1313 Privacy Policy

Last updated: [16 October 2026] Effective: [16 October 2026]

This Privacy Policy explains how Tripbooking Inc ("we", "us" or "our"), collects, uses, stores, discloses and protects personal data when you use the website at 1313.ai, the 1313 console and our virtual telephone number and SMS-receiving services (together, the "Service").

Tripbooking Inc is the data controller (in the terminology of the Malaysian Personal Data Protection Act 2010, as amended, the "PDPA") of the personal data described in this Policy. This Policy forms part of, and uses the defined terms in, our Terms of Service.

The most important thing to understand about this Service: the text messages ("Messages") that arrive at a Number you lease from us—including one-time passcodes and verification codes—are received, stored and displayed by our systems. Section 3 explains exactly how we handle them. Please read it.

By creating an account you consent to the collection, use, disclosure and cross-border transfer of your personal data as described in this Policy. Where the law requires a separate consent (for example for cross-border transfer or marketing), we will ask for it separately.

1. Personal Data We Collect

1.1 Account data. Email address, password (stored only as a salted hash), display name (optional), language and display preferences, and the date your account was created.

1.2 Identity-verification data (only when we request it). Under Section 1.5 of the Terms we may require you to verify your identity. If we do, we (or a verification provider acting for us) collect the information you submit, which may include your full name, date of birth, nationality, residential address, an image of a government-issued identity document, a selfie or liveness check, and the result of the verification. We only collect this when we decide verification is necessary; most users are never asked.

1.3 Order and payment data. Order number, the Number and plan purchased, term, price, currency, tax applied, order status, and the date and time of each order and renewal. Payments are processed by Stripe. We receive from Stripe a customer identifier, the card brand, the last four digits, expiry month and year, billing country and postcode, and the outcome of each payment and any dispute. We do not receive or store your full card number or security code.

1.4 Numbers and Messages. The Numbers allocated to your account, their country, term, status (active, in Grace Period, recycled) and any label or note you add to a Number. For each Message received by a Number: the sender's number or sender ID, the date and time of receipt, and the full text content of the Message (which will typically include verification codes, account names or other information sent by the sender).

1.5 Technical and usage data. IP address, approximate location derived from IP address, device type, operating system, browser type and version, screen size, language settings, referring URL, the pages and features you use, the time and date of each visit and action, login history, and error logs. We collect this using server logs, cookies and similar technologies (see Section 10).

1.6 Support data. The content of emails, chat messages, support tickets and attachments you send us, the Number or order they relate to, and our notes about the request.

1.7 Fraud- and abuse-prevention data. Risk scores and signals generated by Stripe (including Stripe Radar) and by our own systems, records of suspected or confirmed violations of our Terms, and information received from Carriers, payment providers or Third-Party Services about abuse associated with your account or Numbers.

1.8 Communications preferences. Whether you have agreed to receive marketing from us and any opt-out you record.

We do not knowingly collect personal data from anyone under 18 (Section 11), and we do not request sensitive personal data (such as health, religious or political information) unless it appears in an identity document you provide for verification.

2. How We Use Personal Data

We do not sell personal data. We do not use the content of your Messages for advertising, for profiling you, or to train models.

3. How We Handle Message Content

Because Messages often contain verification codes that can unlock accounts elsewhere, we treat them as the most sensitive data in the Service.

3.1 What we do automatically. Our systems receive each Message from the Carrier, store it, associate it with your account and display it in your console. We may run automated checks on Messages (for example to detect spam, patterns associated with fraud, or use prohibited by our Terms). These checks do not involve a person reading your Messages.

3.2 Who at Tripbooking Inc can see Message content. Access to Message content is limited to a small number of authorised personnel, is protected by role-based access controls, and is logged. A person at Tripbooking Inc will view the content of your Messages only when:

(a) you ask us for help with a specific Number or Message and viewing it is necessary to assist you; (b) we are investigating a suspected violation of our Terms or applicable law, or responding to an abuse report from a Carrier, a payment provider or a Third-Party Service; (c) we are required to do so by law, a court order, or a lawful request from a regulator or law-enforcement agency; or (d) it is strictly necessary to diagnose or fix a fault in the Service.

We do not otherwise read your Messages.

