Privacy Notice

1. Personal data and its sources

We process the verified account identifier, email and session information supplied by the ZrenAI academy, along with order references, selected packages, amounts, transaction status, payment-provider references, code allocation and the version/time of your purchase agreement. We receive payment-confirmation data from Curlec and information you send to support.

The store and its infrastructure also process technical information such as IP addresses, browser information, request/security logs and essential session cookies. Account and payment information is needed to authenticate you, process the purchase and deliver it. Without the required information, those functions may not be available.

Payment credentials such as card details or bank credentials are entered into the payment provider's hosted interface. Our store does not intentionally collect or store full card numbers, security codes, banking passwords or OTPs. The academy and payment provider also issue their own privacy notices for their services.

2. Purposes

We use this information to authenticate accounts, process and verify payments, allocate and deliver codes, show purchase history, respond to support and refund requests, investigate fraud or security incidents, resolve disputes and meet applicable record-keeping and legal obligations.

This store does not use purchase consent as consent for marketing. If a separate optional marketing service is introduced, its purpose and choices will be presented separately.

3. Disclosure and international processing

Access is limited to authorised personnel and service providers who need the information for these purposes. Recipients include the academy identity service, Curlec and relevant financial institutions, hosting/database providers, and professional advisers or public authorities where required or permitted by law. Data is not sold as a mailing list.

Hosting and related providers may process data outside Malaysia, including in Singapore depending on the deployed infrastructure. We are responsible for assessing applicable transfer conditions and using appropriate contractual, access-control and security measures. Contact us for information about the providers and transfers relevant to your data.

4. Cookies and security

We use essential cookies for sign-in sessions, request protection and related authentication functions. Blocking these cookies may prevent sign-in or checkout. The hosted payment service may use its own necessary security technologies under its privacy notice.

We use HTTPS, restricted staff access and encryption for stored redemption codes. No online system can guarantee absolute security. Keep your account and codes private and notify us promptly of suspected unauthorised access.

5. Retention

We keep personal data only for as long as needed for the purposes described, including fulfilment, support, disputes and applicable tax/accounting or legal record-keeping requirements. Retention depends on the record type and obligations involved. Data no longer required should be securely deleted or anonymised, subject to lawful preservation requirements.

A request to close an account does not necessarily require immediate deletion of transaction or fraud-prevention records that must be retained. We will explain any applicable retention restriction when responding to a request.

6. Your choices and requests

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, withdrawal of consent, or limits on processing that is not required for the transaction or a legal obligation. You may also raise a complaint about our handling of your data. We may need proportionate verification before disclosing or changing account information.

Use the support email or postal address below and mark the request Privacy. Explain your request and provide your account email or order reference. Do not send a password or OTP. Withdrawal may prevent us from providing functions that depend on that processing; it does not affect lawful processing already carried out or mandatory retention.

We will respond within the applicable legal period and explain any lawful limitation, identity-verification requirement or permitted fee before proceeding. You may also contact Malaysia's Personal Data Protection Commissioner about unresolved concerns.

7. Updates and language

This notice is available in English, Bahasa Malaysia and Simplified Chinese using the language switch above. We update its version date when the practices described materially change. Contact us if you need clarification or assistance understanding the notice.