Privacy Policy

This Privacy Policy explains how Stacky ("we", "us", "our") collects, uses, discloses and protects your personal data when you visit our website or engage our services. We are committed to handling your data responsibly and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). Stacky is operated by Stacky Enterprise, a business registered with the Companies Commission of Malaysia (SSM), registration no. 202603157802.

Stacky is a software company: we build websites, custom software and systems, provide infrastructure and IT advisory and training, and operate our own software products (such as our accounting and CRM systems, with broader ERP capabilities planned). This policy covers the personal data we handle through this website, our own products, and our client engagements.

We may collect information you provide directly to us, such as your name, email address, phone number and the details of your enquiry when you submit our contact or quote form.

We also collect technical information automatically when you browse this website: the pages you visit and when, how long you stay on each page, buttons you interact with (such as contact or WhatsApp links), your IP address and the approximate location derived from it (country, state and city), and your device, operating system and browser type. We use this to understand how the website is used, improve it, and follow up on enquiries.

If you create an account for one of our software products, engage our services, or attend our training, we also collect account and login details, billing and payment information, training registration and attendance records, and any business records or other personal data you choose to store in our products to run your operations.

We use your personal data to respond to your enquiries, prepare quotes, provide and improve our services, communicate with you about your project, and comply with legal obligations.

Where you use our products or systems, we use your data to provide, secure, maintain and support those services, process payments, and deliver the training and support you request.

We do not sell your personal data to third parties.

We use cookies and analytics services (such as Google Analytics) to understand how visitors use our website. You can control cookies through your browser settings. Disabling cookies may affect some site functionality.

In addition, we run our own first-party analytics. It sets three cookies — a visitor ID (st_vid, 1 year), a session ID (st_sid, 30 minutes) and a first-touch attribution cookie (st_attr, 90 days) — and records your visit as described in Section 2, including your IP address and approximate location. This data stays in our own systems, is used only to improve the website and serve enquiries, and is never sold or shared for advertising.

We may share data with trusted service providers who help us operate our business (for example, hosting, email delivery and analytics). These providers are only permitted to use your data to provide services to us.

To operate our products and services we rely on trusted sub-processors in categories such as cloud hosting and storage, payment processing, email/SMS and notifications, and analytics. We do not host personal data on our own premises — our products run on reputable third-party cloud providers. These providers may process personal data only to provide services to us, under our instructions and their own terms.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy or as required by law. We take reasonable technical and organisational measures to protect your data against unauthorised access, loss or misuse.

For our software products, we retain account and billing data while your account is active and for a reasonable period afterwards (or longer where the law requires, for example tax and accounting records). Business data you store in our products is retained according to your instructions and returned or deleted at the end of our engagement.

Under the PDPA, you have the right to access and correct your personal data, and to withdraw consent to its processing. To exercise these rights, please contact us using the details below.

How we handle personal data depends on the product or engagement:

• Our hosted products. For our own subscription products (such as our accounting and CRM systems), we are the data controller for your account, billing and contact details. The business records and personal data you load into a product remain yours — we host and process them on your behalf as your data processor, solely to provide the service, and never for our own purposes.
• Custom systems we build for you. Systems we design and build are usually deployed on your own server or cloud environment, so the personal data they hold resides on your infrastructure, not ours. When we provide maintenance or support, our team may access that environment, and the data within it, only as needed to deliver the support you have requested — acting as your data processor. For larger engagements we sign a separate Data Processing Agreement covering these terms.
• Infrastructure & advisory. When we advise on or set up infrastructure for you, we access your systems only to the extent needed for the agreed work.
• Training & consulting. When you register for our training or consulting, we collect registration and attendance details (such as name, email and organisation) and any completion or certificate records, to administer the session and issue certificates.

You can ask us to access, correct or delete the personal data we hold as a controller. Where we act as a processor, we will support the relevant client (the data controller) in responding to such requests. To make a request, use the "Contact Us" section below.

Some of our applications (such as exastudio) let you connect third-party accounts — for example LinkedIn and Canva — so that we can create and publish content on your behalf. Where you choose to connect such an account:

• Connection credentials. We store the OAuth access and refresh tokens for the services you connect, and any API keys you configure, solely to perform the actions you initiate (for example, publishing a post you have approved). Disconnecting a service immediately revokes and deletes its stored tokens.
• Account identifiers. We store your account identifier on the connected service (for example, your LinkedIn member identifier) and, for LinkedIn Company Pages, the identifiers and names of the organisations you administer, so that we can publish to the page you select.
• Content you create. We store the prompts you enter, the images and captions we generate for you, your publish and schedule choices, and the resulting links to published posts.
• We are publish-only. We do not collect or store other members' profiles, comments, likes, reactions, or other social activity from these platforms.
• Platform data handling. Our handling of data obtained from LinkedIn follows the LinkedIn Marketing API data storage requirements. We retain your account identifier and connected-organisation details only for as long as your connection remains active, and we delete them when you disconnect the service or close your account.
• Service providers. To provide these features we share the minimum data necessary with LinkedIn (to publish your posts), Canva (to host and export your designs), and OpenAI (to generate images and captions). Each processes data under its own terms.

To request deletion of your account or any connected-app data, contact us at the details in the "Contact Us" section below.

If you have any questions about this Privacy Policy or how we handle your data, contact us at contact@stacky.global or +60 17‑318 3312.