Privacy Policy

1. Scope of this Policy

This Policy covers this website only. We operate separate products — YM Tutor (tutor.taufik.app), YM Chess (chess.taufik.app), YM POS (pos.taufik.app) and YM Reno (reno.taufik.app) — each of which publishes its own privacy policy describing how personal data is handled within that product.

2. Personal data we collect

2.1 Hosting and request logs

Standard web request logs are generated by our hosting provider (Cloudflare, Inc.) in the course of delivering the site. These typically include the requester's IP address, user-agent string, requested URL, response status, and timestamp. We do not access, retain, or analyse these logs ourselves.

2.2 Analytics (Google Analytics 4)

We use Google Analytics 4 (property G-QXG9V6V7Q0) to understand how visitors use the site so we can improve it. Google Analytics collects:

• a pseudonymous client identifier stored in cookies (see Section 3);
• pages visited, referring URL, session duration, and basic event interactions (clicks, scrolls, outbound links);
• approximate location (city / region level, derived from IP); and
• device, browser, operating system, and language settings.

Google Analytics 4 does not store full IP addresses, and we have not enabled Google Signals, ad personalization, or cross-property identity features for this property.

We use Google Consent Mode v2. On your first visit, we ask whether you consent to analytics. Until you click Accept, Google Analytics is loaded in consent-denied mode and no analytics cookies are set or measurement events sent. If you click Decline (or take no action), the scripts remain in consent-denied mode. You can change your choice at any time by clearing this site's data in your browser, which will cause the consent banner to reappear on your next visit.

2.3 Contact form submissions

The contact form on this site is delivered as an embedded iframe from our feedback service at feedback.taufik.app. Any information you submit (such as your name, email address, and message) is sent to and stored on that service, which we operate. We use submissions solely to respond to your enquiry.

3. Cookies and similar technologies

If you grant consent via the banner described in Section 2.2, the following cookies are set on this site, all of them placed by Google Analytics. Without consent, no cookies are set.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, by enabling "Do Not Track" or equivalent settings in your browser, or by blocking the cookies listed above via your browser's privacy controls.

4. Purposes and lawful basis

Under section 6 of the Personal Data Protection Act 2010 (PDPA), we process the data described above on the following bases:

• Delivery of the site: hosting and request logs are necessary for the performance of a transaction you have initiated (loading the requested page).
• Analytics: our legitimate interest in understanding aggregate usage of the site in order to improve it.
• Contact form submissions: necessary to take steps at your request prior to entering into any engagement, and to respond to your enquiry.

5. Third-party processors

We rely on the following processors:

Cloudflare's processing is governed by its own Privacy Policy; Google's by its Privacy Policy.

6. Cross-border transfer

Because Cloudflare operates a global edge network and Google processes analytics data in the United States and other regions, your data may be processed at locations outside Malaysia. We rely on each processor's contractual safeguards and on section 129 of the PDPA in respect of any such cross-border transfer.

7. Retention

• Hosting logs: retained by Cloudflare in line with its own retention policy; not stored by us.
• Analytics data: retained in line with our Google Analytics property settings (2 months for user-level data and 14 months for event-level data by default).
• Contact form submissions: retained only for as long as needed to address your enquiry, then deleted or anonymised.

8. Security

The site is served over HTTPS with HSTS and standard browser-side security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy).

9. Your rights under the PDPA

You have the right to:

• request access to any personal data we hold about you;
• request correction of inaccurate or incomplete data;
• withdraw any consent previously given;
• limit the processing of your personal data; and
• lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of these rights, contact us using the details in Section 12.

10. Children's data

This site is not directed at children. YM Tutor, which is intended to be used by parents on behalf of their children, handles children's data under its own privacy policy.

11. Changes to this Policy

We may update this Policy from time to time. The "Effective" date above will be updated to reflect material changes.

12. Contact

For privacy-related enquiries or to exercise your PDPA rights, please reach us via: