Privacy Policy

We collect:

• Account data — your email address, and your name if you sign in with Google.
• Usage data — your practice attempts, mock-exam results and progress, so we can show your stats and readiness.
• Billing data — your purchase history, the access pass you hold and a Stripe customer reference. We do not store your card details; all payments are handled by Stripe.
• Technical data — basic logs needed to operate and secure the Service.

To provide and personalise the Service, track your progress, process your purchases, communicate with you about your account, measure how people find us, and keep the Service secure and working.

We send study tips and offers on our passes only if you agree. When you sign up with email and password there is an unticked box, "Email me study tips and offers"; if you sign up with Google we ask once on your first page. If you leave it unticked, you get no marketing email.

If you agree, we use your email address (and your first name, if we have it) to send study tips, reminders to come back, announcements of new modules and offers on SIDC Prep passes. We record that you agreed and when.

You can withdraw consent at any time, free of charge: click the unsubscribe link in any of those emails, change the setting on our email preferences page or email us. We stop as soon as you tell us. We do not sell or give your personal data to anyone else for their marketing.

Service emails are not marketing and are sent to every account holder: password resets, your welcome and receipt emails, the email confirming your pass is active, and the notice that your pass is about to end.

We share data only with service providers that help us run SIDC Prep:

• Stripe — payment processing and billing.
• Supabase — database hosting (outside Malaysia, in a data centre in Singapore). Your data is transferred there to provide the Service, with protection comparable to the PDPA.
• Vercel — application hosting, and anonymous page-view statistics that do not use cookies.
• Resend — sending account and service emails, and marketing emails if you opted in.
• Google— optional "Sign in with Google", and Google Ads conversion measurement (see Cookies).

We do not sell your personal data.

We use a secure, essential cookie to keep you logged in, and a cookie that remembers which SIDC module you are studying.

We also use the Google tag (gtag.js) for Google Ads conversion measurement. It sets cookies that tell us whether a visit that came from one of our ads led to a sign-up or a purchase. You can block these cookies in your browser settings, or manage ad personalisation at adssettings.google.com.

We keep your data while your account is active. If you delete your account, we delete or anonymise your personal data, except where we must retain limited records (e.g. payment records) to meet legal obligations.

Under the PDPA you may request access to, or correction of, your personal data, withdraw your consent, and require us to stop processing your data for direct marketing (section 43) at any time (see section 3). You may also ask us to delete your account. Contact us using the details below.

We use industry-standard measures (encryption in transit, hashed passwords, access controls). No system is perfectly secure, but we work to protect your data.

Privacy questions or data access and correction requests: email support@sidcprep.my.