Polisi Privasi (Privacy Policy) — SifuContent Skills
⚠️ DRAFT by adil-legal-dept — bukan nasihat undang-undang — perlu pengesahan peguam (task #1948) sebelum dilancar. Notis ini dibuat menurut seksyen 7 Akta Perlindungan Data Peribadi 2010 (PDPA). Berasingan daripada polisi privasi Seposen.ai.
- terms_version:
v1 - Tarikh berkuat kuasa: 24 September 2026
- Pengguna data (data user): SDM Protech Supply (No. pendaftaran SSM: 002620810-V), "SifuContent Skills" ("Kami")
- Pegawai perlindungan data / hubungi: Mohd Khaidin (Pemilik), mohdkhaidin@gmail.com, 017-396 5475, alamat berdaftar SSM (atas permintaan)
Notis ini disediakan dalam BM dan English menurut amalan PDPA.
BAHAGIAN A — BAHASA MALAYSIA
1. Data yang Kami kumpul
| Kategori | Contoh | Sumber |
|---|---|---|
| Akaun | Emel, kata laluan (disimpan secara hash), nama jika diberi | Anda |
| Bil | Status langganan, pelan, ID pelanggan Stripe, 4 digit akhir kad, cap jari kad (card fingerprint) | Stripe |
| Penggunaan | Rekod skill yang dijalankan (skill_runs), sesi yang Anda simpan, kandungan produk/kempen yang Anda masukkan | Connector & dashboard |
| Rujukan | Kod rujukan (?ref=), hash alamat IP, user-agent pelayar, parameter UTM, tarikh klik | Pelayar Anda |
| Affiliate (jika menyertai) | Nama penuh, butiran bank/DuitNow, No. KP/SSM/cukai untuk pelaporan cukai | Anda |
Kami tidak menerima nombor kad penuh — ia diproses terus oleh Stripe.
2. Tujuan
(a) Menyediakan akaun, connector dan skill; (b) memproses bayaran dan langganan; (c) sokongan pelanggan dan notis perkhidmatan; (d) atribusi rujukan dan pengiraan komisen affiliate; (e) pengesanan penipuan — contoh: mengesan rujukan diri melalui padanan emel/cap jari kad; (f) menambah baik produk menggunakan data penggunaan agregat; (g) mematuhi undang-undang (termasuk cukai).
3. Wajib atau pilihan
Emel dan maklumat bil adalah wajib untuk menggunakan perkhidmatan. Tanpanya Kami tidak boleh membuka akaun atau akses. Maklumat affiliate wajib hanya jika Anda menyertai program rujukan.
4. Pendedahan kepada pihak ketiga
| Pihak | Tujuan |
|---|---|
| Supabase | Pangkalan data & pengesahan (hosting) |
| Stripe | Pemprosesan bayaran |
| Resend | Penghantaran emel |
| Platform AI pilihan Anda (contoh: OpenAI/ChatGPT, Anthropic/Claude) | Kandungan skill dan input Anda dihantar ke AI yang Anda sambungkan; mereka memproses mengikut polisi mereka sendiri |
| Pihak berkuasa | Bila dikehendaki undang-undang (contoh: LHDN) |
| Hosting web/CDN | Cloudflare Pages |
Affiliate hanya menerima data agregat/pseudonim (rujukan tersamar, tarikh daftar, jenis pelan, status dan jumlah komisen) — tidak emel, nama, telefon atau penggunaan Anda. Kami tidak menjual data peribadi.
5. Kuki & parameter rujukan
Bila Anda klik link dengan ?ref=KOD, Kami menyimpan kuki/pengecam klik selama 60 hari untuk mengaitkan pendaftaran dengan affiliate. Alamat IP disimpan dalam bentuk hash, bukan teks biasa. Anda boleh memadam kuki melalui tetapan pelayar; ini hanya menjejaskan atribusi rujukan, bukan harga Anda. Kuki/pixel lain yang digunakan: Meta Pixel (untuk penjejakan iklan Facebook/Instagram) pada laman jualan dan dashboard. Tiada Google Analytics, Clarity atau PostHog digunakan setakat ini.
6. Pemindahan rentas sempadan
Penyedia seperti Supabase, Stripe, Resend dan platform AI mungkin menyimpan/memproses data di luar Malaysia. Pangkalan data Supabase Kami dihoskan di rantau Singapura (ap-southeast-1). Kami memilih penyedia dengan langkah keselamatan yang munasabah, dan pemindahan dibuat untuk melaksanakan kontrak dengan Anda.
7. Keselamatan
Akses pangkalan data dikunci (row-level security, akses melalui fungsi pelayan sahaja), sambungan disulitkan (HTTPS), dan kata laluan di-hash. Tiada sistem 100% selamat; Kami akan memaklumkan Anda dan pihak berkuasa mengikut undang-undang jika berlaku pelanggaran data.
