Privacy Notice

Ruth Ai Systems

Last updated: 7 September 2026

---

1. Who We Are

This Privacy Notice is issued by Ruth Ai Systems ("we," "us," "our"), a business providing AI-powered booking and customer communication tools for service businesses. This notice explains how we collect, use, store, and protect personal data in accordance with Malaysia's Personal Data Protection Act 2010 ("PDPA").

Our role depends on how you are interacting with us:

• When you use the booking assistant on our own website, we are the data controller for your personal data.
• When you use a booking assistant on behalf of one of our client businesses (for example a clinic, salon, or other service provider), that business is the data controller and we act as its data processor — handling your data on its instructions. This notice still explains how your data is handled; in that case a request about your data may be passed to, or answered by, that business.

Contact: ruthsystems.ai@gmail.com  ·  +60 11-1098 1143

2. What Personal Data We Collect

When you interact with our booking assistant (on this website or on behalf of one of our client businesses), we may collect:

• Your name
• Your email address
• Your phone number
• The service you're interested in, and your appointment date/time
• Any messages you send during the conversation

3. Why We Collect It

We use this information solely to:

• Check appointment availability and book appointments on behalf of the business you're contacting
• Send you booking confirmations and appointment reminders
• Follow up regarding feedback about your appointment
• Allow a real staff member to contact you if our automated system is unable to complete your request

We do not use your personal data for unrelated marketing purposes without your separate, explicit consent.

4. Who We Share It With

• The specific business you are booking with (e.g., the clinic, salon, or service provider) — this is the essential purpose of the service.
• Service providers (sub-processors) who help us operate the system. They process your data only on our instructions and under a written data processing agreement. They are:
  • Supabase — secure database and file storage
  • Anthropic — the AI model that powers the assistant's understanding and replies
  • Resend — sending booking confirmation, reminder, and feedback emails
  • Google — calendar availability checks and appointment scheduling

We do not sell your personal data to any third party.

5. Where Your Data Is Stored (Cross-Border Transfer)

Some of the service providers we use operate technical infrastructure located outside Malaysia. This means your personal data may be transferred to, and processed in, other countries — primarily the United States and other locations where these providers run their systems — as part of how our booking system works.

We transfer personal data outside Malaysia in reliance on Section 129 of the PDPA and the Personal Data Protection Commissioner's Guidelines on Cross Border Personal Data Transfer (issued 29 April 2025). Specifically, we rely on the basis that we have taken all reasonable precautions and exercised all due diligence to ensure that your personal data will not be processed in a manner that would contravene the PDPA.

The safeguard we rely on is contractual: each provider listed below is bound by a data processing agreement that incorporates the European Union Standard Contractual Clauses ("SCCs") — a set of legally binding data-protection commitments that the Commissioner's Guidelines recognise as an appropriate cross-border transfer mechanism. We maintain an internal record of the recipients of personal data, the transfer routes involved, and the safeguards that apply.

Sub-processors and safeguards

Sub-processor	Role	Personal data involved	Where processed	Safeguard
Supabase	Secure database and file storage for booking records	Name, email, phone, service, appointment date/time, conversation messages	Data-centre region selected by us (may include Singapore, EU or US infrastructure)	Data Processing Addendum incorporating EU SCCs (Modules 2 and 3) — supabase.com/legal/dpa
Anthropic (Claude)	AI language model that powers the booking assistant's understanding and replies	Conversation messages, and any name, contact details or appointment information you provide in the chat	United States	Data Processing Addendum incorporating EU SCCs (Modules 2 and 3) — anthropic.com/legal/dpa. Anthropic does not use data submitted through its API to train its models.
Resend	Sending transactional email — booking confirmations, reminders, feedback requests	Name, email address, and appointment details contained in the message	United States	Data Processing Addendum incorporating EU SCCs (Modules 1, 2 and 3) — resend.com/legal/dpa
Google (Calendar)	Checking availability and creating calendar events for the business you are booking with	Name, appointment date/time, service; phone or email if added to the calendar event	United States and global Google infrastructure	Cloud Data Processing Addendum incorporating EU SCCs — cloud.google.com/terms/data-processing-terms

6. How We Protect Your Data

We apply reasonable technical and organizational security measures to protect your personal data from loss, misuse, unauthorized access, or disclosure, including restricting access to your data to only the systems and personnel that need it to provide the service.

7. How Long We Keep Your Data

We keep different types of information for different periods:

• Booking and conversation data (your name, contact details, the messages you send, and your appointment details): we delete or anonymize this within 90 days after your appointment date. If your conversation does not result in a booking, we delete it within 30 days.
• Where we act on behalf of a client business: we keep the data only for as long as that business instructs us to under our agreement with it, and then delete it. That business keeps its own copy of your booking as its own record.
• Our business and financial records: where information appears in an invoice or payment record between us and a client business, we retain it for 7 years, as required by Malaysian tax law (the Income Tax Act 1967 and the Service Tax Act 2018).

We do not keep your personal data for longer than is needed for the purposes described in this notice, unless the law requires us to.

8. Your Rights

Under the PDPA, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete personal data
• Withdraw your consent for us to process your data (this may limit or prevent our ability to provide the booking service to you)

To exercise any of these rights, contact us using the details in Section 1. We will respond within 21 days. Where we are acting as a data processor for a client business, we may need to forward your request to that business, which will respond as the data controller.

9. Interacting with Our AI Assistant

Our booking assistant is an AI system, not a human being. You are told this at the start of the conversation, before any personal data is collected. It is designed to answer questions, check availability, and book appointments on behalf of the business you are contacting. If at any point you would prefer to speak with a real staff member, you can ask, and our system will pass your request along.