Legal

Privacy Policy

Last updated: 7 June 2026

This Privacy Policy explains how [REGISTERED ENTITY NAME] (the “Company”, “we”, “us”), operating SedonaAI at https://sedonaai.my and https://app.sedonaai.my (the “Service”), collects, uses, discloses, and protects your personal data. We process personal data in accordance with the Malaysian Personal Data Protection Act 2010 (“PDPA”).

By using the Service or providing us your personal data, you consent to the practices described here.

1. Who we are

SedonaAI is operated by [REGISTERED ENTITY NAME] (the “Company”, “we”, “us”), registered in Malaysia (Company No. [SSM REGISTRATION NO.]), with its registered address at [REGISTERED ADDRESS, Malaysia]. For any privacy-related enquiry, contact us at privacy@sedonaai.my.

2. Personal data we collect

We collect only the data needed to provide and improve the Service:

  • Waitlist — your email address when you join the waitlist.
  • Contact enquiries — your name, email address, company (optional), and the message you send us.
  • Account data — when you create an account in the app: your full name and email address, and either a password or a Google sign-in identifier. We never store your Google password.
  • Usage & device data — anonymous analytics (pages viewed, approximate region, device and browser type) collected only after you accept analytics cookies.
  • Content you create — partner-research and outreach data you enter while using the app, which is private to your account.

3. How and why we use your data

  • To operate the Service — authenticate your account, deliver features, and respond to your enquiries.
  • To manage the waitlist and tell you when access is available.
  • To improve and secure the Service through anonymous, aggregated analytics.
  • To communicate important service, security, or legal notices.
  • To comply with applicable legal obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Disclosure to third parties

We share personal data only with service providers who process it on our behalf, under appropriate confidentiality and data-protection obligations:

  • Google Firebase (Authentication, Firestore, Hosting) — account, waitlist, and contact data storage and authentication.
  • Google Analytics — anonymous usage analytics, subject to your consent.

We may also disclose personal data where required by law, regulation, or valid legal process.

5. International transfer of data

Our processors (including Google) may store and process data on servers located outside Malaysia. Where personal data is transferred abroad, we take reasonable steps to ensure it remains protected to a standard consistent with the PDPA.

6. Cookies and analytics

We use cookies and similar technologies for anonymous analytics only. Analytics storage stays disabled until you accept via our cookie consent banner (Google Consent Mode v2). You can withdraw consent at any time by clearing your browser cookies. We do not use advertising cookies.

7. Data retention

We retain personal data only as long as necessary for the purposes above or as required by law. Waitlist and contact records are kept until they are no longer needed; account data is kept for the life of your account and deleted when you delete your account.

8. Security

We apply reasonable technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, including encrypted transport (HTTPS) and access controls on our datastores. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights under the PDPA

Subject to the PDPA, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Withdraw your consent to our processing (this may limit your ability to use the Service).
  • Request deletion of your account and associated data — you can delete your account directly in the app's Settings, or contact us.
  • Limit the processing of your personal data.

To exercise any of these rights, email privacy@sedonaai.my. We will respond within the timeframe required by the PDPA.

10. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated to you. Continued use of the Service after changes take effect constitutes acceptance.

12. Contact us

Questions or requests regarding this policy or your personal data can be sent to privacy@sedonaai.my or by post to [REGISTERED ADDRESS, Malaysia]. See also our Terms of Service.

This document is provided for transparency and does not constitute legal advice.