Privacy & data

This site is built to collect as little as possible, but not nothing. This is the full and honest list of what happens to your data here.

Last updated 21 September 2026.

Who we are

This site is run by ARTEYU LABS (SSM registration 202603194563), a sole proprietorship in Malaysia. For any question about your data, write to arteyulabs@gmail.com or WhatsApp 011-7620 0699. The owner answers these himself.

What is collected, and why

Forms on this site. When you leave a phone number in any form (for example on /nadi-rekod/ or the waitlist box on a product page), that number, your name if you gave one, and whatever you typed are sent to our server and stored in a private Google Sheet belonging to this business. There is exactly one purpose: replying to you. Giving us this is entirely optional; the WhatsApp button does the same job and leaves no record here.

WhatsApp buttons. When you press a WhatsApp button we record that a tap happened on that page, along with the ad campaign that brought you here. We do NOT record your number at that moment, and the record cannot be tied back to you. Whatever you send afterwards lives in WhatsApp and is subject to WhatsApp's policies.

Where you came from. If you arrive through an ad or a short link, the site reads the campaign markers in the URL (utm_source, utm_campaign and similar, including the click reference from Meta, TikTok or Google) and keeps them in your browser for up to 30 days, so that if you come back and ask a question we know which ad worked. These markers do not contain your name.

Language and display choices. Your BM/EN choice and display settings are stored in your browser only and are never sent anywhere.

Buying and paying. The email address you type at /beli/ goes to our server to raise the bill, is passed to the payment gateway, and is used to send the receipt and download link. We never see your bank account number or card number: that happens on the gateway's page, not ours. If you press Pay but do not complete the payment, we keep that address so we can ask whether something went wrong. You can ask us to delete it at any time.

Visit counting. Every page counts visits through Vercel Web Analytics and Cloudflare Web Analytics. Neither sets a cookie, neither identifies you, and neither builds a profile across other sites. They tell us how many people read a page, not who.

Ad measurement. If you allow it (see the section below), Meta and Google measure your visit so we can tell which ads produce results. This is NOT installed unless you press Allow. If you do not answer, or you answer No, none of it loads.

Server logs. Vercel and Cloudflare keep ordinary server logs (IP address, request time) for operational and security purposes.

Who else sees your data

The PDPA requires us to name the classes of third party that receive your data. The full list: Vercel and Cloudflare (hosting and visit counting), Google (Sheets and Apps Script, where leads are stored; and Google Analytics if you allow it), Telegram (lead alerts to the owner's phone), Resend (sending email), Billplz and Stripe (processing payments), Meta (ad measurement, if you allow it). Several of these operate outside Malaysia, so your data does leave the country. We do not sell data to anyone, and we never send your phone number or email address to an advertiser.

How long it is kept

Leads that do not become customers are kept for 24 months, then deleted. Customer and payment records are kept for 7 years, because that is what Malaysian tax and accounting rules require. WhatsApp tap counts contain nothing that identifies you, so they stay as numbers.

Your rights under the PDPA

Under the Personal Data Protection Act 2010 you have the right to know what we hold about you, to get a copy of it, to correct it if it is wrong, to limit how we use it, and to ask for it to be deleted. Send one WhatsApp message or an email and we will handle it. No form, no charge. If you are not satisfied with our answer, you can complain to the Personal Data Protection Department (JPDP).