Privacy Policy - Kyoik.com

Kyoik.com ("we", "us", or "our") is operated by Vessel Business Network (202003085850), registered in Malaysia.

We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website at https://kyoik.com, in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and the General Data Protection Regulation (GDPR).

1. Information We Collect

1.1 Account Information

When you create an account to access our courses, we collect:

Email address - to identify your account and communicate with you
Name (first and last) - to personalise your experience and certificates
Phone number (optional) - if provided during sign-up
Profile image - if provided through your authentication provider

Account creation and authentication is handled by Clerk, a third-party authentication service (see Section 6).

1.2 Enquiry Form Information

When you fill in our enquiry form, we collect:

Name - to identify and address you
Email address - to respond to your inquiry
Phone number (optional) - to contact you if needed
Training topic (optional) - to understand your needs
Introducer (optional) - who referred you to us
Message (optional) - additional details you share

1.3 Information Collected Automatically

When you browse our website, we may automatically collect:

Usage data - pages visited, time spent, click patterns
Device information - browser type, operating system, screen size
IP address - approximate geographic location
Referral source - how you found our website

This data is collected through cookies and similar technologies (see Section 5).

1.4 Enrolment Data

When you enrol in a course, we store the following in our database:

Course enrolment record - which courses you have enrolled in and when
Account details - your name, email, phone number, and profile image (synced from your Clerk account)

This data is stored on our servers in a Neon PostgreSQL database (see Section 6).

1.5 Course Progress Data

When you use our courses, the following data is stored locally in your browser (localStorage):

Module completion status - which modules you have completed
Quiz scores - your scores on module quizzes
Content progress - which content steps you have reached
Chat history - your conversations with the AI course assistant (up to 20 messages)

This data is stored only in your browser and is not transmitted to our servers. You can clear this data at any time by clearing your browser's local storage for this site.

1.6 AI Service Data

Our mini courses include AI-powered features that send data to third-party AI services:

Text-to-Speech - course text content is sent to an AI service to generate audio narration
AI Course Assistant - your chat messages (up to 1,000 characters each) and relevant course content are sent to an AI service to generate responses

These requests are processed through our server and do not include your name, email, or other personal identifiers. See Section 6 for details on the AI services we use.

1.7 Certificate Claims

When you complete a course and claim a certificate, we collect:

Name - for the certificate
Email address - to deliver the certificate
Phone number (required) - for follow-up if needed

Your email address is taken from your signed-in account rather than typed into the form. The request is submitted to our own server, stored in our Neon PostgreSQL database, and notified to us by email through Resend. It is shared with Kyoik and the course leader to support your learning.

1.8 Correspondence

We may also collect information from emails, WhatsApp messages, and other communications exchanged in the course of serving you.

2. How We Collect It

Account registration - When you sign up, your account is created and managed by Clerk. Your name, email, and profile data are stored by Clerk and synced to our database.
Course enrolment - When you enrol in a course, your enrolment record is saved to our Neon PostgreSQL database.
Enquiry forms - When you send an enquiry, it is submitted to our own server and emailed to us through Resend. To limit spam we briefly keep a one-way hash of the sender's IP address, which cannot be turned back into an address, and delete it within 24 hours. Your enquiry itself is not stored in our database.
Certificate requests - When you request a certificate, the request is sent to our own server and saved to our Neon PostgreSQL database. We are notified by email through Resend, and so is the course leader.
Google Analytics - We use Google Analytics (GA4) to understand how visitors use our site. This is only activated if you accept cookies via our consent banner.
Browser local storage - Course progress and chat history are stored automatically in your browser when you use our courses.
AI services - When you use text-to-speech or the AI course assistant, course content and your chat messages are sent to third-party AI services via our server.
Email and WhatsApp - Communications you send to us directly.

3. How We Use Your Information

We use the information we collect for the following purposes:

To manage your account - authenticating you and providing access to courses
To track enrolments - recording which courses you have enrolled in and displaying them on your dashboard
To issue certificates - generating and delivering course completion certificates
To respond to your inquiries - when you contact us through our form
To provide our services - creating courses based on your requirements
To improve our website - understanding how visitors use our site to enhance the experience
To analyse website traffic - monitoring site performance and visitor trends
To comply with legal obligations - where required by law

4. Legal Basis for Processing

Under PDPA (Malaysia)

We process your personal data based on your consent, which you provide when submitting our contact form or accepting cookies on our website. You may withdraw your consent at any time by contacting us.