8. Tempoh simpanan
- Data akaun & penggunaan: selama akaun aktif + 12 bulan selepas penutupan.
- Rekod bil, komisen dan cukai: 7 tahun untuk keperluan perakaunan/cukai. [ACCOUNTANT: sahkan tempoh simpanan rekod bil/cukai sebenar yang diperlukan]
- Log klik rujukan / hash IP: 12 bulan.
Selepas itu data dipadam atau dijadikan tanpa nama.
9. Hak Anda
Di bawah PDPA Anda berhak: (a) mengakses data peribadi Anda; (b) membetulkan data yang tidak tepat; (c) menarik balik persetujuan atau mengehadkan pemprosesan (yang mungkin menyebabkan Kami tidak dapat terus menyediakan perkhidmatan); (d) meminta pemadaman bila tidak lagi diperlukan; (e) membuat aduan kepada Jabatan Perlindungan Data Peribadi. Hubungi mohdkhaidin@gmail.com. Kami akan membalas dalam 21 hari (standard PDPA s.30), tanpa fi akses.
10. Kanak-kanak
Perkhidmatan untuk pengguna berumur 18 tahun ke atas sahaja.
11. Pindaan
Kami akan memaklumkan perubahan material melalui emel/dashboard. Versi semasa ditanda dengan terms_version.
PART B — ENGLISH
1. Data We collect
| Category | Examples | Source |
|---|---|---|
| Account | Email, password (stored hashed), name if provided | You |
| Billing | Subscription status, plan, Stripe customer ID, card last 4 digits, card fingerprint | Stripe |
| Usage | Skill run records (skill_runs), sessions You save, product/campaign content You enter | Connector & dashboard |
| Referral | Referral code (?ref=), hashed IP address, browser user-agent, UTM parameters, click date | Your browser |
| Affiliate (if joined) | Full name, bank/DuitNow details, IC/SSM/tax No. for tax reporting | You |
We do not receive full card numbers — Stripe processes them directly.
2. Purposes
(a) Provide Your account, connector and skills; (b) process payments and subscriptions; (c) customer support and service notices; (d) referral attribution and affiliate commission calculation; (e) fraud detection — e.g. detecting self-referral by matching email/card fingerprint; (f) improve the product using aggregated usage data; (g) comply with law (including tax).
3. Obligatory or voluntary
Email and billing information are obligatory to use the service; without them We cannot open Your account or access. Affiliate details are obligatory only if You join the referral programme.
4. Disclosure to third parties
| Party | Purpose |
|---|---|
| Supabase | Database & authentication (hosting) |
| Stripe | Payment processing |
| Resend | Email delivery |
| Your chosen AI platform (e.g. OpenAI/ChatGPT, Anthropic/Claude) | Skill content and Your inputs go to the AI You connect; they process under their own policies |
| Authorities | When required by law (e.g. LHDN) |
| Web hosting/CDN | Cloudflare Pages |
Affiliates receive aggregate/pseudonymous data only (masked reference, signup date, plan type, status and commission amount) — never Your email, name, phone or usage. We do not sell personal data.
5. Cookies & referral parameter
When You click a link with ?ref=CODE, We store a cookie/click identifier for 60 days to connect a signup to an affiliate. IP addresses are stored hashed, not in plain text. You can delete cookies in browser settings; this only affects referral attribution, not Your price. Other cookies/pixels in use: Meta Pixel (for Facebook/Instagram ad tracking) on the sales page and dashboard. No Google Analytics, Clarity or PostHog are currently used.
6. Cross-border transfer
Providers such as Supabase, Stripe, Resend and AI platforms may store/process data outside Malaysia. Our Supabase database is hosted in the Singapore (ap-southeast-1) region. We choose providers with reasonable security measures, and transfers are made to perform Our contract with You.
7. Security
Database access is locked down (row-level security, server-function access only), connections are encrypted (HTTPS), and passwords are hashed. No system is 100% secure; We will notify You and the authorities as required by law if a data breach occurs.
8. Retention
- Account & usage data: while the account is active + 12 months after closure.
- Billing, commission and tax records: 7 years for accounting/tax. [ACCOUNTANT: confirm actual required retention period for billing/tax records]
- Referral click logs / IP hash: 12 months.
Afterwards data is deleted or anonymised.
9. Your rights
Under the PDPA You may: (a) access Your personal data; (b) correct inaccurate data; (c) withdraw consent or limit processing (which may mean We cannot keep providing the service); (d) request deletion when no longer needed; (e) complain to the Personal Data Protection Department. Contact mohdkhaidin@gmail.com. We will respond within 21 days (PDPA s.30 standard), with no access fee.
10. Children
The service is for users aged 18 and above only.
11. Changes
We will notify material changes by email/dashboard. The current version is marked with terms_version.