Privacy Policy

Kyoik.com ("we", "us", or "our") is operated by Vessel Business Network (202003085850), registered in Malaysia.

We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website at https://kyoik.com, in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and the General Data Protection Regulation (GDPR).

1. Information We Collect

1.1 Account Information

When you create an account to access our courses, we collect:

• Email address - to identify your account and communicate with you
• Name (first and last) - to personalise your experience and certificates
• Phone number (optional) - if provided during sign-up
• Profile image - if provided through your authentication provider

Account creation and authentication is handled by Clerk, a third-party authentication service (see Section 6).

1.2 Contact Form Information

When you fill in our contact form, we collect:

• Name - to identify and address you
• Email address - to respond to your inquiry
• Phone number (optional) - to contact you if needed
• Training topic - to understand your needs
• Message (optional) - additional details you share

1.3 Information Collected Automatically

When you browse our website, we may automatically collect:

• Usage data - pages visited, time spent, click patterns
• Device information - browser type, operating system, screen size
• IP address - approximate geographic location
• Referral source - how you found our website

This data is collected through cookies and similar technologies (see Section 4).

1.4 Enrolment Data

When you enrol in a course, we store the following in our database:

• Course enrolment record - which courses you have enrolled in and when
• Account details - your name, email, phone number, and profile image (synced from your Clerk account)

This data is stored on our servers in a Neon PostgreSQL database (see Section 6).

1.5 Course Progress Data

When you use our courses, the following data is stored locally in your browser (localStorage):

• Module completion status - which modules you have completed
• Quiz scores - your scores on module quizzes
• Content progress - which content steps you have reached
• Chat history - your conversations with the AI course assistant (up to 20 messages)

This data is stored only in your browser and is not transmitted to our servers. You can clear this data at any time by clearing your browser's local storage for this site.

1.6 AI Service Data

Our mini courses include AI-powered features that send data to third-party AI services:

• Text-to-Speech - course text content is sent to an AI service to generate audio narration
• AI Course Assistant - your chat messages (up to 1,000 characters each) and relevant course content are sent to an AI service to generate responses

These requests are processed through our server and do not include your name, email, or other personal identifiers. See Section 6 for details on the AI services we use.

1.7 Certificate Claims

When you complete a course and claim a certificate, we collect:

• Name - for the certificate
• Email address - to deliver the certificate
• Phone number (optional) - for follow-up if needed

This information is submitted via Web3Forms and is shared with Kyoik and the course leader to support your learning.

1.8 Correspondence

We may also collect information from emails, WhatsApp messages, and other communications exchanged in the course of serving you.

2. How We Collect It

• Account registration - When you sign up, your account is created and managed by Clerk. Your name, email, and profile data are stored by Clerk and synced to our database.
• Course enrolment - When you enrol in a course, your enrolment record is saved to our Neon PostgreSQL database.
• Contact and certificate forms - Our website forms are processed by Web3Forms, a third-party form service. Your name, email, phone, and message are sent to Web3Forms and then forwarded to us (and to the course leader for certificate claims).
• Google Analytics - We use Google Analytics (GA4) to understand how visitors use our site. This is only activated if you accept cookies via our consent banner.
• Browser local storage - Course progress and chat history are stored automatically in your browser when you use our courses.
• AI services - When you use text-to-speech or the AI course assistant, course content and your chat messages are sent to third-party AI services via our server.
• Email and WhatsApp - Communications you send to us directly.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To manage your account - authenticating you and providing access to courses
• To track enrolments - recording which courses you have enrolled in and displaying them on your dashboard
• To issue certificates - generating and delivering course completion certificates
• To respond to your inquiries - when you contact us through our form
• To provide our services - creating courses based on your requirements
• To improve our website - understanding how visitors use our site to enhance the experience
• To analyse website traffic - monitoring site performance and visitor trends
• To comply with legal obligations - where required by law

4. Legal Basis for Processing

Under PDPA (Malaysia)

We process your personal data based on your consent, which you provide when submitting our contact form or accepting cookies on our website. You may withdraw your consent at any time by contacting us.

Under GDPR (EU/EEA visitors)

We process your data based on:

• Consent (Article 6(1)(a)) - for analytics cookies and marketing communications
• Legitimate interest (Article 6(1)(f)) - for website security and basic functionality
• Contractual necessity (Article 6(1)(b)) - when you engage us for our services

5. Cookies and Tracking Technologies

Our website uses cookies to enhance your browsing experience and analyse website traffic.

5.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. They help us understand how you use our site and improve your experience.

5.2 Cookies We Use

5.3 Local Storage

In addition to cookies, our mini courses use browser local storage to save your progress:

Local storage data stays on your device and is not sent to our servers. You can clear it at any time through your browser settings.

5.4 Managing Cookies

When you first visit our website, you will see a cookie consent banner. You can:

• Accept - allow all cookies including analytics
• Decline - only essential cookies (cookie preference) will be stored

If you click Decline, no Google Analytics scripts are loaded and no tracking cookies are set.

You can also manage cookies through your browser settings. Note that disabling cookies may affect your browsing experience. You can change your cookie preference at any time by clearing your browser's local storage for this site.

