Privacy notice (English)
1. Who we are
This notice explains how Syncwealth Sdn Bhd ("we", "us") handles your personal data when you:
- visit faidhifahmi.my,
- use the contact form, or
- message our WhatsApp assistant.
- Registration: 202101028803 (1429103-H)
- Contact address: faidhifahmi@gmail.com (we correspond by email)
- Email: faidhifahmi@gmail.com
- Data protection contact: Faidhi Fahmi, faidhifahmi@gmail.com
About the WhatsApp number. Our WhatsApp assistant runs on a WhatsApp Business number and an Infobip account held by Syncwealth Sdn Bhd. The number may show the name of our iLyF brand.
2. What personal data we collect
a) When you browse faidhifahmi.my
If you select "Accept" in the cookie banner, we use Microsoft Clarity to understand how visitors use the site. Clarity collects:
- Interaction data: clicks, taps, scrolling, mouse movement, pages viewed and time on page. Clarity uses this to build heatmaps and session recordings (a replay of how a page was used).
- Device and browser data: device type, browser, operating system, screen size, and approximate location derived from your IP address.
- Cookie identifiers: a pseudonymous ID that links your page views into one session. See §13.
- Events we define: for example, that a WhatsApp button or pricing section was viewed or clicked, with a campaign tag such as
site-hero. These events never include your phone number, name or email.
The contact form and the booking window are marked so that Clarity masks their content in recordings (Microsoft: masking).
b) When you use the contact form
The form collects:
- your name,
- your email address,
- your company (optional), and
- your message.
We also process your IP address briefly, in server memory, to limit spam (no more than 5 messages per 10 minutes). We don't write your IP address to our own logs. Our hosting providers (§4) may keep standard request logs under their own terms.
c) When you message our WhatsApp assistant
- Your WhatsApp phone number and profile name.
- The messages you send and the replies you receive.
- A source tag that shows which link or page you came from, for example
src=site-pricing. If you were contacted earlier, the tag may include a reference number that links this chat to our earlier record about you. - Your answers to our qualifying questions. These can cover your name, industry, agency name and type, team size, number of customers, where your leads come from, how you handle enquiries today, the problems you face, what you have tried, and your timing. If you become a client, we also record your billing name and billing email.
- Booking details: the time slot you chose, and a calendar event and video-call link for the call.
- Notes we make after a call with you.
d) Information from other sources
Before contacting a business, we may look at publicly available business information about it, for example its website and public business listings. We do not collect information from LinkedIn automatically. We do not collect home addresses, family details, IC numbers, health or religion.
Please don't send us sensitive data. Don't send IC or passport numbers, health or medical information, bank or card details, or information about your customers. We don't need any of it to answer your enquiry or book a call. If you send it anyway, we will delete it where practicable.
Is giving us data obligatory? No. You can browse the site and reject cookies (§13). If you don't give us a way to reach you (an email address in the form, or a WhatsApp chat), we can't reply to you or book a call.
3. Why we use it
We use your personal data to:
- reply to your enquiry and answer questions about our services;
- understand your needs (qualification) and decide whether a call is worthwhile;
- book, change or cancel a call;
- prepare a follow-up summary or proposal after a call that you asked for;
- avoid creating duplicate records, using the source tag and reference number;
- measure which pages and links work, and improve the website;
- keep records of our contact with you, handle opt-outs and deletion requests, and meet legal obligations;
- protect the site and the assistant from spam and abuse.
We don't sell your personal data. We don't use it for advertising profiles, and the site has no advertising pixels.
4. Who processes it for us, and where
We use the service providers below. Each one processes data only to provide its service to us, under its own terms or a data processing agreement with us.
| Provider | What it does for us | Data involved | Where the data is processed |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Carries WhatsApp messages | Number, profile name, messages | Outside Malaysia, including the United States |
| Infobip | WhatsApp business provider; also delivers contact-form emails to us | Number, profile name, messages; form contents | Outside Malaysia |
| OpenRouter, Inc. | Routes chat text to the AI model | Message text and conversation context | United States |
| OpenAI (AI model vendor) | Generates the assistant's replies | Message text and conversation context | United States |
| Google (Calendar, Meet, Sheets, Gmail) | Booking calendar and video calls, a CRM view of enquiries, and our email inbox | Name, number, booking, qualifying answers, form contents | Outside Malaysia, including the United States |
| Render | Hosts the website | Requests and contact-form contents in transit; server logs | Singapore |
| Microsoft Azure | Hosts the website (second host) | Requests and form contents in transit; server logs | Malaysia |
| Microsoft Clarity | Website analytics and session recordings (only after you accept) | See §2(a) | United States |
| Tailscale | Network link that carries WhatsApp webhooks to our server | Encrypted message traffic only | Outside Malaysia |
Our main records (the CRM database) are kept on equipment we control in Malaysia.
We may also disclose personal data:
- to our professional advisers, under confidentiality;
- where the law requires it; or
- to a buyer or successor if the business is transferred, in which case we will tell you first.