3.3 How long Messages are kept. Messages are kept for as long as the Number is allocated to your account (including the Grace Period). You can delete individual Messages from your console at any time, and deleted Messages are removed from our active systems promptly and from backups within thirty (30) days. When a Number is recycled, or when your account is closed, all stored Messages for that Number are deleted from our active systems within thirty (30) days and from backups within a further thirty (30) days, unless a legal hold, investigation or dispute requires us to keep specific Messages for longer.

3.4 Messages that arrive during the Grace Period. Messages sent to a Number during the Grace Period are not delivered to your console and are not stored for you. They are discarded.

3.5 Recycled Numbers. Before a recycled Number is allocated to a new user, all Messages stored for the previous holder are removed from the new user's view and deleted under Section 3.3. However, we cannot stop senders from continuing to send messages to a Number after it has been recycled. Messages that arrive after re-allocation are received by, and displayed to, the new holder. We will never forward or disclose such Messages to the previous holder, and we require the new holder not to use them.

3.6 Metadata. Message metadata (sender number, timestamp, Number, volume) is retained in our logs for the period in Section 6 even after Message content is deleted, because it is needed for billing, fraud prevention and responding to lawful requests.

4. Who We Share Personal Data With

We disclose personal data only as described below. Each recipient is permitted to use the data only for the purpose for which we share it, and we require our service providers to protect it under written terms.

4.1 Carriers and number providers. The licensed telecommunications carriers and number providers from which we source Numbers necessarily route every Message to a Number and therefore handle the sender number, the Message content and the Number. They are located in the country that issues the Number (currently the United States and the United Kingdom) and in other countries where they operate, and may be required by their own regulators to keep records. Where a Carrier or its regulator requires it—for example in response to an abuse report or a legal request in the issuing country—we may also provide them with your account identifier, verification data, IP and device logs, and order records.

4.2 Stripe. Stripe, Inc. and its affiliates process your payments and receive the payment data described in Section 1.3 together with your email address, IP address and device data for fraud prevention. Stripe acts as an independent controller of that data under its own privacy policy.

4.3 Identity-verification providers. If we require verification, the provider we use will receive the data you submit and return the result to us.

4.4 Hosting, infrastructure and tools. Cloud and server hosting providers (our primary servers are located in the United States), content-delivery and DDoS-protection providers, email-delivery providers, customer-support ticketing and chat tools, error-monitoring and analytics tools, and backup providers.

4.5 Our personnel, affiliates and contractors. Employees and contractors who operate, support and secure the Service, including customer-support and engineering staff, under confidentiality obligations and subject to the access restrictions in Section 3.2. Some of these individuals and affiliated companies are located outside Malaysia.

4.6 Authorities, courts and regulators. Law-enforcement agencies, courts, regulators (including telecommunications and data-protection regulators) and government authorities in Malaysia, in the country that issues your Number, or elsewhere, where we are required by law to do so, where we receive a lawful request, subpoena or order, or where we reasonably believe disclosure is necessary to prevent fraud or serious harm, protect the rights, property or safety of any person, or enforce our Terms. We may do so without notifying you where the law prohibits notice or where notice would prejudice an investigation or endanger a person.

4.7 Third-Party Services and payment networks. Where an abuse report or payment dispute requires it, we may confirm to the Third-Party Service, card network or issuer concerned whether a Number or transaction is associated with an account, and provide the records needed to resolve the matter.

4.8 Professional advisers. Lawyers, auditors, accountants and insurers, under professional confidentiality.

4.9 Business transfers. A buyer, successor or investor in connection with any merger, acquisition, financing, reorganisation or sale of all or part of our business, in which case this Policy will continue to apply to your data.

4.10 With your direction. Any other person to whom you ask us to disclose data.

5. International Transfers

Our servers are located in the United States, our Carriers are located in the United States and the United Kingdom, and our other service providers, affiliates and personnel are located in various countries. Your personal data will therefore be transferred to, stored and processed in countries other than the one in which you are located, and those countries may not provide the same level of data protection as your own.

Where the PDPA or another applicable law requires it, we rely on your express consent to such transfers (which we obtain through a separate checkbox when you create your account), on the transfer being necessary to perform our contract with you (for example routing Messages through the Carrier that issued your Number), and on written contractual commitments from recipients to protect your data to a standard consistent with this Policy and applicable law. You may withdraw consent to international transfer at any time by closing your account; we cannot provide the Service without transferring data to the Carriers and hosting providers described above.

