PickAI Privacy Policy (Privacy Notice)
Last updated: 28 October 2026 · Version 1.0
This notice explains what personal data PickAI (https://pickai-a3i.pages.dev) collects, why, who it is shared with, and how you can access, correct or delete it. It is our written notice under section 7 of Malaysia’s Personal Data Protection Act 2010 (as amended by the Personal Data Protection (Amendment) Act 2024) (“PDPA”). It is published in Bahasa Melayu and English, and both versions say the same thing. A Chinese version is provided for convenience. If the versions differ, the Bahasa Melayu and English versions prevail.
1. Who we are
PickAI is a website that recommends AI tools by task. It is run from Malaysia by PickAI (“PickAI”, “we”, “us”), which you can contact at leeyongwei210084@gmail.com. We are the data controller for the personal data described here.
Contact for all privacy matters, including access, correction, deletion and complaints: leeyongwei210084@gmail.com (subject line: “Privacy request”).
2. The short version
- You can read the whole site without giving us any personal data. We do not use cookies for analytics or advertising.
- We only collect personal data when you choose to post a comment, send feedback, apply to sponsor, or subscribe to the newsletter.
- Comments (nickname and text) are public. Do not put personal details in them.
- We never sell your personal data.
- We use a few service providers to run the site: Cloudflare (hosting and database), Kit (newsletter email), Stripe (sponsor payments only) and Gmail (for replying to email). Some of them are outside Malaysia.
- You can ask us at any time to access, correct or delete your data, or to stop emailing you.
3. What we collect, why, and whether you must provide it
| Feature | Personal data | Purpose | Voluntary or required |
|---|---|---|---|
| Comments on tool and scenario pages | Nickname and comment text (shown publicly); the page and language version; time posted; a pseudonymised hash of your IP address (not shown publicly) | Showing your comment; preventing spam, floods and duplicate posts (rate limits) | Voluntary. Nickname and text are required to post. If you do not provide them, you cannot post, but you can still use the whole site. |
| Feedback form (/feedback/) | Feedback type and message; the related page (optional); email address (optional); language; time sent; IP hash | Fixing errors, considering suggestions, replying to you if you gave an email; preventing abuse | Voluntary. The message is required to send feedback. Email is optional; without it we cannot reply. |
| Sponsorship application (/advertise/) | Tool name and website; contact name; contact email; preferred start date, message and highlights (optional); language; time sent; IP hash | Reviewing your application, replying and arranging the sponsorship; preventing abuse | Voluntary. Tool name, website, contact name and email are required, because we cannot review or reply to an application without them. |
| Sponsor payment (only if your application is accepted) | Payment details you enter on Stripe’s checkout page, the tool name/URL and scenario fields on that page | Taking payment and keeping business and tax records | Required only if you choose to pay for a sponsorship. Card details go to Stripe; we never see or store your full card number. |
| Newsletter | Email address; language; the page you subscribed from; subscription and unsubscription times; subscription status; IP hash; technical sync status with Kit | Sending the confirmation email and the PickAI weekly email; handling unsubscribes; preventing abuse | Voluntary. Email is required to subscribe. |
| Campaign (UTM) statistics | Only the utm_source, utm_medium and utm_campaign values in the link you clicked, the landing page path and the date (UTC) | Counting visits per marketing channel in aggregate | Automatic when you arrive through a tagged link. No IP, IP hash, device, browser, referrer, cookie or visitor ID is recorded, so this data does not identify you. |
| Page-view statistics (Cloudflare Web Analytics) | Aggregate page views, measured without cookies | Understanding which pages are used | Automatic. See section 6. |
| Email you send us | Your email address and whatever you write | Replying to you | Voluntary. |
Source of the data. We collect this data directly from you through the forms above. The IP hash is computed from the connection your browser makes to our site. We do not buy data or collect it from other sources.
About the IP hash. We never store your raw IP address. For spam control we store a one-way SHA-256 hash of your IP address (for IPv6, of its /64 network prefix) combined with a secret value. It cannot be shown publicly or reversed by others, but because the same address always gives the same hash, we treat it as personal data and protect it accordingly.
Please do not send us sensitive personal data (for example health, religious, political or biometric data, or financial details) in comments, feedback or applications. We do not ask for it.
Children. PickAI is meant for a general adult audience. If you are under 18, please get your parent’s or guardian’s consent before posting a comment, sending feedback or subscribing.
4. Who we share personal data with
We do not sell or rent personal data, and we do not share it for other companies’ marketing. We only disclose it to the following classes of third parties:
- Service providers that process data for us (data processors):
- Cloudflare, Inc. (USA, global network): website hosting (Cloudflare Pages), our database (Cloudflare D1, where comments, feedback, sponsorship applications, newsletter records and UTM counts are stored), Web Analytics and, if enabled, the Turnstile bot check.
- Kit, Inc. (kit.com, USA): newsletter delivery. When you subscribe, your browser sends your email address directly to Kit. Kit sends the confirmation email (double opt-in) and each newsletter. If Kit suspects automated sign-ups, it may show you its own security check. Kit may record whether an email is opened and whether links in it are clicked.
