Privacy Policy

1. Who we are

Tanyalah Ustaz API is operated by Hikmah Tech (Business Registration No. 003599417-X), based in Malaysia.

For your developer account, we are the data controller. For your end users' data that you send us through the API, you are generally the controller and we act as a data processor on your instructions.

2. Information we collect

Information you provide: your name, company name, email address, and password (stored hashed, never in plain text).

Billing information: your credit balance, top-up history, and payment references. Card and bank details are handled by our payment gateway, ToyyibPay, and we do not store them.

Information collected automatically: API requests, chat messages and responses, session identifiers, token counts and costs, IP address, timestamps, and error logs.

Partner knowledge data: files you upload and the text extracted from them, used only to answer your own requests.

3. How we use your information

Providing the service: answering requests and retrieving relevant knowledge.

Billing: charging usage correctly and keeping accurate credit records.

Platform improvement: enhancing user experience and developing new features.

Communication: responding to inquiries and sending transactional email, such as email verification and low-credit alerts.

Security and legal compliance: protecting against fraudulent activity and meeting our legal, tax, and accounting obligations.

4. Queries sent through the API

When your product sends a request, we process the message so we can generate an answer and retrieve relevant knowledge. We also store the request and response as a chat log, so you can review your own usage in your dashboard.

We do not use your end users' questions to train our own models, and we do not sell query content. Query content is sent to our AI model provider to generate the answer, as described in section 5.

Because the requests come from your product, we treat the content as yours and your end users' responsibility. Do not send data you are not entitled to send, and tell your users how their questions are handled.

5. Data sharing

We do not sell your personal information, do not share it for marketing purposes, and do not disclose your religious inquiries.

We may share information with service providers who assist our operations, including cloud hosting, our database provider, AI model providers used to generate answers, our email provider, and our payment gateway. They only receive what they need and are bound by confidentiality obligations.

Your chat content is sent to the AI model provider to generate a response. Do not send personal or sensitive data you are not willing to have processed this way.

We may also disclose information where required by Malaysian law or legal process, or where necessary to protect our rights or the safety of others.

6. Where your data is stored

Our infrastructure and some of our service providers may store or process data outside Malaysia. Where we transfer personal data out of Malaysia, we take steps to ensure it remains protected to a standard consistent with the PDPA.

7. How long we keep it

We keep account and billing records for as long as your account is active, and afterwards for as long as we need to meet legal, tax, and accounting requirements.

Chat logs are kept so you can review your usage and can be deleted from your dashboard. Deleting your account removes your data, subject to records we must retain by law.

8. Your rights

Under the PDPA you have the right to access the personal information we hold about you, to request correction of inaccurate data, to request deletion (subject to legal requirements), to withdraw consent for data processing, and to lodge a complaint with the relevant authorities.

You can update most of your details in your settings. To exercise any of these rights, contact us at alustazai@gmail.com.

We may need to verify your identity before acting on a request, and some rights are limited by law.

9. Data security

We use technical and organisational measures to protect your data, including secure SSL encryption for data transmission, regular security reviews, hashed passwords, and limited access to personal data.

No system is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authority where the law requires it.

10. Cookies

We use only strictly necessary cookies. They keep you signed in, remember your language, and remember your light or dark theme choice. We do not use advertising, analytics, or third-party tracking cookies.

The API itself does not set cookies. Cookies only apply to the portal when you are signed in.

Because we only set strictly necessary cookies, there is no cookie consent banner. You can still block or delete cookies in your browser settings, but the portal may not work correctly if you block the session cookie.

11. Business users only

The developer portal is for business users aged 18 and over. We do not knowingly allow anyone under 18 to create an account, and we do not knowingly collect personal data from children.

If you believe a minor has created an account, contact us and we will close it.

12. Changes to this policy

We may update this policy periodically. Changes will be posted on this page with an updated revision date, and we will give notice of material changes.