Privacy Policy

Last updated: 3 October 2026

1. Who is responsible for your data

SpeakMelayu runs speakmelayu.com and decides how your personal data is used. We follow Malaysia's Personal Data Protection Act 2010 (PDPA). Contact us at [email protected].

2. What we collect

• Email address and subscription details, when you subscribe or buy credits. Stripe holds your payment details; we never see your full card number.
• Learning progress: the units you have ticked and your best quiz and practice scores, so they appear on every device you use. We store them under a scrambled (hashed) form of your email.
• Your name, only if you request a certificate. It is printed on the certificate and shown on the public verification page to anyone who has the certificate number.
• Cikgu AI credit balance and invite-a-friend records (your invite code and how many friends used it).
• Messages and writing you send to Cikgu AI. These are processed to generate a reply and are not stored in your SpeakMelayu account.
• Basic technical data. To prevent abuse, we count requests per visitor using a daily scrambled version of your IP address, which is deleted after two days.

3. Data stored on your device

The site saves your progress, settings and access details in your browser's local storage so lessons load quickly. We do not use advertising cookies or third-party tracking. You can clear this data in your browser settings at any time.

4. How we use your data

• To give you access to the courses you paid for, and to let you log in on new devices.
• To save your progress, award badges and issue certificates.
• To run Cikgu AI and the listening and speaking practice.
• To process payments, refunds and invite-a-friend rewards.
• To answer your messages and send important service notices, such as price changes. We do not sell your data or send marketing emails without your consent.

5. Service providers we use

We share only the data each provider needs to do its job:

• Stripe processes payments and holds your billing details.
• Cloudflare hosts the site and stores your progress, credits and certificate records.
• Anthropic provides the AI model behind Cikgu AI and receives the messages you send to it.
• Microsoft Azure Speech or Google Cloud Text-to-Speech turns lesson text into audio. It receives the text only, not your personal details.
• Your browser's speech recognition. When you use speaking practice, your browser converts your voice to text. In Chrome and Edge this is done by the browser maker's own service. SpeakMelayu does not receive or store your voice recordings.

Some of these providers process data outside Malaysia, including in the United States. We use providers that protect data with industry-standard security.

6. How long we keep data

We keep your progress, credits and certificate records while you are a subscriber, so they are still there if you return. You can ask us to delete them at any time. Payment records are kept by Stripe for as long as tax and accounting laws require.

7. Your rights

Under the PDPA you can ask to see the personal data we hold about you, ask us to correct it, ask us to delete it, or withdraw consent for optional uses. Email [email protected] from the address you subscribed with, and we will reply within 21 days.

8. Children

Learners under 18 should use SpeakMelayu with a parent or guardian's consent. A parent or guardian can contact us to see or delete their child's data.

9. Security

The site uses HTTPS encryption, access codes are checked on our servers, and progress records are stored under hashed email addresses. No online service can be perfectly secure, so please keep your access code private.

10. Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will tell subscribers by email about significant changes.

11. Contact

Privacy questions or requests: [email protected]. See also our Terms of Service.