What we actually collect.
This page is the operator's manual to our data practices. The Privacy Policy covers your rights and our promises in plain English; this page is the technical inventory — every form, every cookie, every API call. Read this if you want to know exactly what happens when you tick a box on our site.
1. Forms on this website.
Every form on the site is listed below, with the precise fields collected and where they end up.
| Where | What we ask | Where it goes |
|---|---|---|
Contact / quote form on / and /services.html |
Name, email, phone, business, message, optional file attachment | Stored as a "lead" record on our server; an email is sent to our sales team. Retained for 24 months from last contact. |
| Chat widget (bottom-right of every page) | Free-text conversation; the AI may ask for your name + email if you express interest | Transcript stored on our server (90 days, then anonymised). Each turn of the chat is sent to a third-party AI service to generate a reply, then discarded by that service at end of request. |
Developer signup at /dev/signup |
Display name, email, country, password, GitHub URL, portfolio URL | Account record on our server. Password is salted and hashed using industry-standard cryptographic methods before storage. A welcome email + signed PDF of the marketplace agreement is sent. |
Buyer signup at /buy/signup |
Name, email, phone (optional), password | Account record on our server. Password hashed as above. |
KYC submission at /buy/kyc |
Full legal name, DOB, ID type, ID number, nationality, ID image; for Tier 2: + selfie + residential address + optional address proof | Record on our server with sensitive PII. The ID number is converted into a one-way cryptographic hash before storage; we never keep the plaintext. The ID/selfie/address files are written to a private storage area, isolated from the public website, and accessible only via an authenticated admin endpoint. KYC images are deleted 12 months after expiry. |
Bid form on /auction.html |
Bid amount; your account name + email are attached automatically | Bid record on our server, attached to the auction. Retained 7 years for financial-record purposes. |
Payment-proof upload at /payment-proof.html |
Reference, screenshot/photo of your bank transfer | Stored against the related quotation/invoice/entry-fee record. Retained 7 years. |
Sign-agreement at /sign-agreement.html |
Authorised signatory name, designation, IC/passport number for the agreement only, email, drawn signature | Embedded into the executed PDF agreement and emailed to both parties. Stored alongside the agreement record. Retained 7 years. |
| Newsletter / marketing (if and when added) | Email; optional first name | Sent only with explicit opt-in. You can unsubscribe with one click in every email. |
2. Cookies we set.
We use the smallest practical set of cookies. We do not use third-party advertising or social-media tracking cookies. You can clear or disable any of these in your browser settings; some functionality (login, KYC, chat continuity) will not work without them. The cookies we set fall into the following categories:
| Category | Purpose | Lifetime | Type |
|---|---|---|---|
| Authentication & session | Keeps you signed in to your account (buyer, developer, or staff) for the current session. | Up to 12 hours per session | Strictly necessary |
| Chat continuity | Lets the chat widget resume your conversation if you reload the page. | Up to 30 days | Functional |
| Consent record | Records that you have already accepted this notice, so we do not ask again on every page. | Up to 12 months | Strictly necessary |
Cookies in the "Authentication & session" category are tamper-resistant, are not readable by scripts running on our pages, and are not sent on cross-site requests. In production they are transmitted only over HTTPS. Specific cookie names and technical attributes are not published here for security reasons; they are available to lawful authorities, our auditors, or your appointed data-protection representative on request.
3. Server-side logs.
Our hosting and CDN provider automatically captures the following for every request, for security and debugging:
- Your IP address (truncated to /24 in our analytics view);
- The URL you requested and the HTTP status we returned;
- The time of the request, your user-agent string, and the referrer URL;
- If you are logged in, the user-id of the request (we never log password hashes or KYC images).
These logs are retained for 30 days, then rotated.
4. Third-party services and what they receive.
4.1 Hosting and CDN provider
Every HTTP request you make to zenarajaya.com is served by our hosting and CDN partner. They see the request URL, your IP, and any data you submit through forms. They act as our data processor under PDPA and operate under their own privacy policy. The current provider's identity, jurisdiction, and policy URL are available in writing on request to hello@zenarajaya.com.
4.2 AI service provider — chat-widget replies
When you chat with our widget, your message text (and recent conversation history) is sent to a third-party AI service to generate a reply. We use a service tier where customer content is not retained for training. Processing currently takes place outside Malaysia. The current provider's identity, jurisdiction, and policy URL are available in writing on request.
4.3 Banking partners — receiving payments
When you transfer funds to us, our banking partner receives whatever the law and the transfer require — your name, your IC number if you bank in person, the amount, and the time. We store the transfer reference and your name; we do not store your bank account number unless you have specifically shared it with us for payouts.
4.4 International transaction services — cross-border payouts
If we owe you a payout in a non-MYR currency, we may use a regulated international transaction service. The service sees your name, email, country, and bank details. We share the minimum information required to complete the transfer.
4.5 Email service provider
We use a transactional email provider to deliver the emails we send you (quotes, agreements, receipts, password resets). They do not use your address for any other purpose. Provider details are available on request.
5. Analytics.
We use a privacy-preserving, first-party analytics setup — page views, referrers, and basic device type — without sending data to third-party trackers (no Google Analytics, no Meta Pixel). All analytics events are aggregated and stripped of personal identifiers within 24 hours of collection. We see "1,200 people read the services page from Sarawak this month," not "Reiner from this IP read these pages on these dates."
6. AI training and your data.
We do not use your personal data, your messages, your KYC files, or your project content to train any AI model — ours, our partners', or anyone else's. The AI in our chat widget is consumed via API; no fine-tuning is performed on your conversations. If this changes, we will say so here, prominently, and ask for fresh consent.
7. What we do not collect.
- We do not collect or process biometric data (fingerprints, face vectors). The KYC selfie is reviewed by a human admin and stored as an image only — no face-recognition is run.
- We do not buy, scrape, enrich, or augment your profile from third-party data brokers.
- We do not collect data on visitors via fingerprinting, ETags, or other "cookie-less" tracking.
- We do not sell, rent, or barter personal data.
8. Your control.
At any time you can:
- See your data — log in and visit your account page; or email us for the full export;
- Correct your data — edit it yourself if the page allows, or email us;
- Delete your data — write to hello@zenarajaya.com with subject "Delete my account". We will action it within 30 days, subject to legal retention obligations (tax records, fraud-prevention hashes).
- Reject cookies — clear or block them in your browser. Strictly-necessary cookies will be set again the next time you log in; without them, login won't work.
9. Special note for marketplace KYC.
KYC images and the records linked to them are subject to additional safeguards beyond the rest of this notice. They are:
- Stored in a private storage area with strict access controls, isolated from the public website;
- Served only via an admin-authenticated endpoint that disables caching and search-engine indexing;
- Reviewed only by directors and named compliance staff;
- Retained 12 months after KYC expiry, then securely deleted (the underlying files and the database fields that referenced them).
A one-way cryptographic hash of your ID number is retained longer for fraud prevention (to detect a single individual creating multiple accounts) but cannot be reversed back into the original ID number.
10. Changes.
If we change what we collect, we will update this page and bump the version + effective date at the top. Material changes are also emailed to active account holders 14 days before they take effect.