Privacy Policy

Last updated: June 2025 · Compliant with Malaysia PDPA 2010

This policy explains how CloudMark collects, uses, and protects your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

1. Data We Collect

Account Information

When you sign in with Google, we receive your email address, display name, and profile picture from Google. We do not receive or store your Google password.

Exam Activity

We store your exam attempt history — which exams you attempted, your scores, and per-question answers. This is used to show your progress history.

Payment Information

Payments are processed by Stripe. We do not store your credit card details. We store your email address and the product you purchased to grant access.

Technical Data

Session cookies are used to keep you signed in. We do not use third-party analytics or advertising trackers.

2. How We Use Your Data

To authenticate you and maintain your session
To display your exam history and progress
To grant access to purchased content
To process payments via Stripe
We do not sell, rent, or share your data with third parties for marketing purposes
We do not send marketing emails unless you explicitly opt in

3. Data Storage and Security

Your data is stored on a private server. We use industry-standard security practices including HTTPS encryption, signed session cookies (HMAC-SHA256), and parameterised database queries to prevent injection attacks.

We retain your data for as long as your account is active. If you request deletion, we will remove your personal data within 30 days, subject to any legal retention obligations.

4. Third-Party Services

Google Sign-In — handles authentication. Subject to Google's Privacy Policy.

Stripe — handles payments. Subject to Stripe's Privacy Policy.

AI Study Assistant — powers AI explanations. Your question text and study context may be sent to a third-party AI service for processing. We do not share your personal information with AI providers beyond what is necessary to generate your study explanation.

5. Your Rights Under PDPA 2010

Under the Malaysian Personal Data Protection Act 2010, you have the right to:

Access the personal data we hold about you
Correct any inaccurate personal data
Withdraw consent and request deletion of your data
Be informed of how your data is used

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

6. Cookies

We use a single session cookie (session) to keep you signed in. This cookie is HTTP-only, secure, and contains only a signed reference to your identity — not your raw data. No advertising or tracking cookies are used.

7. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. The date at the top of this page will reflect the most recent update. Continued use of the Platform after changes are posted constitutes your acceptance.

8. Contact

For privacy-related questions or requests: [email protected]