Polisi Privasi (Privacy Policy) — SifuContent Skills

• terms_version: v3
• Tarikh berkuat kuasa: 24 September 2026 (dikemas kini 19 Oktober 2026)
• Pengguna data (data user): SDM Protech Supply (No. pendaftaran SSM: 002620810-V), "SifuContent Skills" ("Kami")
• Pegawai perlindungan data / hubungi: Mohd Khaidin (Pemilik), support@sifucontent.com, 017-396 5475, alamat berdaftar SSM (atas permintaan)

Notis ini dibuat menurut seksyen 7 Akta Perlindungan Data Peribadi 2010 (PDPA) dan disediakan dalam BM dan English. Ia khusus untuk SifuContent Skills dan berasingan daripada polisi privasi Seposen.ai. / This notice is issued under section 7 of the Personal Data Protection Act 2010 (PDPA) in BM and English. It applies to SifuContent Skills only and is separate from the Seposen.ai privacy policy.

BAHAGIAN A — BAHASA MALAYSIA

1. Data yang Kami kumpul

Kami tidak menerima nombor kad penuh — ia diproses terus oleh Stripe.

1A. Threads Autopilot (pilihan)

Apabila Anda memilih untuk menyambungkan Threads, Kami menerima ID akaun Threads, nama pengguna, token akses, kebenaran dan tarikh luput token daripada Meta. Kami menyimpan data ini pada pelayan di Supabase; token akses disimpan secara disulitkan dalam Supabase Vault dan tidak dipaparkan dalam dashboard atau hasil alat AI.

Kami juga menyimpan siri dan draf Anda, teks dan pautan media imej/video, jadual dan kelulusan, susunan balasan dalam rantaian, status penerbitan, ID media/siaran yang diterbitkan dan permalink. Daripada Threads Kami menerima dan menyimpan metrik siaran: views, likes, replies, reposts, quotes dan shares. Ini digunakan untuk menerbitkan kandungan yang Anda luluskan mengikut jadual, menyambungkan bahagian rantaian sebagai balasan kepada siaran sebelumnya, memaparkan prestasi dan menyelesaikan masalah penerbitan. Ciri rantaian ini tidak bermaksud Kami membaca atau membalas semua komen orang lain secara automatik.

Meta/Threads menerima kandungan, pautan media dan permintaan API untuk sambungan, penerbitan dan insights. Semasa sambungan OAuth, kod kebenaran dan parameter state melalui halaman callback dashboard yang dihoskan oleh Cloudflare sebelum dihantar ke Supabase untuk pertukaran token. Media yang Anda pilih disediakan melalui hosting/CDN termasuk Cloudflare supaya Threads boleh mengambilnya untuk penerbitan. Apabila Anda meminta data melalui klien AI/MCP yang Anda sambungkan, klien itu menerima hasil alat yang diminta, termasuk profil akaun, siaran atau insights, dan memprosesnya mengikut polisinya sendiri. Threads Autopilot menerima kandungan daripada klien Anda atau suntingan dashboard; penerbitan berjadual tidak dengan sendirinya menghantar kandungan ke LLM pelayan. Jika Anda memilih aliran penjanaan kandungan dengan penyedia AI, input dan hasil aliran itu diproses oleh penyedia yang dipilih.

Sambungan Threads adalah pilihan. Dalam dashboard, buka tab Threads, pilih Disconnect pada kad akaun dan sahkan. Ini memadam token akses yang disimpan dan menjeda siaran berjadual; ID akaun/nama pengguna, siri, draf dan rekod penerbitan/insights kekal. Permintaan penerbitan yang sudah dihantar kepada Threads mungkin telah diproses. Pemutusan sambungan bukan pemadaman akaun atau semua data. Untuk meminta pemadaman, hubungi support@sifucontent.com dan lihat Arahan pemadaman data. Tempoh simpanan dan hak dalam seksyen 8 dan 9 terus terpakai. Siaran yang telah diterbitkan di Threads perlu diurus atau dipadam melalui Threads.

