Your data, handled with care.

Reka Bytes (“Reka Bytes”, “we”, “us”, “our”) operates this learning platform. The legal entity that is the data controller of your personal data is Rekabytes Enterprise (registration no. 202503277241 (IP0614333-M)), a business registered in Malaysia under the Registration of Businesses Act 1956, which is not a separate legal person.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website, apply to a cohort, or use our learning platform. We process your personal data in accordance with the Personal Data Protection Act 2010 (“PDPA”) and the regulations made under it.

• Directly from you — when you register an account, submit an application, complete a lesson or quiz, upload a file to the AI Masterclass, or contact us.
• Automatically — through cookies and similar technologies (see our Cookies Policy).
• We do not purchase personal data from data brokers and we do not use third-party advertising trackers.

We process your personal data for the following purposes, each a permissible ground under the PDPA:

1. Service delivery — operating the learning platform, tracking your progress, generating quizzes, awarding XP and badges.
2. Application review — evaluating your suitability for a cohort; storing decisions and reviewer notes.
3. AI generation — for the AI Masterclass, sending your uploaded PDF to a third-party language model (see §5) to analyse and produce course outlines, lessons, and quizzes.
4. Communications — sending service emails (account, application status, security alerts). Marketing emails are only sent with your explicit consent.
5. Safety & integrity — protecting against abuse, debugging, fraud prevention, and enforcing our Terms of Use.
6. Legal compliance — record-keeping as required by Malaysian law.

We do not sell your personal data. We disclose it only as follows:

• Cloud hosting & database — our hosting provider, currently Supabase Pte. Ltd. (Singapore) .
• AI processing— for the AI Masterclass, uploaded PDFs and generation prompts are sent to large language models accessed via OpenRouter (US) and Boundary ML's BAML runtime. PDFs are deleted from our servers after generation; please review those providers' policies for their retention practices.
• Service providers — strictly to subprocessors who help us operate the platform (hosting, email delivery, error monitoring). Each is bound by confidentiality and data-processing obligations no less protective than this Policy.
• Legal — where compelled by a Malaysian court order, statutory body, or to protect our legal rights.

Where personal data is transferred outside Malaysia, we take reasonable steps to ensure the recipient is bound by PDPA-equivalent or comparable data-protection obligations.

The Reka Bytes AI Masterclass uses generative AI to create course outlines, lessons, and quizzes from material you upload. AI-generated content may contain errors, bias, or material you do not have the right to reproduce. We review generated content before publication where feasible, but we do not guarantee its accuracy. AI outputs are not professional, legal, medical, or financial advice. Your uploaded source files are deleted from our servers once generation completes; we may retain anonymised generation metadata (job ID, timing, schema version) for service improvement.

We retain personal data only for as long as necessary to fulfil the purposes in §4 or to comply with legal, accounting, or reporting obligations. In practice:

• Account data — for the life of your account; deleted within 30 days of closure.
• Application data — 24 months after final decision, then deleted.
• Learning progress & XP — 36 months after last activity, then anonymised.
• AI Masterclass source PDFs — deleted within 24 hours of generation completion.
• Server logs — 90 days, then purged.
• Backups — [[retention window]].

We use industry-standard safeguards appropriate to the sensitivity of the data: TLS in transit, encrypted-at-rest database storage, bcrypt password hashing, HTTP-only session cookies, principle-of-least-privilege access controls for staff, and an audit log of administrative actions. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the PDP Commissioner as required by law.

Subject to the PDPA, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — request that inaccurate data be corrected.
• Withdraw consent — at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Stop processing for direct marketing — we will honour this immediately.
• Delete / erase — subject to retention obligations in §7.

To exercise these rights, email [email protected] from the address on your account. We will respond within 21 days. If you are unsatisfied with our response, you may lodge a complaint with the Jabatan Perlindungan Data Peribadi (PDP).

Reka Bytes is intended for users aged 18 and above, or 13 and above with verifiable parental consent. We do not knowingly collect personal data from children below these thresholds. If you believe a child has provided us data in violation of this Policy, contact us and we will delete it.

We may update this Policy from time to time. Material changes will be notified via email (where you have an account) and a prominent notice on this page. The “Last updated” date at the top reflects the current version. Continued use of the service after a change constitutes acceptance, except where a new purpose requires fresh consent under the PDPA.