Privacy Policy

Data We Collect

We collect data necessary to provide professional technical services, build software solutions, and manage commercial relationships. This includes:

• ▲Corporate & Contact Credentials: full name, corporate email address, contact phone number, company name, business registration details, and mailing address.
• ▲Tax Verification Profiles: Tax Identification Numbers (TIN), corporate tax markers, and related data required for compliant e-invoicing with LHDN.
• ▲Project & Integration Metadata: repository structures, system requirements, application schema goals, and third-party API configurations shared during engineering cycles.

Purpose of Data Processing

In compliance with the PDPA, your data is processed exclusively for the following:

• ▲To fulfil contractual development obligations, execute deployments, and provide maintenance retainers.
• ▲To manage secure accounting workflows, issue compliant financial records, and track payments.
• ▲To deliver operational notifications regarding system health, staging reviews, and security updates.

Protection of Client Data

We implement strict protocols ensuring that no proprietary client data, custom source code, commercial assets, or operational databases are uploaded to public AI training repositories. All AI tooling used in our workflows operates within secure, enterprise-grade, isolated environments to prevent data leakage.

Code Base Isolation

Each project is architected within decoupled, isolated environments — such as private Git repositories and isolated cloud database instances — preventing any cross-contamination between client projects.

Disclosure of Personal Data

We do not sell, rent, lease, or trade your personal or corporate data to third parties. Data is disclosed strictly to entities necessary to complete your platform architecture:

• ▲Regulated statutory bodies: the Inland Revenue Board of Malaysia (LHDN) and the Companies Commission of Malaysia (SSM), for financial compliance reporting.
• ▲Infrastructure partners: cloud infrastructure providers (e.g., Supabase, Vercel, AWS) designated by the Client for server operations, and Resend, which delivers our contact form submissions by email.

Data Retention

We retain personal data and corporate records only for as long as necessary to satisfy business delivery terms, active maintenance agreements, or statutory tax preservation requirements under Malaysian law (typically seven years for financial records). Custom source code fragments are purged from our internal staging environments 90 days after final production deployment and successful asset transfer.

Your Rights Under the PDPA

As a data subject in Malaysia, you have explicit rights regarding your personal data held by Digital Alchemy:

• ▲The right to access: you may request a copy of the personal data records we hold under your name or entity.
• ▲The right to correction: you may request updates or corrections to inaccurate, incomplete, or outdated information.
• ▲The right to withdrawal: you may withdraw your consent for future data processing, noting that this may result in the termination of active support retainers or development cycles.

Contact Us

To exercise any of these rights, or for any questions about this policy, please submit a request to our operations desk at letstalkalchemy@gmail.com.