Customer privacy notice
Who is responsible and what this covers
EPFMy DigitalX Services, a sole proprietorship registered in Malaysia under registration number 201703276454 (002693550-D), based in Cyberjaya, is responsible for the personal information described in this notice. Contact us at hello@epf.my or +60 19-330 5580 for privacy questions or requests.
This shared notice covers customer contact, subscription administration, payments and support for products that expressly refer to it. Read it together with the relevant product privacy notice. The product notice explains its account information, stored content, hosting, cookies, integrations and deletion arrangements. It supplements this notice and identifies any product-specific differences. It does not extend to unrelated products simply because they also use Stripe.
Our website privacy notice covers visits to epf.my and general service enquiries. Our products remain in development; the payment sections below describe the intended arrangements for products that launch with Stripe. They do not mean that subscriptions are currently available.
Information involved in billing and support
When you subscribe to an available product, billing information may include your name, email address, billing address and tax details where needed, chosen product and plan, customer and subscription identifiers, amounts, currency, invoices, payment status, cancellation requests, refunds and disputes. We receive information from you, the product's billing integration and Stripe as needed to administer the purchase.
Payments use Stripe-hosted Checkout, and payment-method updates use the Stripe-hosted customer billing portal. Stripe receives the payment information entered through those interfaces and may collect device, browser, IP address and transaction information to process payments and prevent fraud. We receive billing details and payment status from Stripe. This integration does not provide us with full card numbers or card security codes, and we do not store them. The information available to us can include payment-method type and limited details such as a card's last digits and expiry date. Do not send card numbers or security codes through email or WhatsApp.
If you ask for support, we receive your contact information, messages, attachments and information needed to investigate your request. Share only information relevant to the issue; avoid including unrelated financial records or account credentials such as passwords or authentication codes.
Why we use this information
We use it to administer purchases and access entitlements, process and reconcile payments, send invoices and service notices, handle renewals and cancellations, respond to support requests, investigate billing errors and disputes, prevent misuse, keep necessary business records and meet applicable obligations.
Billing and security messages are operational communications. Buying a product does not by itself subscribe you to unrelated marketing messages. Any optional marketing permission will be handled separately.
You choose whether to purchase and supply the requested information. Without the details necessary for a transaction, we may be unable to complete payment, issue an invoice or provide paid access. Optional information will be identified where it is requested. Information needed for fraud prevention or required records may be necessary even if you decline optional features.
Providers and disclosures
Stripe provides payment and subscription services for products that use it. It processes information on our behalf for some activities and for its own purposes for other activities, including fraud prevention and meeting financial and legal obligations. See Stripe's privacy policy for its practices. Stripe's notice supplements this notice; it does not replace our responsibility to explain what we do.
Microsoft 365 Business Basic stores and processes support email. If you choose WhatsApp Business, WhatsApp processes service information under its privacy policy, and we receive your messages and available profile/contact information. WhatsApp's in-app chat backups are stored in Apple iCloud with WhatsApp end-to-end encrypted backup enabled. Apple processes service-related information under its privacy policy. We do not record support calls or keep separate call notes; written follow-ups use email or WhatsApp.
Cloudflare delivers epf.my and may process technical request information for delivery and security. Each product's notice identifies its own hosting, authentication and other relevant providers. We do not currently use a CRM or submit support correspondence to AI tools. Product AI or MCP features require their own explanation of permissions and data flows before use.
We may disclose relevant information to authorities where required by law or where necessary to establish, exercise or defend legal claims. We do not sell customer contact or billing information. We do not send product content to Stripe merely because it processes subscriptions; any content involved in support or a dispute must be assessed for relevance and explained where required.
Overseas processing
Stripe and our communication and hosting providers may process information outside Malaysia. Locations and arrangements can depend on the provider and the product. We will identify relevant product arrangements in its privacy notice and assess applicable transfer requirements before introducing a new processing arrangement. We do not promise that all information remains in Malaysia.
Retention and protection
We retain billing, invoice, refund and dispute records for as long as needed to administer transactions and meet applicable accounting, tax and legal requirements. Cancellation does not necessarily permit immediate deletion of those records. Product account and content retention periods, including deletion and backup handling, are explained in the product notice rather than inferred from the subscription end date.
We review correspondence every three months and remove information no longer needed. Unsuccessful enquiries inactive for at least 12 months are normally deleted during those reviews unless a specific continuing need applies. The 12 months are counted from the last communication about that enquiry; we may delete information sooner when it is no longer needed. Support records for existing or former customers may need to be retained for ongoing service, billing or dispute matters; the unsuccessful-enquiry rule is not a promise to erase all customer records after 12 months.
We use account and device security, limit access to those who need it and review what we retain. Provider backups or recovery systems may hold copies temporarily under their processes. Stripe may retain information independently for its own legal obligations. No transmission or storage system is completely secure.
Your choices and requests
You may contact us to request access, correction, deletion where applicable, limits on processing or withdrawal of consent where applicable, or to raise a concern. We may need to verify your identity. We will explain any legal limits and effects on your service before acting. Withdrawal does not necessarily require deletion of records that must be retained by law.
You may request by email that we transmit your personal information directly to another data controller of your choice, subject to applicable legal requirements, technical feasibility and compatibility of the data format. You may also complain to the Personal Data Protection Commissioner through the official complaint portal.
To exercise rights concerning Stripe's independent processing, you may also contact Stripe through its privacy channels. Contact us for information we control; we will explain where a request needs to be handled by a provider separately.
Product notices and changes
No product-specific privacy notices are published yet. Futoroku is in development. Before a product collects account or feature data, its notice will be available from that product and linked here. Its notice will address matters such as expense records, uploads, connected tools and MCP access if those features are offered.
We will update this notice when practices change, show the effective date, and notify affected customers of material changes as appropriate. The English and Bahasa Malaysia versions are intended to describe the same practices.