What we collect, and why

From businesses that use CustomerDock

• Account details: name, email address, workspace name, billing information (payments are processed by Stripe; we do not store card numbers).
• Channel connections: the credentials needed to send and receive on a connected channel (for example a Telegram bot token, or a Facebook Page access token). These are encrypted at rest and are never shown back to anyone.
• Calendar connections: if a team member connects a Google Calendar, the data described under Google Calendar below.

From people who message a business

• Messages and attachments sent to a connected channel, the sender's platform identifier (such as a Page-scoped Messenger ID), display name and, where the platform provides it, profile picture.
• For Facebook Lead Ads, the answers a person submits on a business's lead form.

We process this data on behalf of the business you contacted, so that they can reply to you and keep a record of the conversation. The business is the controller of that data; CustomerDock is its processor.

Facebook and Messenger

When a business connects a Facebook Page, we use Meta's Messenger Platform to receive the messages people send to that Page and to deliver the business's replies. We use the permissions pages_show_list, pages_messaging and pages_manage_metadata for that, and leads_retrieval to fetch Lead Ads form submissions the business chose to receive. We do not post to Pages, read Page followers, or use this data for advertising. Messages are kept in the business's inbox until the business deletes them or closes its account.

Google Calendar

A business can connect a team member's Google Calendar, so that bookings avoid the times that person is busy and confirmed appointments appear in their calendar. Connecting is optional. The calendar's owner signs in with Google and approves these permissions, and CustomerDock uses each one only for the purpose given:

• calendar.calendarlist.readonly: the names of your calendars, so you can choose which ones CustomerDock checks and which one receives appointments.
• calendar.freebusy: the times you are busy on the calendars you chose. Google gives CustomerDock only the start and end of each busy period, never event titles, descriptions or guests.
• calendar.events: to create, move and cancel the appointments booked through CustomerDock on the one calendar you chose for them, and to notice when you move or delete one of those appointments in Google Calendar.
• Your Google account's email address, so you can see which account is connected.

What we store

We store the connected account's email address, the names of its calendars and which ones you selected, and the tokens Google issues for the connection, encrypted with AES-256-GCM. For each appointment written to your calendar we keep the Google event ID. Busy times are fetched each time availability is calculated and are never stored. When CustomerDock checks your appointment calendar for changes, it acts only on events it created and keeps nothing about your other events.

What we write to your calendar

Each appointment event contains the appointment type and its description, the customer's name, any notes the customer gave when booking and, if the appointment uses Google Meet, the meeting link. If the customer gave an email address, they are added as a guest and Google sends them the invitation.

How Google data is used and shared

• Google data is used only to provide the calendar features described above. We do not sell it, use it for advertising, or use it to develop, improve or train generalised AI or machine-learning models.
• If a business uses CustomerDock's AI assistant, the assistant can look up open booking times to offer them to a customer. It receives only those open times, which Anthropic, our AI model provider, processes to write the reply. It never receives busy times or event details.
• Google data is stored with our database host, Supabase, and is not shared with anyone else unless the law requires it.
• No one at CustomerDock reads your Google data unless you ask us to help with a problem, it is needed for security, or the law requires it.

CustomerDock's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting

Disconnecting a calendar in CustomerDock's calendar settings deletes the stored tokens immediately, and CustomerDock stops reading and writing that calendar. Appointments already in your calendar stay there. You can also remove CustomerDock's access at any time in your Google Account, at myaccount.google.com/connections. The record of which account was connected, and its calendar names, stays with the workspace's appointment history. Contact us to have it deleted.

How long we keep data

Conversation data is kept for as long as the business's workspace exists. When a workspace is closed, its data is deleted within 30 days. Encrypted channel credentials are deleted immediately when a channel is disconnected.

Deleting your data

If you connected a Facebook account to CustomerDock and later remove the app from your Facebook settings, Meta notifies us and we delete the connection and its credentials automatically; you receive a confirmation code and a status page. If you messaged a business through CustomerDock and want your messages removed, contact that business, or contact us and we will pass the request on. Businesses can delete contacts and conversations from their workspace at any time.

Sharing

We share data only with the providers needed to run the service:

• Supabase: database hosting.
• Vercel: application hosting.
• Railway: the messaging runtime.
• Stripe: billing.
• Anthropic: the AI model behind CustomerDock's AI features, such as reply drafts, automatic replies and message understanding. It receives the conversation text a feature works on.
• OpenAI: search across a business's knowledge base. It receives the knowledge base content, and the customer message being answered so the right entries can be found.
• The platforms a business connects: Meta, Telegram, and Google when a calendar is connected.

We do not sell data.

Security

Data is isolated per workspace with row-level security, credentials are encrypted with AES-256-GCM, and every webhook from a platform is verified by signature before it is processed.

Contact

Privacy questions and deletion requests: customerdock@gmail.com.