6. Third-Party Services

We use the following third-party services that may process your data:

6.1 Google Analytics

We use Google Analytics to understand how visitors interact with our website. Google Analytics collects data such as pages visited, session duration, and general location. This data is aggregated and anonymised. Google's privacy policy: https://policies.google.com/privacy.

You can opt out of Google Analytics by declining cookies on our website or by installing the Google Analytics Opt-out Browser Add-on.

6.2 Web3Forms

Our contact form submissions are processed through Web3Forms. When you submit our contact form, your data is sent to Web3Forms for delivery to our email. Web3Forms' privacy policy: https://web3forms.com/privacy.

6.3 Clerk (Authentication)

We use Clerk to manage user accounts, sign-up, sign-in, and session management. When you create an account, Clerk collects and stores your email address, name, phone number (if provided), and profile image. Clerk sets session cookies on your device to maintain your signed-in state. Clerk's privacy policy: https://clerk.com/legal/privacy.

6.4 Neon (Database)

We use Neon, a serverless PostgreSQL database service, to store your enrolment records and account details (synced from Clerk). This data is stored securely and used solely for providing course access and your dashboard. Neon's privacy policy: https://neon.tech/privacy-policy.

6.5 OpenRouter (AI Services)

Our mini courses use AI-powered features provided through OpenRouter, which routes requests to AI models:

• Text-to-Speech - course text is sent to generate audio narration
• AI Course Assistant - your chat messages and course content are sent to generate conversational responses

These requests are made through our server. No personal identifiers (name, email, etc.) are included in the requests. OpenRouter's privacy policy: https://openrouter.ai/privacy.

6.6 YouTube

Our mini courses embed YouTube videos using the privacy-enhanced mode (youtube-nocookie.com). This means YouTube does not set tracking cookies on your device until you play a video. When you play a video, YouTube may collect usage data according to their privacy policy. Google's privacy policy: https://policies.google.com/privacy.

6.7 Google Fonts

We load fonts from Google Fonts (fonts.googleapis.com). When you visit our website, your browser makes a request to Google's servers to download the font files. This may transmit your IP address and browser information to Google. Google Fonts' privacy information: https://developers.google.com/fonts/faq/privacy.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share your data only in these circumstances:

• Service providers - third-party tools listed in Section 6, strictly for the purposes described
• Course leaders - when you claim a certificate, your name, email, and phone number are shared with the course leader to support your learning
• Legal requirements - if required by law, regulation, or legal process
• Business transfers - in the event of a merger, acquisition, or sale of assets

8. Data Retention

We retain your personal data only for as long as necessary:

• Account data - retained for as long as your account is active. You may request account deletion at any time by contacting us
• Enrolment records - retained for as long as your account is active, or until you request deletion
• Contact form submissions - retained for up to 2 years after your last interaction with us, or until you request deletion
• Analytics data - retained in Google Analytics for 14 months, after which it is automatically deleted
• Cookie consent preferences - stored in your browser for 1 year
• Authentication cookies - Clerk session cookies expire at the end of your browser session or after 7 days
• Course progress and chat history - stored in your browser's local storage until you clear it. This data is not retained on our servers
• AI service requests - text-to-speech and chat requests are processed in real time and are not stored on our servers. Refer to OpenRouter's privacy policy for their data retention practices

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data transmitted to and from our website
• Secure third-party services with their own security measures
• Limited access to personal data on a need-to-know basis

While we strive to protect your personal data, no method of internet transmission is 100% secure. We cannot guarantee absolute security.

10. Your Rights

Under PDPA (Malaysia)

You have the right to:

• Access your personal data held by us
• Correct any inaccurate or incomplete data
• Withdraw consent for data processing
• Request deletion of your personal data

Under GDPR (EU/EEA visitors)

In addition to the above, you also have the right to:

• Data portability - receive your data in a structured, machine-readable format
• Restrict processing - limit how we use your data
• Object to processing - object to processing based on legitimate interest
• Lodge a complaint - with your local data protection authority

To exercise any of these rights, including requesting deletion of your account and all associated data, please contact us at hi@kyoik.com. We will respond to your request within 21 days (PDPA) or 30 days (GDPR).

11. International Data Transfers

Our website is hosted and may process data outside of Malaysia and the EU/EEA. When data is transferred internationally, we ensure appropriate safeguards are in place through the use of reputable service providers who comply with applicable data protection laws.

12. Business Transfers

If our business is sold or transferred to another party, your personal data may be disclosed to the new owners to enable them to continue operating the business. We will take reasonable steps to ensure that your personal data remains protected and is used solely for the purposes for which it was collected. We will comply with all applicable data protection laws when disclosing personal data in the context of a business transfer.

13. Children's Privacy

Our services are intended for professionals and business owners. We do not knowingly collect personal data from children under 18. If you believe we have collected data from a child, please contact us immediately at hi@kyoik.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make changes, we will update the "Last updated" date at the top of this page. The latest version of this policy is always available on this page. We encourage you to review this policy periodically.

Changelog

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Email: hi@kyoik.com