This is our privacy notice under Malaysia’s Personal Data Protection Act 2010 (PDPA), the English version of section 7. Your data is handled by CeritaSaya Sdn. Bhd. (1234567-A).
- About you: your name, e-mail or WhatsApp number, and your payment and order records. For printed books, the recipient’s name, phone and delivery address. You enter card or bank details for payment on the payment gateway’s own page, and we never see them.
- About your child and family: your child’s name, age, gender and look, the names and roles of other characters, the story you pick or write, and photos if you use them.
- For manual refunds or Rakan CeritaSaya: bank account details for the transfer. For Rakan, also your name or social media account and your channels.
- Technical details: IP address, browser details and cookies, to keep you signed in, save your story draft, record Rakan links and measure our ads.
Almost all of this comes from you. Payment status comes from the payment gateway, and technical details from your browser.
- Writing and illustrating your book with the help of AI.
- Your account, sign-in, payments, receipts and refunds.
- Printing and delivering printed books.
- Sending book updates and Peringatan (reminders) by WhatsApp or e-mail.
- Helping you when you contact us, checking generation problems, and preventing abuse.
- Measuring our ads and working out Rakan commission.
We don’t sell your data.
An e-mail or WhatsApp number, your child’s name and the story details are required to make a book, and an address is required for a printed book. Without them we can’t make or deliver your book. Photos, other characters and Peringatan are optional.
- Photos are optional. You can choose your child’s look without one.
- Photos of your child and other characters are only used to draw the characters. They are sent to the AI provider that draws them, and never to an ad platform or to a Rakan.
- Photos are deleted when the book is finished, or after 30 days if the book is left unfinished. Copies in our technical generation records are deleted at the same time.
- A real photo you choose for a printed book’s back cover goes into the print file. It is deleted when the book arrives, or at the latest 30 days after the file is handed to the printer.
- Make sure you have the right to use the photos and details you give, including photos of other family members. You give your child’s details as their parent or guardian.
We share data only with the companies that help us run CeritaSaya, and only what they need:
- AI providers: your child’s name and the story and character details to write the story, and photos to draw the characters. The book’s pictures are also sharpened for print (the drawings only, never photos).
- Hosting and storage providers that run our website, database, files and AI jobs.
- Sign-in, payment gateway and messaging providers (WhatsApp and e-mail). The payment gateway receives your name and e-mail.
- The printer and courier: the recipient’s name, phone, address and the print files.
- Meta, for ad measurement: the pages you open and when you sign up, start paying and buy, with the amount, plus your e-mail and phone number hashed (one-way encrypted), IP address, browser details and Meta cookie. If you came through a Rakan CeritaSaya link or Kupon, the same goes to that Rakan’s own Meta Pixel. Your child’s name, photos and story are never sent to Meta or to a Rakan. Your browser also loads the site’s fonts from a font provider.
- Anyone you give a share link to can read that book, including your child’s name and pictures.
- Authorities, when the law requires it.
Some of these companies store or process data outside Malaysia, for example in Singapore, Australia and the United States. It is sent there only for the purposes above.
- Your account, books and stories: for as long as you have an account, so your books stay readable and shareable.
- Photos: as described above.
- A story draft before payment: in your browser only, for at most 30 days.
- Technical generation records (AI instructions and results, including names and stories): at most 30 days, to check problems.
- Ad measurement records in our systems: at most 90 days.
- Payment and order records: as long as the law requires, for example for tax.
- Ask for a copy of your data, or ask us to correct anything wrong. You can change your name yourself in Akaun.
- Turn off Peringatan in Akaun, or with the “Tutup di sini” link in a Peringatan e-mail.
- Choose a look without a photo, or change and remove photos before the story is written.
- Withdraw your consent, or ask us to delete your account and books. Once deleted, the books and their share links no longer open. Records the law requires us to keep stay.
- Limit ads based on this activity in your Facebook or Instagram ad settings, or block third-party cookies in your browser.
For any request, question or complaint about your personal data, WhatsApp us at 012-345 6789. We reply within 21 days. You can also complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi).
Photos and files are kept in private storage, and links to them expire on their own. Only the people on our team who need to can see your data, for example to help when you ask. If a data breach could harm you, we will tell you and the Personal Data Protection Commissioner.