6. How Long We Keep Personal Data

When a retention period ends we delete or irreversibly anonymise the data. Data in encrypted backups is overwritten on the backup rotation cycle, which does not exceed thirty (30) days.

7. Security

We protect personal data using measures appropriate to its sensitivity, including encryption of data in transit (TLS) and at rest, salted hashing of passwords, role-based access control with the principle of least privilege, logging and review of access to Message content, network segmentation, firewalling and DDoS protection, regular patching, and confidentiality obligations on personnel and contractors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a personal-data breach that is likely to cause harm to you, we will notify the Personal Data Protection Commissioner and you as required by the PDPA and any other applicable law, and will tell you what happened and what we recommend you do.

You can reduce your own risk by using a strong, unique password, deleting Messages you no longer need, keeping track of which accounts are tied to each Number, and removing a Number from any Third-Party Service account before the Number expires.

8. Your Rights

Subject to the conditions and exceptions in the PDPA and other applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy. We may charge a prescribed fee where the law permits.
• Correct personal data that is inaccurate, incomplete, misleading or out of date. You can update most account data directly in the console.
• Withdraw consent to processing that is based on your consent, including by closing your account. Withdrawal does not affect processing already carried out and may mean we cannot continue to provide the Service.
• Limit processing of your personal data, including by requiring us to stop processing data that is likely to cause damage or distress to you or another person.
• Object to direct marketing at any time, by using the unsubscribe link in any marketing email or by adjusting your preferences in the console. Service communications about your account and Numbers are not marketing and will continue while you hold an account.
• Data portability: receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format, where technically feasible.
• Delete your account and the data in it, subject to the retention periods in Section 6 that are required by law or for the purposes stated there.
• Request human review of any decision that is based solely on automated processing and that significantly affects you (for example an automated fraud block), by contacting us.

To exercise any right, email [[email protected]] from the email address registered to your account. We may ask you to verify your identity before acting on a request. We aim to respond within twenty-one (21) days as required by the PDPA, and will tell you if we need longer or if we are unable to comply, and why.

If you are not satisfied with how we handle your personal data or your request, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi) or to the data-protection authority in your own country.

9. Additional Information for Users in the EEA, United Kingdom and Switzerland

If the EU/UK General Data Protection Regulation or Swiss data-protection law applies to you, the following also applies.

Legal bases. We process your personal data on the following bases: performance of our contract with you (account, Numbers, Messages, payments, support, service communications); our legitimate interests (securing the Service, preventing fraud and abuse, enforcing our Terms, improving the Service, and defending claims), which we have balanced against your rights; compliance with legal obligations (record-keeping, responding to lawful requests, sanctions screening); and your consent (marketing, non-essential cookies, and where we rely on consent for international transfers).

International transfers. When we transfer your data outside the EEA, the UK or Switzerland to countries not recognised as providing adequate protection, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), your explicit consent, or the necessity of the transfer for the performance of our contract with you. You may request a copy of the relevant safeguards.

Additional rights. In addition to the rights in Section 8, you have the right to object to processing based on legitimate interests, the right to restriction of processing, the right to erasure, and the right to lodge a complaint with your local supervisory authority. We are not required to appoint a representative in the EEA or UK unless the relevant thresholds apply; if we do, their details will be provided here.

10. Cookies and Similar Technologies

We use strictly necessary cookies to keep you signed in, remember your language and theme preferences, and secure the Service; these cannot be switched off. With your consent where required, we may also use analytics cookies to understand how the Service is used. We do not use advertising cookies. Stripe sets its own cookies on checkout pages for fraud prevention. You can control cookies through your browser settings; disabling necessary cookies will prevent you from using the console.

11. Children

The Service is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has created an account, contact us at [[email protected]] and we will delete the account and its data.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new "Last updated" date and, for material changes, notify you by email to your account address or by a notice in the console before the change takes effect. Where a change requires your consent under applicable law, we will ask for it.

13. Contact

Data controller: Tripbooking Inc

Privacy and data-protection requests: [[email protected]] Data Protection Officer: [name / [email protected]] General support: [[email protected]]