2. Tujuan

(a) Menyediakan akaun, connector dan skill; (b) memproses bayaran dan langganan; (c) sokongan pelanggan dan notis perkhidmatan; (d) atribusi rujukan dan pengiraan komisen affiliate; (e) pengesanan penipuan dan penyalahgunaan — contoh: mengesan rujukan diri melalui padanan emel/cap jari kad, dan memantau corak muat skill (bilangan, kekerapan, masa dan teks arahan) untuk mengesan eksport, penyalinan pukal atau pemasangan skill di luar perkhidmatan (Terma Perkhidmatan Fasal 5.3, 5.4). Semakan ini dibuat secara automatik dan boleh menyebabkan permintaan muat ditolak; keputusan menggantung atau menamatkan akaun disemak oleh pemilik perniagaan; (f) menambah baik produk menggunakan data penggunaan agregat; (g) mematuhi undang-undang (termasuk cukai); (h) bagi affiliate: mengesahkan identiti penerima, membuat bayaran Komisen ke akaun atas nama Anda, mencegah penipuan bayaran, dan memenuhi kewajipan cukai Kami — termasuk penyediaan Borang CP58, potongan cukai pegangan di bawah seksyen 107D Akta Cukai Pendapatan 1967 dan e-Invois (termasuk e-Invois kendiri) jika dikehendaki; (i) emel pemasaran langsung — menghantar emel mengenai produk, ciri baharu dan tawaran SifuContent Skills kepada Anda. Anda boleh berhenti menerimanya pada bila-bila masa melalui pautan "unsubscribe" dalam setiap emel tersebut; notis perkhidmatan dan emel berkaitan akaun atau bayaran tidak termasuk dan akan terus dihantar.

3. Wajib atau pilihan

Emel adalah wajib untuk membuka akaun; maklumat bil wajib untuk langganan berbayar. Tanpanya Kami tidak boleh membuka akaun atau akses berbayar. Maklumat affiliate wajib hanya jika Anda menyertai program rujukan. Maklumat bayaran dan cukai affiliate (nama, No. KP/SSM, TIN, alamat, butiran bank/DuitNow) wajib untuk menerima bayaran Komisen. Jika tidak diberi atau tidak lengkap, Kami tidak dapat membuat bayaran — Komisen anda kekal dalam baki dan dibayar sebaik maklumat lengkap diterima.

4. Pendedahan kepada pihak ketiga

Affiliate hanya menerima data agregat/pseudonim (rujukan tersamar, tarikh daftar, jenis pelan, status dan jumlah komisen) — tidak emel, nama, telefon atau penggunaan Anda. Kami tidak menjual data peribadi.

5. Kuki & parameter rujukan

Bila Anda klik link dengan ?ref=KOD, Kami menyimpan kuki/pengecam klik selama 60 hari untuk mengaitkan pendaftaran dengan affiliate. Alamat IP disimpan dalam bentuk hash, bukan teks biasa. Anda boleh memadam kuki melalui tetapan pelayar; ini hanya menjejaskan atribusi rujukan, bukan harga Anda. Kuki/pixel lain yang digunakan: Meta Pixel (untuk penjejakan iklan Facebook/Instagram) pada laman jualan dan dashboard. Tiada Google Analytics, Clarity atau PostHog digunakan setakat ini.

6. Pemindahan rentas sempadan

Penyedia seperti Supabase, Stripe, Resend dan platform AI mungkin menyimpan/memproses data di luar Malaysia. Pangkalan data Supabase Kami dihoskan di rantau Singapura (ap-southeast-1). Kami memilih penyedia dengan langkah keselamatan yang munasabah, dan pemindahan dibuat untuk melaksanakan kontrak dengan Anda.

7. Keselamatan

Akses pangkalan data dikunci (row-level security, akses melalui fungsi pelayan sahaja), sambungan disulitkan (HTTPS), dan kata laluan di-hash. Maklumat bayaran dan cukai affiliate hanya boleh diakses oleh pemilik perniagaan untuk tujuan bayaran dan cukai. Tiada sistem 100% selamat; Kami akan memaklumkan Anda dan pihak berkuasa mengikut undang-undang jika berlaku pelanggaran data.

8. Tempoh simpanan

• Data akaun & penggunaan: selama akaun aktif + 12 bulan selepas penutupan.
• Rekod bil, Komisen, bayaran dan cukai — termasuk maklumat bayaran/cukai affiliate (nama, No. KP/SSM, TIN, butiran bank/DuitNow) yang digunakan untuk bayaran: 7 tahun dari akhir tahun ia berkaitan, menurut seksyen 82 Akta Cukai Pendapatan 1967.
• Butiran bank/DuitNow yang tidak pernah digunakan untuk bayaran: dipadam dalam 12 bulan selepas penyertaan affiliate tamat.
• Log klik rujukan / hash IP: 12 bulan.

Selepas itu data dipadam atau dijadikan tanpa nama.

9. Hak Anda

Di bawah PDPA Anda berhak: (a) mengakses data peribadi Anda; (b) membetulkan data yang tidak tepat; (c) menarik balik persetujuan atau mengehadkan pemprosesan (yang mungkin menyebabkan Kami tidak dapat terus menyediakan perkhidmatan); (d) meminta pemadaman bila tidak lagi diperlukan; (e) membuat aduan kepada Jabatan Perlindungan Data Peribadi. Hubungi support@sifucontent.com. Kami akan membalas dalam 21 hari (standard PDPA s.30), tanpa fi akses. Untuk berhenti menerima emel pemasaran, klik pautan "unsubscribe" dalam emel tersebut atau hubungi support@sifucontent.com; notis perkhidmatan dan emel berkaitan akaun atau bayaran tidak boleh dihentikan selagi akaun Anda aktif.

10. Kanak-kanak

Perkhidmatan untuk pengguna berumur 18 tahun ke atas sahaja.

11. Pindaan

Kami akan memaklumkan perubahan material melalui emel/dashboard. Versi semasa ditanda dengan terms_version.

PART B — ENGLISH

1. Data We collect

We do not receive full card numbers — Stripe processes them directly.

1A. Threads Autopilot (optional)

When You choose to connect Threads, We receive Your Threads account ID, username, access token, permissions and token expiry from Meta. We store this data server-side in Supabase; the access token is stored encrypted in Supabase Vault and is not shown in the dashboard or AI tool results.

We also store Your series and drafts, text and image/video media links, schedules and approvals, reply-chain order, publishing status, published media/post IDs and permalinks. From Threads We receive and store post metrics: views, likes, replies, reposts, quotes and shares. We use this data to publish content You approve on schedule, connect chain parts as replies to the preceding post, show performance and troubleshoot publishing. Reply-chain support does not mean We automatically read or reply to all other people's comments.

Meta/Threads receives content, media links and API requests for connection, publishing and insights. During OAuth connection, the authorization code and state parameter pass through the dashboard callback page hosted by Cloudflare before being forwarded to Supabase for token exchange. Your selected media is served through hosting/CDN including Cloudflare so Threads can fetch it for publishing. When You request data through Your connected AI/MCP client, that client receives the requested tool results, including account profile, posts or insights, and processes them under its own policies. Threads Autopilot receives content from Your client or dashboard edits; scheduled publishing does not itself send content to a server-side LLM. If You select a content-generation workflow with an AI provider, that workflow's inputs and results are processed by the selected provider.

Connecting Threads is optional. In the dashboard, open the Threads tab, select Disconnect on the account card and confirm. This deletes the stored access token and pauses scheduled posts; the account ID/username, series, drafts and publishing/insights records remain. Publishing requests already sent to Threads may have been processed. Disconnecting does not delete Your account or all data. To request deletion, contact support@sifucontent.com and see Data deletion instructions. The retention periods and rights in sections 8 and 9 continue to apply. Manage or delete posts already published on Threads through Threads itself.

