Privacy Policy

1. Introduction

Kelulut Labs ("we", "us", "our") provides AI integration services to small businesses in Malaysia. This policy describes how we collect, use, store, and protect personal data when you use this website or engage our services. It applies to data collected through our contact form, email correspondence, and service delivery.

We take data handling seriously — in part because our own work involves helping clients manage their records carefully. Any questions about this policy can be sent to [email protected].

2. What Personal Data We Collect

Data you provide directly

• Name and email address (required when you submit the contact form)
• Phone number (optional, if you choose to provide it)
• Message content (optional)
• Business name and description (where relevant to a service enquiry)

Data collected automatically

• Browser type, device type, and approximate location (country/city level) via web analytics
• Pages visited and time spent on the site
• Referring URL (which page or search brought you here)

Legal basis for processing (PDPA Malaysia)

We process your data on the basis of your consent (for optional fields and analytics cookies), contract performance (when delivering a service you have engaged), and legitimate interest (for general enquiry follow-up and website improvement).

Retention periods

• Contact form submissions: retained for up to 12 months for correspondence purposes, then deleted
• Client files shared for service delivery: deleted after delivery is confirmed
• Analytics data: retained for 26 months in aggregate, anonymised form

3. How We Use Your Data

• To respond to enquiries submitted via the contact form
• To deliver the service you have engaged (Data Tidy-Up, Quotation Drafting Helper, or Team Session)
• To communicate about the progress or completion of an engagement
• To understand how the website is used and improve its content
• To comply with applicable Malaysian law

We do not use your data for unsolicited marketing. We do not sell, rent, or share your personal data with third parties for their own commercial purposes.

Third-party services

We use Google Analytics to collect aggregated, anonymised website usage data. We may use a hosted email service to receive and store contact form submissions. These services operate under their own privacy policies and are chosen for their data handling standards.

4. How We Protect Your Data

• This website is served over HTTPS (encrypted in transit)
• Access to contact form submissions is limited to the team member handling your enquiry
• Client files shared for service engagements are held only for the duration of the engagement
• Sensitive data flagged during Data Tidy-Up is handled separately and returned to you rather than processed through external services

In the event of a data breach affecting your personal information, we will notify you within 72 hours of becoming aware of the breach, to the extent required under applicable law.

5. Cookies

This site uses cookies to keep basic functionality working and to collect anonymised analytics data. You can manage your cookie preferences using the banner that appears on your first visit, or by visiting our Cookie Policy page, which includes controls for each cookie category.

6. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Withdraw consent for processing based on consent
• Request that we stop using your data for certain purposes
• Request deletion of your data (subject to legal retention requirements)

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you believe your data rights have not been upheld, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP).

7. External Links

This website may contain links to external websites. We are not responsible for the privacy practices of those sites. We recommend reviewing their privacy policies before providing personal data to them.

8. Children's Privacy

Our services are intended for business operators and are not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through this site, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top of the page reflects the most recent revision. Significant changes will be communicated via a notice on the website. Continued use of the site after an update constitutes acceptance of the revised policy.

10. Contact

For data-related questions or requests:

• Email: [email protected]
• Post: Kelulut Labs, 68 Lebuh Pantai, 10300 George Town, Pulau Pinang, Malaysia
• Phone: +60 4 261 7398 (Mon–Fri 9am–6pm)