Privacy Notice

1. Who is responsible

For site owner accounts, billing and our own service, we are the data controller ("data user" under the PDPA).

For information that visitors give to a site built on Komers Sites (for example contact form messages, bookings or visitor sign-ins), the site owner decides what is collected and why. The site owner is the data controller and we process that data on the owner's behalf as their data processor. Questions about a particular site should go to its owner first; you can also contact us.

Contact: Komers Sites operator (set LEGAL_COMPANY_NAME), —. Email: —. Data Protection Officer: —.

2. Personal data we process

• Account data: your email address, sign-in method (email code or Google), the Google account identifier if you use Google sign-in, and the date you accepted these terms.
• Site content: pages, images and files you or your AI app create, and site settings.
• Site data: records submitted through your sites' forms and collections, and visitor accounts (visitor email, sign-in times).
• Billing data: credit purchases and usage, payment references and amounts. Card, bank and e-wallet details are entered on the payment provider's page and are not received or stored by us.
• Security data: sign-in codes (stored only as a one-way hash, valid 10 minutes), session records, IP addresses used for rate limiting and bot checks, and abuse reports.
• Analytics: page views counted without cookies. We record the page, the referring website and a visitor fingerprint made by hashing the IP address and browser with a random value that changes every day and is then deleted. We never store raw IP addresses for analytics and cannot link visits across days.

3. Why we process it

We do not sell personal data and do not use it for advertising.

• To create and secure your account and sign you in.
• To build, store, publish and serve your sites, and to deliver form messages to you.
• To process credit purchases, renew hosting and send service emails (sign-in codes, renewal and unpublishing notices, form alerts).
• To prevent spam, fraud and abuse, including phishing sites, and to enforce our Terms of Service.
• To comply with Malaysian law and lawful requests from authorities.

4. Your AI app (Claude, ChatGPT and others)

When you connect an AI app to Komers Sites, you authorise it to act on your account through our connector. The AI app can then create, read, change, publish, unpublish and delete your sites, read and delete form records and visitor lists, see your credit balance and create payment links. It cannot complete a payment or see your payment details.

Anything the AI app reads through the connector (including visitors' form messages) is sent to that AI provider and handled under its own privacy policy. Only connect AI apps and accounts you trust. You can disconnect an AI app at any time from the AI app's settings; access tokens expire after one hour and refresh tokens after 30 days.

5. Who we share it with

We use these service providers, under contracts that require them to protect the data and use it only for our instructions:

• Hosting and storage: Google Cloud (Singapore, asia-southeast1) and Cloudflare (global network, R2 storage).
• Content delivery, security and bot checks: Cloudflare (including Cloudflare Turnstile).
• Email delivery: Amazon Web Services (Amazon SES, Singapore region).
• Payments: our payment processing service, which uses CHIP (FPX, DuitNow QR), Xendit (Touch 'n Go eWallet, GrabPay) and Stripe (cards).
• Payments on sites and payouts: when a site takes payment, the customer's email, the amount and the order reference go to our payment processing service and CHIP; a site owner's bank account details go to CHIP to verify the account and send payouts.
• Sign-in: Google, only if you choose "Continue with Google".

6. Transfers outside Malaysia

Our servers and some providers are located outside Malaysia, mainly in Singapore, and Cloudflare operates globally. We transfer personal data abroad only to providers that are bound to protect it to a standard comparable to the PDPA, as allowed under Section 129 of the PDPA.

7. How long we keep it

• Sign-in codes: until used or 10 minutes. Sessions: up to 30 days (connector refresh tokens and visitor sessions) or 7 days (dashboard).
• Account data and site content: while your account is active. Deleting a site deletes its pages, files, records and visitor accounts.
• Analytics: daily aggregates are kept while the site exists; the daily random value used for fingerprints is deleted after one day.
• Billing records: 7 years, as required for tax and accounting.
• Abuse reports and security logs: as long as needed to investigate and prevent abuse.

8. Security

We use encryption in transit (HTTPS), hashed sign-in codes, session tokens and API tokens, access controls, rate limits and bot checks. If a personal data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner within 72 hours and affected individuals without unnecessary delay, as required by the PDPA.

9. Your rights

Under the PDPA you may request access to and correction of your personal data, withdraw consent, ask us to stop processing that is likely to cause you damage or distress, limit processing, and ask for your data to be transmitted to another data controller (data portability). Site owners can export form records as CSV from the dashboard.

Email — with your request. We may need to verify your identity and will reply within 21 days. A fee may apply only where the PDPA allows it. If you withdraw consent for data we need to run your account, we may have to close the account.

If you are a visitor of a site on udx.my, contact the site owner for requests about the data you gave that site; we will help the owner respond. You can also contact us.

10. Cookies

We use only essential cookies: sign-in sessions for the dashboard and for site visitor accounts, and a short-lived cookie that protects Google sign-in. Sites do not use tracking cookies from us; analytics work without cookies. Cloudflare may set security cookies to protect against bots.

11. Children

Komers Sites is for people aged 18 and over. Site owners must not use their sites to knowingly collect personal data from children without a parent's or guardian's consent.

12. Changes

We may update this notice. For significant changes we will email account holders before they take effect. This version: 2026-10-30.

If there is any inconsistency between the English and Bahasa Malaysia versions, the English version prevails, unless the law requires otherwise.