- Stripe: payment processing for accepted sponsors only.
- Google (Gmail): our contact mailbox, used to reply to feedback, sponsorship and privacy requests.
- The public: your comment nickname and text, and the time it was posted, are visible to everyone.
- Authorities and advisers: where required or permitted by law (for example a court order, or a request from the Personal Data Protection Commissioner or police), or to establish, exercise or defend legal claims.
- A successor: if PickAI is transferred to another operator, the data may be transferred with it under this notice. We will tell you before that happens.
5. Transfers outside Malaysia
Our service providers store or process data outside Malaysia, including in the United States and in other countries where Cloudflare operates data centres. The United States has no single national data protection law that is substantially similar to the PDPA. We therefore rely on the conditions in section 129 of the PDPA: we choose established providers that commit by contract (their data processing terms) to protect personal data and keep it secure, and we tell you about the transfer in this notice. By subscribing to the newsletter, you also consent to your email address being sent to Kit in the United States for that purpose.
6. Cookies, analytics and browser storage
- No analytics or advertising cookies. Cloudflare Web Analytics measures page views without cookies or local storage and does not record URL query strings. As our host, Cloudflare necessarily processes your IP address and technical request data to deliver pages and protect the site against attacks. See Cloudflare’s privacy policy.
- Browser storage that stays on your device. If you switch between dark and light themes, your choice is saved in your browser’s localStorage. If you arrive through a tagged link, a flag (
pa_utm) is saved in sessionStorage so the visit is counted only once, and it is cleared when you close the tab. Neither is sent to us as an identifier. - Third-party sites. Tool links, affiliate links and sponsored links take you to other websites. Those sites, and affiliate networks, may use their own cookies to track referrals. Their privacy policies apply there, not ours.
7. How long we keep data
| Data | Retention |
|---|---|
| Public comments | While the comment is displayed. Deleted within 30 days of your deletion request, or of us removing it. |
| IP hash on comments, feedback, applications and subscriptions | Deleted (cleared) after 30 days. Spam checks only need it for up to 24 hours. |
| Feedback | Up to 12 months after we receive it, then deleted. |
| Sponsorship applications not taken up | Up to 12 months after the application, then deleted. |
| Records of accepted sponsorships and payments | As long as Malaysian tax and business record laws require (generally 7 years). |
| Newsletter subscription | Until you unsubscribe. Your email is deleted from our database within 30 days after you unsubscribe. Kit keeps a record that you unsubscribed so that it does not email you again; if you want Kit to delete your email too, tell us and we will ask Kit to delete it. Sign-ups that Kit did not accept are deleted after 30 days. |
| UTM counts | Kept indefinitely as aggregate statistics. They contain no personal data. |
| Emails with us | Up to 24 months after the last message, unless needed for a legal claim. |
When these periods end, an automated cleanup job deletes or clears the data.
8. Security
Data is sent to us over HTTPS. Feedback, applications and subscriber data are never shown publicly and can be read only by the PickAI team through access-controlled tools. Raw IP addresses are not stored. We require our service providers to keep data secure, as data processors are also required to do under the PDPA. No system is perfectly secure. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and, where the breach is likely to cause you significant harm, notify you as the PDPA requires.
9. Your rights
Under the PDPA you can:
- Access the personal data we hold about you and get a copy. We will reply within 21 days. We do not charge a fee for this.
- Correct data that is inaccurate, incomplete, misleading or out of date. We will reply within 21 days.
- Withdraw consent and ask us to stop processing, for example by unsubscribing or asking us to delete a comment.
- Ask us to delete your comment, feedback, application or subscription data.
- Stop direct marketing. Every newsletter email has an unsubscribe link, or you can email us.
- Ask us not to process data in a way that is likely to cause you substantial damage or distress.
- Data portability. Ask us to send your data to another organisation where this is technically feasible.
How to make a request. Email leeyongwei210084@gmail.com with the subject “Privacy request”. Tell us what you want and enough detail for us to find the data: for a comment, the page, nickname, approximate date and text. For a subscription or application, write from the same email address, or we may ask a simple question to confirm the data is yours. We may refuse or limit a request where the PDPA allows, and we will tell you why.
Complaints. If you are not satisfied with our reply, you can complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi, https://www.pdp.gov.my).
10. Visitors outside Malaysia
PickAI is run from Malaysia and is governed by Malaysian law. If you are in another country, such as the EU, UK or Singapore, your local law may give you similar rights, such as access, correction, deletion, objection and portability. We will handle requests from anywhere in the same way, through the contact above. Where such laws require a legal basis, we rely on your consent (newsletter), on taking steps at your request (sponsorship applications, replies to feedback), and on our legitimate interest in running and protecting the site (comments, spam prevention, aggregate statistics). You may also complain to your local data protection authority. This paragraph does not claim that PickAI is certified under, or fully compliant with, any foreign law.
11. Changes to this notice
We will update this page when our data practices change and change the “Last updated” date. If a change materially affects how we use data we already hold, we will announce it on the site and, for newsletter subscribers, in the newsletter before it takes effect.