Privacy Policy — Modelcraft

1. Introduction

Modelcraft ("we", "us", or "our") operates an AI online school based in Kuala Lumpur, Malaysia. We offer structured reading programmes and studio cohorts to individuals interested in understanding how modern AI systems work.

This Privacy Policy covers how we collect, use, store, and protect personal data submitted through our website at modelcraftima.pro and through our enquiry and enrolment processes.

We are the data controller for information you provide to us. Our processing activities are conducted in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

For questions about this policy, write to us at [email protected].

2. Data We Collect

Information you provide directly

Name — so we can address you personally in correspondence.
Email address — our primary channel for programme-related communication.
Phone number — optional, used only if you provide it and wish to be contacted by phone.
Message content — the text of your enquiry or application note.

Information collected automatically

Browser type and version, approximate location (country/city), referring page, and session duration — collected through analytics cookies if you have consented.
IP address — collected by our hosting infrastructure for security logging purposes.

Legal basis and retention

Legal basis

Consent (for marketing and analytics); legitimate interest (for security logging); contractual necessity (for programme delivery).

Retention period

Enquiry data: up to 24 months after last contact. Enrolment records: up to 5 years for administrative purposes. Analytics data: up to 24 months.

3. How We Use Your Data

Programme enquiries and enrolment. When you submit our contact form, we use your name, email, and message to respond to your enquiry and, where appropriate, to discuss programme options with you.

Programme delivery. If you enrol in a cohort or reader series, your contact details are used to deliver course materials, coordinate live sessions, and provide written feedback.

Site improvement. Aggregated analytics data (collected only with your consent) helps us understand which parts of the site are most useful and identify areas to improve.

Advertising measurement. If you have consented to marketing cookies, conversion events from advertising platforms (Meta, Bing) may be recorded. This data is used only for measuring campaign effectiveness — not for building individual profiles.

Legal compliance. We may process or retain data as required by Malaysian law or as necessary to establish, exercise, or defend legal claims.

We do not sell your personal data to third parties, nor do we use it to build advertising profiles for resale.

4. Data Sharing and Third Parties

We share data only where necessary and with parties who have appropriate data protection arrangements in place.

Google LLC (Analytics) Anonymised usage data is processed by Google Analytics to generate aggregate reports. Google operates under standard contractual clauses for international data transfers.

Meta Platforms, Inc. (Pixel) Conversion events are reported to Meta's advertising platform when marketing cookies are accepted. This is used solely for measuring the reach of our adverts.

Microsoft Corporation (Bing UET) Similar to Meta, Bing UET records conversion events for Bing advertising campaigns when marketing cookies are accepted.

We do not share personal data with other commercial partners, marketing agencies, or data brokers.

5. Data Protection Measures

Encryption in transit

All data transferred between your browser and our servers is encrypted using TLS. Our site operates exclusively over HTTPS.

Secure hosting

Submitted data is stored on hosting infrastructure with access restricted to authorised personnel only.

Access controls

Internal access to personal data is limited to team members who require it to carry out their responsibilities.

Breach notification

In the event of a data breach affecting your personal information, we will notify you and the relevant authority as required under the PDPA.

6. Cookies

We use cookies on this site for functionality, analytics, marketing measurement, and preference storage. A brief summary:

Essential cookies — required for site operation. Cannot be disabled.
Analytics cookies — help us understand traffic patterns (optional, requires consent).
Marketing cookies — measure ad conversion events (optional, requires consent).
Preference cookies — store your language or display choices (optional).

For full details and to manage your preferences, see our Cookie Policy.

7. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and, where applicable, international data protection standards, you have the following rights regarding your personal data:

Right to access. You may request a copy of the personal data we hold about you at any time.

Right to correction. If any information we hold is inaccurate or incomplete, you may ask us to correct it.

Right to erasure. In certain circumstances, you may ask us to delete your personal data. We will do so unless we have a lawful basis to retain it.

Right to data portability. You may request a copy of your data in a structured, machine-readable format where technically feasible.

Right to object. You may object to processing based on our legitimate interests where your individual circumstances warrant it.

Right to withdraw consent. Where processing is based on consent (e.g. analytics cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.

Right to lodge a complaint. You may raise a concern with the Department of Personal Data Protection Malaysia (pdp.gov.my) if you believe your data has been mishandled.

To exercise any of the above rights, write to us at [email protected]. We aim to respond within 14 working days.

8. Links to Other Sites

Our site may occasionally link to external resources or reading materials. We are not responsible for the privacy practices of those sites. When you follow a link to another site, we recommend reading their privacy policy before providing any personal information.

9. Minimum Age

Our programmes are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that personal data from a minor has been submitted, we will delete it promptly. If you believe a minor has submitted data through our site, please contact us at [email protected].

10. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last Updated" date at the top of this page. Material changes will be communicated to enrolled participants by email. Continued use of our website after an update constitutes acceptance of the revised policy.

11. Contact and Data Controller

For any privacy-related query, data access request, or concern, please contact us using the details below. We take every enquiry seriously and respond within 14 working days.

Modelcraft
19 Jalan Sultan Ismail, 50250 Kuala Lumpur, Wilayah Persekutuan, Malaysia

[email protected]

+60 3 2148 7390

Governing law: Personal Data Protection Act 2010 (Malaysia)
Supervisory authority: Department of Personal Data Protection Malaysia