2. Purposes

(a) Provide Your account, connector and skills; (b) process payments and subscriptions; (c) customer support and service notices; (d) referral attribution and affiliate commission calculation; (e) fraud and abuse detection — e.g. detecting self-referral by matching email/card fingerprint, and monitoring skill-load patterns (number, frequency, timing and instruction text) to detect export, bulk copying or installing skills outside the service (Terms of Service Clauses 5.3, 5.4). These checks are automated and may cause a load request to be refused; a decision to suspend or terminate an account is reviewed by the business owner; (f) improve the product using aggregated usage data; (g) comply with law (including tax); (h) for affiliates: verify the payee's identity, pay Commission to an account in Your name, prevent payout fraud, and meet Our tax obligations — including preparing Form CP58, withholding tax under section 107D of the Income Tax Act 1967 and e-Invoicing (including self-billed e-Invoices) where required; (i) direct marketing emails — send You emails about SifuContent Skills products, new features and offers. You may opt out at any time by clicking the "unsubscribe" link in any such email; service notices and account or payment emails are not marketing and will still be sent.

3. Obligatory or voluntary

Email is obligatory to open an account; billing information is obligatory for a paid subscription. Without them We cannot open Your account or paid access. Affiliate details are obligatory only if You join the referral programme. Affiliate payout and tax details (name, IC/SSM No., TIN, address, bank/DuitNow details) are obligatory to receive Commission payouts. If they are not provided or are incomplete, We cannot make the payout — Your Commission stays in Your balance and is paid once complete details are received.

4. Disclosure to third parties

Affiliates receive aggregate/pseudonymous data only (masked reference, signup date, plan type, status and commission amount) — never Your email, name, phone or usage. We do not sell personal data.

5. Cookies & referral parameter

When You click a link with ?ref=CODE, We store a cookie/click identifier for 60 days to connect a signup to an affiliate. IP addresses are stored hashed, not in plain text. You can delete cookies in browser settings; this only affects referral attribution, not Your price. Other cookies/pixels in use: Meta Pixel (for Facebook/Instagram ad tracking) on the sales page and dashboard. No Google Analytics, Clarity or PostHog are currently used.

6. Cross-border transfer

Providers such as Supabase, Stripe, Resend and AI platforms may store/process data outside Malaysia. Our Supabase database is hosted in the Singapore (ap-southeast-1) region. We choose providers with reasonable security measures, and transfers are made to perform Our contract with You.

7. Security

Database access is locked down (row-level security, server-function access only), connections are encrypted (HTTPS), and passwords are hashed. Affiliate payout and tax details are accessible only to the business owner for payout and tax purposes. No system is 100% secure; We will notify You and the authorities as required by law if a data breach occurs.

8. Retention

• Account & usage data: while the account is active + 12 months after closure.
• Billing, Commission, payout and tax records — including affiliate payout/tax details (name, IC/SSM No., TIN, bank/DuitNow details) used for a payout: 7 years from the end of the year to which they relate, under section 82 of the Income Tax Act 1967.
• Bank/DuitNow details never used for a payout: deleted within 12 months after affiliate participation ends.
• Referral click logs / IP hash: 12 months.

Afterwards data is deleted or anonymised.

9. Your rights

Under the PDPA You may: (a) access Your personal data; (b) correct inaccurate data; (c) withdraw consent or limit processing (which may mean We cannot keep providing the service); (d) request deletion when no longer needed; (e) complain to the Personal Data Protection Department. Contact support@sifucontent.com. We will respond within 21 days (PDPA s.30 standard), with no access fee. To stop receiving marketing emails, click the "unsubscribe" link in the email or contact support@sifucontent.com; service notices and account or payment emails cannot be turned off while Your account is active.

10. Children

The service is for users aged 18 and above only.

11. Changes

We will notify material changes by email/dashboard. The current version is marked with terms_version.