Privacy Notice

This Privacy Notice explains what personal data AI SMITH collects, why we collect it, how it is used and shared, and what rights you have over it. It is written to support Malaysia's Personal Data Protection Act 2010 (PDPA) notice and choice obligations, and will be reviewed by qualified Malaysian counsel before it governs any live data collection.

Who we are

AI SMITH ("we," "us," "our") is the accountable organisation for personal data collected through this website and related consultation, support, and partner channels. Our verified legal entity name, registration details, and a dedicated privacy contact will be published here once confirmed — until then, please use the Contact page, selecting "Privacy or data request," to reach us about any privacy matter.

What we collect

Depending on how you interact with us, we may collect:

• Contact details you provide — such as your name, email address, phone or WhatsApp number, company, role, and country.
• Enquiry content — the business challenge, workflow, or question you describe to us, and any optional context you choose to share (industry, company size, current tools, desired outcome).
• Communication records — messages sent through our WhatsApp channel, contact forms, or consultation booking flow, and records of meetings scheduled.
• Technical and usage data — collected through our cookieless analytics tools, described in our Cookie Notice; this does not identify you individually.
• Application or proposal information — if you apply as a partner or submit a referral, the specific details set out on that form.

We do not knowingly collect sensitive personal data (such as financial account numbers, identity document numbers, or health information) through our public forms, and our forms explicitly ask you not to submit this kind of information.

Sources

We collect personal data directly from you when you complete a form, message us on WhatsApp, or otherwise contact us. Where a referral programme is active, we may also receive limited contact details about you from a referrer who confirms you agreed to be contacted — see the Referral Program terms once published.

Why we use it

We use personal data to:

• respond to your consultation, pricing, support, partnership, or general enquiry;
• assess fit and prepare a recommended next step;
• schedule and conduct meetings you request;
• operate and improve our website and services;
• meet legal, accounting, and security obligations; and
• send you optional marketing updates, only where you have separately and explicitly agreed to receive them.

Required vs optional

Fields marked "required" on our forms are needed to process your specific request — for example, we cannot follow up on a consultation without an email address or a description of your business challenge. Optional fields help us prepare more useful context but are never required to submit a request. If you don't provide a required field, we may not be able to respond to that specific enquiry.

Legal basis

We process personal data on the basis that it is necessary to respond to a request you initiated (such as a consultation, support, or application enquiry), to take steps toward a possible agreement at your request, to meet a legal obligation, or on the basis of your consent where the applicable basis is consent — most clearly for optional marketing communications, which are never bundled into a required acknowledgement. The exact basis for each form and use case will be confirmed by qualified counsel before launch.

Who we share with

We may share personal data with:

• Service providers who help us operate our website, forms, communication tools, and internal systems, acting under confidentiality and data-protection obligations.
• Team members who need the information to respond to your enquiry.
• Partners, only where you have specifically engaged with a partner programme and agreed to that sharing.
• Legal or regulatory authorities, where required by law.

We do not sell personal data. We do not share personal data with advertising networks — we do not run advertising or marketing cookies (see our Cookie Notice).

Cross-border transfers

Where a service provider we use stores or processes data outside Malaysia, we will identify the relevant countries and the safeguards in place once our vendor arrangements are finalised and reviewed by counsel. We do not currently make an unqualified claim about cross-border transfers; this section will be completed before launch.

Retention

We retain personal data only for as long as necessary to respond to your enquiry, maintain a business relationship, or meet a legal or accounting obligation, after which it is deleted or anonymised. Specific retention periods by data category will be confirmed and published here before launch.

Security

We take reasonable technical and organisational steps to protect personal data against loss, misuse, and unauthorised access, appropriate to the sensitivity of the data involved. No system is completely secure, and we do not claim our systems are "100% secure" or guaranteed against every risk.

Your rights

Under the PDPA and applicable Malaysian regulations, you may have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate data;
• withdraw consent for processing based on consent, including marketing communications;
• request that we stop processing your data in certain circumstances; and
• lodge a complaint with the relevant Malaysian data protection authority.

To exercise any of these rights, use the Contact page and select "Privacy or data request." We will confirm our verification and response process before this notice governs live data collection.

Marketing choices

We only send marketing communications if you have separately opted in — marketing consent is never pre-selected and is never required to receive a response to your enquiry. You can withdraw marketing consent at any time using the unsubscribe link in any marketing message, or by contacting us through the Contact page.

Cookies and analytics

We use only strictly necessary website storage and cookieless analytics tools (Umami and Ahrefs Web Analytics) that do not use tracking cookies or build an individual profile of you. See our full Cookie Notice for detail.

Children

Our website and services are intended for business use by adults acting on behalf of an organisation. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us through the Contact page and we will address it.

Automated processing

AI agents referenced on this website may assist in preparing drafts, summaries, or recommendations from data your organisation has approved for a specific engagement. Automated processing of this kind does not make final decisions about you as an individual without human review, particularly for anything affecting your employment, finances, or legal standing, in line with our Acceptable Use & Responsible AI Policy.

Complaints

If you have a concern about how we handle personal data, please contact us first through the Contact page so we can address it directly. You may also have the right to lodge a complaint with the relevant Malaysian data protection authority; details will be confirmed here once our compliance review is complete.

Changes

We may update this notice as our practices, services, or the law change. Material changes will be reflected by an updated effective date at the top of this page. We encourage you to review this notice periodically.

Language

We intend to publish this notice in both Bahasa Malaysia and English, consistent with Malaysian Personal Data Protection Commissioner guidance, once translation and legal review are complete.

Contact

For any privacy question or to exercise a right described above, use the Contact page and select "Privacy or data request." A dedicated privacy contact will be published here once confirmed.