Under GDPR (EU/EEA visitors)

We process your data based on:

Consent (Article 6(1)(a)) - for analytics cookies and marketing communications
Legitimate interest (Article 6(1)(f)) - for website security and basic functionality
Contractual necessity (Article 6(1)(b)) - when you engage us for our services

5. Cookies and Tracking Technologies

Our website uses cookies to enhance your browsing experience and analyse website traffic.

5.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. They help us understand how you use our site and improve your experience.

5.2 Cookies We Use

Cookie	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes unique visitors to track site usage	2 years
_ga_*	Google Analytics	Maintains session state for analytics	2 years
cookie_consent	Kyoik.com	Stores your cookie preference	1 year
__session	Clerk	Maintains your signed-in session	Session / up to 7 days
__client_uat	Clerk	Tracks authentication state for session management	Session / up to 7 days

5.3 Local Storage

In addition to cookies, our mini courses use browser local storage to save your progress:

Key	Purpose	Duration
kyoik_<course>_v1	Stores course progress, quiz scores, knowledge check answers, and chat history for each mini course	Until manually cleared
cert_kyoik_<course>_v1	Remembers that you have already requested a certificate for that course, so the page shows your confirmation instead of the form	Until manually cleared
kyoik_enrol_<course>	Caches whether you are enrolled in a course so the page renders correctly before the server responds	Until manually cleared
pwa_dismissed	Remembers that you dismissed the "add to home screen" prompt	Until manually cleared
cookie_consent	Stores your cookie consent preference	Until manually cleared

We also use browser session storage for one item, kyoik_avatar_url, which caches your profile image address so it appears immediately on the next page. It is cleared when you sign out or close the tab.

Local storage data stays on your device and is not sent to our servers. You can clear it at any time through your browser settings.

5.4 Managing Cookies

When you first visit our website, you will see a cookie consent banner. You can:

Accept - allow all cookies including analytics
Decline - only essential cookies (cookie preference) will be stored

If you click Decline, no Google Analytics scripts are loaded and no tracking cookies are set.

You can also manage cookies through your browser settings. Note that disabling cookies may affect your browsing experience. You can change your cookie preference at any time by clearing your browser's local storage for this site.

6. Third-Party Services

We use the following third-party services that may process your data:

6.1 Google Analytics

We use Google Analytics to understand how visitors interact with our website. Google Analytics collects data such as pages visited, session duration, and general location. This data is aggregated and anonymised. Google's privacy policy: https://policies.google.com/privacy.

You can opt out of Google Analytics by declining cookies on our website or by installing the Google Analytics Opt-out Browser Add-on.

6.2 Clerk (Authentication)

We use Clerk to manage user accounts, sign-up, sign-in, and session management. When you create an account, Clerk collects and stores your email address, name, phone number (if provided), and profile image. Clerk sets session cookies on your device to maintain your signed-in state. Clerk's privacy policy: https://clerk.com/legal/privacy.

6.3 Neon (Database)

We use Neon, a serverless PostgreSQL database service, to store your enrolment records and account details (synced from Clerk). This data is stored securely and used solely for providing course access and your dashboard. Neon's privacy policy: https://neon.tech/privacy-policy.

6.4 Resend (Email Delivery)

We use Resend to send our own notification emails, such as when you send us an enquiry, enrol in a course, or request a certificate. Your name, email address, phone number, and the course concerned are included in that notification so we and the course leader can act on it. Resend's privacy policy: https://resend.com/legal/privacy-policy.

6.5 OpenRouter (AI Services)

Our mini courses use AI-powered features provided through OpenRouter, which routes requests to AI models:

Text-to-Speech - course text is sent to generate audio narration
AI Course Assistant - your chat messages and course content are sent to generate conversational responses

These requests are made through our server. No personal identifiers (name, email, etc.) are included in the requests. OpenRouter's privacy policy: https://openrouter.ai/privacy.

6.6 YouTube

Our mini courses embed YouTube videos using the privacy-enhanced mode (youtube-nocookie.com). This means YouTube does not set tracking cookies on your device until you play a video. When you play a video, YouTube may collect usage data according to their privacy policy. Google's privacy policy: https://policies.google.com/privacy.

6.7 Google Fonts

We load fonts from Google Fonts (fonts.googleapis.com). When you visit our website, your browser makes a request to Google's servers to download the font files. This may transmit your IP address and browser information to Google. Google Fonts' privacy information: https://developers.google.com/fonts/faq/privacy.

