Privacy notice

1. Who we are

Preda Agency Sdn. Bhd. (SSM no. 202601014225), which owns ArkibDigital.com, is the data user responsible for your personal data. For anything about privacy, contact us by email hello@arkibdigital.com or WhatsApp 016-620 9028.

2. What we collect

• What you fill in: your name, email, phone number (WhatsApp) and answers to any extra questions on the order form.
• Order details: products, prices, dates, how you paid and the Stripe or CHIP payment reference. Your card number and banking details are handled by Stripe or CHIP and never reach us. For card payments we keep a code from Stripe that shows whether the same card was used before (never the card number), to spot fraud through affiliate links.
• Technical details: IP address, browser and device type, the page you bought on, and ad identifiers such as Meta cookies (_fbp, _fbc) and UTM tags.
• Your town, state and country when you pay, worked out from your IP address.
• Account use: sign-in records, module pages read, boxes ticked, PDF downloads, and which parts of Rak Saya you open or press each day (the gallery, offers and the Affiliate tab, for example), without the time or device.
• Records you keep in tools inside a module, such as sales, costs or orders. We keep them in your account so they're there when you open the module on another phone. Our admin only sees how much space they take, not what's in them.
• If you choose to sign in with Google: your name, email address, profile picture and Google account identifier, which Google gives us with your permission. We use them only to recognise your account and sign you in, never for ads. We never receive your Google password and we don't access Gmail, Drive, contacts or any other Google data.
• Messages you send us by email or WhatsApp. On WhatsApp: your phone number and WhatsApp name, the messages, pictures and voice notes you send, and the text of those voice notes. We match your number with the phone number on orders so we can help with your order; we only tell you the product names, order numbers, dates and the email half hidden, and the access email is only ever sent again to the email on the order.
• Messages you write in the chat on our brand sites, the page you wrote from, your country (worked out from your IP address) and the ad tags that brought you to the site. Your browser keeps a random code so the same chat opens again; we keep only a hash of that code, never the code itself. If you agree in the chat, the name and WhatsApp number or email you give so our team can get back to you about your question (never for marketing). If you buy in the same browser after chatting, your order number is linked to that chat, so our team can see you've bought when they help you.
• Messages you write in the Help chat in Rak Saya. The chat is kept in your account so it's the same on every device, and our team sees your name, email and orders when they help you.
• How our brand sites are used: which pages are opened, and whether the order form is seen, started and the pay button pressed. We keep counts only, never who visited. Your browser remembers which steps were already counted that day, so each person is counted once a day.
• On brands that use Microsoft Clarity: recordings of how pages on that brand's site are scrolled, clicked and read, and heatmaps made from them. The order form, the order card on the thank-you page and the chat are hidden from recordings, so what you type there isn't recorded.
• If you join the affiliate program: your affiliate name, link name, phone number, the name you typed as your signature, when you signed and the IP address and browser at that moment, how many clicks your links get, and your commission. Before your first payout: your bank, account number and the account holder's name. If you're paid as yourself: your full name and IC number, and a photo of the front of your IC. If you're paid as a business: the business's name, its SSM registration number and a copy of its SSM certificate, and for an enterprise, its owner's name, IC number and IC photo. The IC and account numbers are kept locked (only their last 4 digits can be read), the IC photo and SSM certificate are never shown again to anyone but the ArkibDigital.com owner, and every time the owner opens the full numbers, the photo or the certificate, it's recorded. An SSM number is public and kept as it is. For each payout we keep the amount, the date, the bank's transaction ID and the commission it paid.
• If you press pay for a product that isn't open yet (a waiting list): your name, email, phone number, answers to extra questions, the package and bumps you picked, the way to pay you picked (never a card number or banking details, which aren't asked for), the amount you would have paid, your marketing consent, the page, UTM tags, the affiliate link that brought you, and your town, state and country (worked out from your IP address). No payment is taken and no order is made. Your browser tells the brand's test Meta Pixel that you started the form, pressed pay and made that test purchase, with its amount.
• If you buy through an affiliate's link: the link is kept in your browser for 30 days. That affiliate sees the order number, products, date and amount paid only, never your name, email or phone number.

