Privacy Policy

1. Who We Are

404Found Studio is a web development and digital technology company based in Malaysia. We build websites, web applications, SaaS platforms, and digital systems for businesses. We also operate our own digital products and platforms.

For data protection purposes, 404Found Studio is the data controller for personal data collected through this website and our direct client engagements.

2. Data We Collect

We may collect the following categories of personal data:

Information you provide directly

• Name, email address, phone number submitted via contact forms or WhatsApp
• Business name and website URL when requesting a quote
• Conversation content submitted through our AI Consultant chat tool
• Project briefs, files, or documents you share with us during an engagement

Information collected automatically

• IP address, browser type, device type, and operating system
• Pages visited, time spent, and navigation patterns on this website
• Referral source (how you arrived at our website)

Information from third-party tools

• Google Analytics 4 — aggregated website traffic and behaviour data
• Microsoft Clarity — session recordings and heatmaps for UX improvement (anonymised)

We do not collect sensitive personal data (such as financial account details, health information, or national identity numbers) through this website.

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• To respond to enquiries — contacting you about your project request or consultation
• To provide our services — managing your project, communicating updates, and delivering agreed deliverables
• To process payments — issuing invoices and processing fees via our payment gateway partners
• To improve our website — analysing usage data to enhance user experience and content
• To send relevant communications — project updates, invoices, or (with your consent) occasional service updates
• To comply with legal obligations — retaining business and financial records as required by Malaysian law

We do not use your personal data for automated decision-making or profiling that produces legal or significant effects on you.

4. Legal Basis for Processing

Under PDPA 2010, we process your personal data on the following grounds:

• Consent — when you submit a contact form, start a chat, or provide your details voluntarily
• Contractual necessity — when we need your data to fulfil a service agreement with you
• Legitimate interests — for website analytics, portfolio display, and business improvement activities
• Legal obligation — for invoicing, tax records, and other regulatory compliance

5. Cookies

We use cookies and similar tracking technologies on this website. These include:

• Essential cookies — required for basic website functionality (e.g. theme preference)
• Analytics cookies — Google Analytics and Microsoft Clarity to understand how visitors use our site

You can control cookies through your browser settings. Disabling analytics cookies will not affect your ability to use this website, but may limit our ability to improve it.

Google Analytics data is processed under Google's Privacy Policy. Microsoft Clarity is processed under Microsoft's Privacy Statement. We have configured both tools to anonymise IP addresses where possible.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to third parties. We may share your data with:

• Payment gateway providers — to process project fees (e.g. ToyyibPay, Stripe, Billplz). These providers have their own privacy policies and handle payment data independently.
• Cloud and hosting providers — Cloudflare (website hosting and delivery), Supabase, and other infrastructure providers who process data on our behalf under data processing agreements.
• Communication tools — WhatsApp, email providers, for correspondence purposes.
• Legal authorities — if required by Malaysian law, court order, or government authority.

Where we share data with third-party processors, we ensure appropriate safeguards are in place.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy:

• Enquiry and contact data — 12 months from last contact, unless a project commences
• Client project data — 5 years after project completion (for business record-keeping and warranty purposes)
• Financial and invoice records — 7 years, as required under Malaysian tax and accounting law
• Website analytics data — 14 months (Google Analytics default retention)

After the retention period, data is securely deleted or anonymised.

8. Data from Our SaaS Platforms

We develop and operate SaaS platforms including but not limited to unlockedu.my, ezkhairat.com, kariah.my, and lokaljob.my. Each of these platforms has its own privacy policy governing data collected from users of those specific platforms.

Data processed through those platforms is governed by the relevant platform's privacy policy and the terms agreed with the respective platform operator (our client), who acts as the data controller. 404Found Studio acts as a data processor in relation to those platforms.

9. Your Rights Under PDPA 2010

As a data subject under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access — request a copy of personal data we hold about you
• Correction — request that inaccurate or incomplete data be corrected
• Withdrawal of consent — withdraw consent for us to process your data (where consent is the legal basis), subject to contractual obligations
• Limit processing — request that we restrict how we use your data in certain circumstances

To exercise any of these rights, please contact us using the details in Section 11. We will respond within 21 days of receiving your request. We may need to verify your identity before processing your request.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, or destruction. These include:

• HTTPS encryption for all data transmitted through this website
• Access controls limiting who within our team can access client data
• Use of reputable, security-certified infrastructure providers

Despite our efforts, no internet transmission is 100% secure. If you believe your data has been compromised, please contact us immediately.

11. Contact & Complaints

For any privacy-related queries, data access requests, or complaints, please contact our data officer:

If you are unsatisfied with our response, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) at pdp.gov.my.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated policy will be published on this page with a revised effective date. We encourage you to review this page periodically.