6.8 Vercel (Hosting)

Our website and its server-side routes are hosted on Vercel. Every request to kyoik.com passes through Vercel's infrastructure, which processes technical data such as your IP address, browser type, and the pages requested in order to serve the site and keep it secure. Vercel's privacy policy: https://vercel.com/legal/privacy-policy.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share your data only in these circumstances:

Service providers - third-party tools listed in Section 6, strictly for the purposes described
Course leaders - when you claim a certificate, your name, email, and phone number are shared with the course leader to support your learning
Legal requirements - if required by law, regulation, or legal process
Business transfers - in the event of a merger, acquisition, or sale of assets

8. Data Retention

We retain your personal data only for as long as necessary:

Account data - retained for as long as your account is active. You may request account deletion at any time by contacting us
Enrolment records - retained for as long as your account is active, or until you request deletion
Enquiry submissions - the email we receive is retained for up to 2 years after your last interaction with us, or until you request deletion
Anti-spam records - the one-way hash of an enquiry sender's IP address is deleted within 24 hours
Certificate requests - the name, account email, phone number, and course you requested are retained for as long as your account is active, or until you request deletion. The record is also what prevents a duplicate request for the same course
Analytics data - retained in Google Analytics for 14 months, after which it is automatically deleted
Cookie consent preferences - stored in your browser for 1 year
Authentication cookies - Clerk session cookies expire at the end of your browser session or after 7 days
Course progress and chat history - stored in your browser's local storage until you clear it. This data is not retained on our servers
AI service requests - text-to-speech and chat requests are processed in real time and are not stored on our servers. Refer to OpenRouter's privacy policy for their data retention practices

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

HTTPS encryption for all data transmitted to and from our website
Secure third-party services with their own security measures
Limited access to personal data on a need-to-know basis

While we strive to protect your personal data, no method of internet transmission is 100% secure. We cannot guarantee absolute security.

10. Your Rights

Under PDPA (Malaysia)

You have the right to:

Access your personal data held by us
Correct any inaccurate or incomplete data
Withdraw consent for data processing
Request deletion of your personal data

Under GDPR (EU/EEA visitors)

In addition to the above, you also have the right to:

Data portability - receive your data in a structured, machine-readable format
Restrict processing - limit how we use your data
Object to processing - object to processing based on legitimate interest
Lodge a complaint - with your local data protection authority

To exercise any of these rights, including requesting deletion of your account and all associated data, please contact us at hi@kyoik.com. We will respond to your request within 21 days (PDPA) or 30 days (GDPR).

11. International Data Transfers

Our website is hosted and may process data outside of Malaysia and the EU/EEA. When data is transferred internationally, we ensure appropriate safeguards are in place through the use of reputable service providers who comply with applicable data protection laws.

12. Business Transfers

If our business is sold or transferred to another party, your personal data may be disclosed to the new owners to enable them to continue operating the business. We will take reasonable steps to ensure that your personal data remains protected and is used solely for the purposes for which it was collected. We will comply with all applicable data protection laws when disclosing personal data in the context of a business transfer.

13. Children's Privacy

Our services are intended for professionals and business owners. We do not knowingly collect personal data from children under 18. If you believe we have collected data from a child, please contact us immediately at hi@kyoik.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make changes, we will update the "Last updated" date at the top of this page. The latest version of this policy is always available on this page. We encourage you to review this policy periodically.

Changelog

Date	Changes
25 Aug 2026	Enquiry forms moved from Web3Forms to our own server, delivered by Resend, with a short-lived hashed IP record for spam prevention. Web3Forms is no longer used and has been removed from the third-party services list.
25 Aug 2026	Certificate requests moved from Web3Forms to our own server: the email address now comes from your signed-in account, the request is stored in our Neon database, and a phone number is required. Added disclosures for Resend (email delivery) and Vercel (hosting), corrected the local storage key list, and added certificate request retention.
16 Apr 2026	Added disclosures for Clerk authentication (account data, session cookies), Neon PostgreSQL database (enrolment records), certificate claim data sharing with course leaders, and updated data retention and third-party service sections accordingly.
13 Mar 2026	Initial version. Covers contact forms, Google Analytics, course progress (localStorage), AI services (TTS and chat via OpenRouter), YouTube embeds, Google Fonts, cookie consent, and PDPA/GDPR compliance.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Email: hi@kyoik.com