3. Why we use it

• To process your order and payment.
• To give you access to your products, and send access emails, receipts and sign-in codes.
• To keep a customer record and help you by email, WhatsApp, the chat on our brand sites or the Help chat in Rak Saya. Chats and WhatsApp are answered first by an AI assistant, and our team steps in when needed.
• To prevent fraud and misuse, such as stolen-card attempts.
• To measure how our ads perform, through the Meta Pixel and Conversions API. Meta is told when you open a brand page, start filling in the order form, press pay and buy, with the products picked and the amount. When you press pay, even if the payment doesn't go through, and when you buy, your email, phone number and name are sent as a hash, not as plain text.
• To improve our brand sites: seeing where visitors stop, through our own counts and Microsoft Clarity.
• To show recent buyers on our brand sites: only your first name, your town or state, and how long ago you bought, such as "Aminah just bought from Arkib Digital · Kota Bharu · 3 hours ago". We never show your full name, email or phone number. If you'd rather not be shown, contact us and we'll take you off.
• To keep accounting and tax records as the law requires.
• To mark the PDF you download with your name, email and order number on every page, so a copy shared without permission can be traced to its buyer.
• To send you tips and offers, only if you tick the consent box on the order form.
• Waiting lists: to test whether people want a product before it's ready, and to send one email when it opens, only if you ticked the consent box.
• Payments that didn't finish: if you press pay but the payment doesn't reach us within 30 minutes, we send one email only about that payment, with what you picked and a link to finish paying. The link fills the order form in again with your name, email, phone number and picks for 7 days, and we keep only a hash of it. This email is about a payment you started yourself, not marketing, so it doesn't depend on the consent box.

Your name, email and phone number are needed to buy. Without them we can't deliver your access or help you. Marketing consent is optional.

4. Who we share it with

We never sell your data. We share it only with the providers that help us run this service:

• Stripe and CHIP (payments: CHIP receives your name and email with the order when you pay through it);
• Convex (database, servers in Ireland);
• Vercel (website hosting);
• Resend (email delivery);
• Anthropic (the AI that answers the chat on brand sites and in Rak Saya: it receives your chat messages and our product information, including the names of the products you own when you ask in Rak Saya, and on WhatsApp your WhatsApp name, the pictures you send and the orders on your number as above, never your IP address, phone number or your browser's code, and doesn't use them to train its models);
• OpenAI (turning WhatsApp voice notes into text, when switched on: it receives the voice note's recording only);
• Google (sign-in with Google, only if you choose it);
• Meta Platforms (ad measurement);
• if you came to a brand site through an affiliate's link and that affiliate set up their own Meta Pixel or Google Ads tag: Meta or Google, for the affiliate's ad account, get that you opened the page and, if you buy, the amount, currency and order number. The affiliate's tags run in a separate frame that can't read the page, so your name, email and phone number never reach them;
• Microsoft (Microsoft Clarity, recordings and heatmaps of the brand sites that use it, without what you type in the order form or the chat);
• our customer record and messaging system, which holds your name, email, phone number and the products you bought. Tips and offers from it go only to buyers who agreed to marketing.

We may also disclose data when the law or the authorities require it.

5. Transfers outside Malaysia

Some of our providers store or process data outside Malaysia, including in the European Union and the United States. We choose providers with comparable data protection safeguards, as the PDPA allows.

6. Cookies

We use cookies that are needed for signing in, remembering your language, linking your payment to the thank-you page, and opening your chat on a brand site again (for 30 days). Our brand sites also use the Meta Pixel to measure ads, and some use Microsoft Clarity to understand how pages are used. You can block cookies in your browser settings. Blocking the Meta Pixel or Clarity doesn't affect your purchase.

7. How long we keep it

• Orders and receipts: 7 years, for accounting and tax.
• Your account and access: as long as you own products with us.
• Marketing consent: until you withdraw it.
• The copy of a PDF marked with your details: up to 30 days after your last download, or until your access ends.
• Records in module tools: as long as you own the product. You can delete them in the tool itself at any time, or ask us to delete them all. If your access ends, they're deleted 90 days later.
• Chat messages on brand sites, in Rak Saya and on WhatsApp: 90 days after the last message, then deleted, with your WhatsApp number. WhatsApp pictures and voice notes: 90 days. You can ask us to delete your chat sooner.
• Sign-in codes: 10 minutes.
• Waiting lists: 180 days after you last pressed pay, then deleted. You can ask us to take you off sooner.
• Affiliate, commission and payout records: while you're an affiliate, and 7 years after your last payout for tax records.
• The photo of your IC and the SSM certificate: while you're an affiliate, and 1 year after your affiliate account closes. An old file is deleted as soon as you send a new one, or when you change how you're paid and it's no longer needed.

8. Security

Data travels over encrypted connections. Access tokens are stored as hashes, and only team members who need buyer data can see it. If a data breach affects you, we'll tell you and the authorities as the law requires.

9. Your rights

Under the PDPA, you can:

• ask for a copy of your personal data;
• correct data that's wrong;
• withdraw marketing consent at any time;
• ask us to limit how we process your data;
• ask for your data to be transferred, where this applies.

Contact us by email hello@arkibdigital.com or WhatsApp 016-620 9028. We'll reply within 21 days. You can also complain to Malaysia's Personal Data Protection Commissioner.

10. Marketing

We only send tips and offers if you tick the consent box on the order form. The box is never ticked for you. To stop, tap the unsubscribe link in our emails, or tell us by email or WhatsApp.

11. Children

Our products are for adults aged 18 and over.

12. Changes to this notice

We may update this notice. The date of the latest update is at the top of this page. If the Bahasa Melayu and English versions differ, the Bahasa Melayu version applies.