Privacy Policy

1. INTRODUCTION

Anything Digital Hub ("we", "us", or "our") is committed to protecting your personal data in compliance with the Personal Data Protection Act 2010 (PDPA) (Act 709) of Malaysia. This Privacy Policy explains how we collect, process, use, disclose, and protect personal data when you use StudyPlace.my ("Platform").

By using the Platform, you consent to the data practices described in this Policy. If you do not agree, please discontinue use of the Platform.

2. DATA CONTROLLER

The data controller for personal data collected on the Platform is:

• Anything Digital Hub
• Platform: StudyPlace.my (https://studyplace.my)
• Contact: contact@studyplace.my

3. CATEGORIES OF PERSONAL DATA COLLECTED

3.1 Data You Provide Directly

• Parent identity data: full name;
• Parent contact data: email address, WhatsApp-linked phone number;
• Parent account data: account credentials (password stored in hashed form via Clerk authentication), account type;
• Student (child) profile data: child's full name, school name, date of birth (used to determine school grade/year) — entered by the parent or guardian only;
• Payment data: billing name, transaction references (we do not store full card numbers);
• Communications: messages you send to our support team.

3.2 Data Collected Automatically

• Device and browser data: IP address, browser type, device identifier, operating system;
• Usage data: pages visited, features used, time spent, clickstream data;
• Log data: access times, error logs, and diagnostic data.

3.3 Educational Data

• Exam scores, practice results, and question attempt history;
• Learning progress, completed bundles, and performance analytics;
• Subject and topic preferences derived from usage patterns.

4. PURPOSES OF PROCESSING

We process your personal data for the following purposes:

• To create and manage your account and student profiles;
• To deliver the educational services you have subscribed to or purchased;
• To process payments and maintain billing records;
• To send transactional communications (receipts, account notices, access confirmations);
• To provide customer support and respond to your inquiries;
• To monitor, analyse, and improve our Platform and educational content;
• To detect, prevent, and investigate fraud, abuse, and security incidents;
• To comply with our legal and regulatory obligations under Malaysian law;
• To send you marketing and promotional communications, where you have opted in.

5. LEGAL BASIS FOR PROCESSING

Under the PDPA 2010, we process your data on the following bases:

• Consent: you have given explicit consent when registering or opting into marketing;
• Contractual necessity: processing is required to fulfil our service agreement with you;
• Legal obligation: processing is required to comply with applicable Malaysian laws;
• Legitimate interests: processing is necessary for our legitimate business interests, such as security monitoring and service improvement, where these are not overridden by your rights.

6. CHILDREN'S DATA

We recognise the importance of protecting the privacy of children under 18. Student (child) profiles are created and managed by parent or guardian accounts. We do not knowingly collect personal data directly from children under 13 without verifiable parental consent. Parents may request the deletion of their child's data at any time by contacting our support team.

7. DATA SHARING AND DISCLOSURE

We do not sell your personal data. We may share your data with:

• Payment processors (e.g., Billplz) solely for transaction processing;
• Database and personal data storage: Supabase (Supabase Inc.) — personal data including parent and student profiles is stored on Supabase-managed cloud infrastructure, which may be hosted on servers outside Malaysia. Supabase is contractually bound to process this data only on our instructions and in accordance with applicable data protection law;
• Web hosting and application delivery infrastructure providers (including CDN and edge network services) — these providers serve the Platform's application code and do not have access to your personal data stored in our database;
• Law enforcement or regulatory authorities where required by Malaysian law or court order;
• Successor entities in the event of a business merger, acquisition, or asset sale, with appropriate notice to you.

All third-party processors are contractually required to handle your data in accordance with applicable law and only for the purposes we specify.

8. DATA RETENTION

We retain your personal data for as long as your account is active or as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Upon account deletion, we will delete or anonymise your personal data within 90 days, except where retention is required by law.

9. YOUR RIGHTS UNDER THE PDPA

Under the Personal Data Protection Act 2010, you have the following rights:

• Right to access: request a copy of the personal data we hold about you;
• Right to correction: request correction of inaccurate or incomplete data;
• Right to withdraw consent: withdraw consent for processing at any time (this may affect your ability to use the Platform);
• Right to limit processing: request that we cease processing your data for direct marketing purposes.

To exercise any of these rights, please contact us at contact@studyplace.my. We will respond within 21 days as required under the PDPA.

10. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, session tokens, and similar technologies to maintain your login session, remember preferences, and gather analytics data. You may control cookies through your browser settings; however, disabling certain cookies may impair Platform functionality.

11. DATA SECURITY

We implement appropriate technical and organisational measures to protect your personal data, including encrypted data transmission (TLS/HTTPS), hashed password storage, access controls, and regular security assessments. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.

12. CROSS-BORDER DATA TRANSFERS

Your data may be processed on servers located outside Malaysia (for example, by our cloud infrastructure providers). We ensure that any such transfer is subject to adequate safeguards consistent with the requirements of the PDPA 2010.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes will be communicated by email or notice on the Platform. Your continued use of the Platform after changes take effect constitutes your acceptance.

14. CONTACT US

For any privacy-related queries, to exercise your PDPA rights, or to raise a complaint, please contact us at contact@studyplace.my.