5. Transfers outside Malaysia
Some providers in §4 process data outside Malaysia, including in the United States and Singapore. We transfer personal data abroad only for the purposes in §3. We rely on section 129(3)(f) of the Personal Data Protection Act 2010: we take reasonable precautions and exercise due diligence, including choosing established providers and relying on their data protection terms, so that the data is not processed in a way that would breach the Act. We keep a record of each transfer (PDP Guideline 3/2025).
6. How long we keep it
| Data | How long |
|---|---|
| WhatsApp chats, qualifying answers and CRM record | Deleted 12 months after our last contact with you, or sooner if you ask. A weekly check flags idle records, which we then delete. |
| Calendar booking | Cancelled and deleted when your record is deleted. Otherwise kept with the CRM record. |
| Contact-form emails | 12 months after our last contact with you. |
| Clarity session recordings | 30 days. Recordings we mark as favourites or label, and aggregated click and heatmap data, are kept for up to 9 months. Source: Microsoft Clarity data retention. We don't favourite or label recordings that show personal data. |
| Copies held by WhatsApp, Infobip, OpenRouter and OpenAI | Under each provider's own retention terms. |
| Records of opt-outs and deletion requests | Kept as long as needed to honour them: the number and date only. |
| Signed contracts and invoices (clients only) | 7 years, as tax and company law require. |
7. Your rights and how to use them
Under the Personal Data Protection Act 2010 you can:
- Access: ask what personal data we hold about you, and get a copy.
- Correction: ask us to correct data that is inaccurate, incomplete, misleading or out of date.
- Withdraw consent and limit processing: stop us using your data, or using it for a particular purpose.
- Stop direct marketing: tell us not to contact you for marketing.
- Data portability: ask us to send your data to another data controller, where technically feasible (in force since 1 June 2025).
How to use these rights
- On WhatsApp:
- Reply STOP (or BERHENTI) and the assistant will stop messaging you.
- Reply PERSON (or ORANG) at any time to talk to Faidhi instead of the AI.
- To delete your data, reply PERSON and ask Faidhi, or email us. We will delete your chat, qualifying answers and CRM record, and cancel any booking.
- By email: write to faidhifahmi@gmail.com with the subject "Personal data request".
We will reply within 21 days. Requests are free. We may ask you to verify your identity, for example by messaging from the same WhatsApp number. If we can't fully meet a request, for example because the law requires us to keep a record, we will tell you why.
Complaints: please contact us first. You can also complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi): https://www.pdp.gov.my
8. Our AI assistant
- What it is: replies on our WhatsApp number come from an AI assistant, not a person. The first message says so.
- What it uses: it answers only from information we have approved about our own services.
- What it doesn't do: it doesn't give legal, financial, insurance, investment or property advice, and it doesn't negotiate prices.
- Mistakes: AI replies can contain errors. Anything important, such as prices, terms or contracts, is set out by Faidhi in writing.
- Talking to a person: reply PERSON or ORANG at any time.
- No automated decisions: the assistant may sort enquiries to decide follow-up priority. It makes no decision that has a legal or similarly significant effect on you. Faidhi decides whether to work together.
- Model training: your messages are not used to train AI models.
9. How we protect your data
We take practical steps to protect personal data from loss, misuse and unauthorised access, change or disclosure. These include:
- encrypted connections,
- access limited to Faidhi,
- separately stored credentials,
- signature checks on incoming WhatsApp webhooks, and
- regular backups.
No system is risk-free.
10. Data breaches
If a personal data breach causes, or is likely to cause, significant harm, we will:
- notify the Personal Data Protection Commissioner within 72 hours, and
- notify affected people without unnecessary delay, and within 7 days of that notice.
We keep a record of breaches. Source: PDP Data Breach Notification Guideline.
11. Under-18s
Our services are for businesses. They are not intended for anyone under 18. Please don't message the assistant or use the form if you are under 18. If we learn that we hold data about someone under 18, we will delete it.
12. Links to other sites
This notice doesn't cover other websites or services, including WhatsApp itself. Meta's own privacy policy applies to your use of WhatsApp.
13. Cookies and Microsoft Clarity
Clarity sets these cookies:
- First-party:
_clck(keeps your Clarity ID) and_clsk(links page views into one session). - Microsoft cookies:
MUID,CLID,ANONCHK,MRandSM. These are used across Microsoft services.
Source: Microsoft: Clarity cookies.
We load Clarity only after you select "Accept" in the cookie banner. If you choose "Reject", Clarity doesn't run.
You can change your choice at any time through "Cookie settings" in the site footer. Microsoft's handling of this data is described in the Microsoft Privacy Statement.
We also store your cookie choice in your browser for 12 months so we don't ask you again. The site uses no advertising cookies.
14. Changes to this notice
We may update this notice. The date at the top shows the latest version. For significant changes, we will put a notice on the site and, where practicable, tell people we are in contact with.
15. Language
This notice is available in English and Bahasa Malaysia. If the two versions differ, the English version prevails.