Privacy Policy

1. Introduction

PintarPrep is operated by NetAI Sdn Bhd (1431413-D) ("we", "us"). This Privacy Policy explains what personal data we collect when you use the PintarPrep website, applications and related services (the "Service"), why we collect it, who we share it with, and the choices and rights you have. It is our notice under the Personal Data Protection Act 2010 ("PDPA") of Malaysia, and we process personal data in accordance with the PDPA.

2. Information We Collect

Information you give us

• Full name and display name
• Email address, or a username for a child account created by a guardian
• Password (stored only in hashed form)
• Date of birth and school (for student profiles)
• Phone number and profile photo (optional)
• For guardians, the details of the children you add
• What you write and upload: answers, drawings, discussion posts and messages to us
• Billing details (your card is handled by Stripe; we do not see or store the card number)

Information collected as you use the Service

• Learning activity: exam attempts, answers and marks, practice progress, reading progress and time spent
• IP address and approximate location, browser and device type, and operating system
• Sign-in sessions and the pages and features you use

Information from others

A guardian may give us their child's details when creating the child's account, and teachers add marks and feedback to students' work.

3. What You Must Provide

To create an account we need a name, an email address (or, for a child account, a username), a password and, for a student, a date of birth. Without these we cannot create the account. Everything else is optional, though some features may not work without it — for example, we cannot send receipts without an email address.

4. How We Use Your Information

• To create and run your account and provide the Service
• To mark answers, give feedback and show progress to you, your teachers and your guardians
• To process subscriptions and payments, and send receipts
• To send service messages such as verification codes, reminders and account notices
• To answer your questions and provide support
• To understand how the Service is used and improve it
• To keep the Service secure and prevent fraud and misuse
• To meet our legal obligations

5. Artificial Intelligence

Written answers (essays, short answers and fill-in-the-blank answers) are sent, together with the question, to an AI provider — Anthropic or OpenAI — to be marked and to receive feedback. We also use these providers to draft explanations and to read textbooks and exam papers uploaded by our staff. We send only what the task needs: the question and the answer, never your name, email address or other contact details. A teacher may review or change any AI mark.

6. Who We Share It With

We do not sell, rent or trade your personal data. We share it only as follows:

• Teachers and administrators of your classes, who see your work and progress as needed for teaching.
• Guardians linked to a student, who see the child's progress and account details.
• Service providers who run parts of the Service for us and may use the data only for that: Stripe (payments), Zoho ZeptoMail (email delivery), DigitalOcean (hosting and file storage), Cloudflare (network delivery and security), Anthropic and OpenAI (AI marking and drafting), and Google Analytics (usage statistics).
• Authorities and others when the law requires it, or when needed to enforce our Terms or protect the rights, property or safety of our users, the public or us.

7. Transfers Outside Malaysia

Some of our providers store or process data outside Malaysia: files are stored in Singapore, and our payment, email, network, AI and analytics providers may process data in the United States and other countries. By using the Service you agree to these transfers. We choose providers that protect personal data to a standard comparable to the PDPA.

8. Cookies and Browser Storage

We use cookies that are needed to keep you signed in and to protect your account. We store your preferences (such as language and theme) and, during an exam, a copy of your unsaved answers in your browser, so that an answer is not lost if the page closes; that copy is removed when the exam ends, or after seven days. We use Google Analytics, which sets its own cookies, to understand how the Service is used. You can block or delete cookies in your browser settings, but signing in will not work without the necessary ones.

9. Security

We protect personal data with technical and organisational measures, including encryption in transit, hashed passwords, access controls and limits on sign-in attempts. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected, as the PDPA requires.

10. Children's Privacy

Many of our users are under 18. A student under 18 may register with a parent or legal guardian's permission, or a guardian may create the account for them. We collect only what is needed to provide the Service. Guardians linked to a child can see the child's progress and account details. A parent or guardian may contact us to access, correct or delete their child's personal data, or to tell us if they believe we hold a child's data without proper consent.

11. How Long We Keep It

We keep your personal data while your account is open and as needed to provide the Service. An account that is registered but never verified is removed after 7 days. Operational records such as sent emails and finished background jobs are deleted after a limited period.

Account deletion is handled by our support team: email us from your account's email address and we will verify who you are and delete the account within 30 days — see how to delete your account. When an account is deleted, its name, email address, phone number, photo, password, sessions, enrolments and guardian links are removed, together with its exam attempts, practice exercises and answers, and its billing account, invoices and payment records. Any active subscription is cancelled.

After deletion we keep only:

• Payment records held by Stripe under its own terms; we delete our copy.
• Audit logs that an action took place, stripped of your IP address, device, session and the details of any change to your record, so that closing an account cannot erase the record of what was done with it.

12. Your Rights

Under the PDPA you may:

• Ask for access to the personal data we hold about you
• Ask us to correct data that is inaccurate, incomplete or out of date
• Ask for a copy of your data in a commonly used format
• Withdraw consent, or ask us to limit how we process your data
• Ask us to delete your account and personal data

You can change your password and profile photo yourself in the Service. For anything else, email us at [email protected]. We will respond within 21 days. Withdrawing consent or asking us to limit processing may mean we can no longer provide some or all of the Service.

13. Third-Party Links

The Service may link to websites or services we do not operate. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy here with a new "Last updated" date and, for significant changes, tell you by email or in the Service before they take effect.

15. Contact Us

NetAI Sdn Bhd (1431413-D) is responsible for your personal data. For any question, request or complaint about this policy or your data, including for our Data Protection Officer, contact us at [email protected]. This policy is available in English and Malay; if the two differ, the English version prevails.