Privacy Policy | SPM Chat

SPM Chat ("we", "our", or "us") operates spmchat.com, an AI-powered study platform for Malaysian SPM students. This Privacy Policy explains what personal data we collect, why we collect it, and how you can control it — in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

1. What data we collect

We collect the following categories of personal data:

Account data — email address, display name, and authentication credentials (managed by Supabase Auth; passwords are hashed and never stored in plaintext)
Academic profile — current form level (Form 4 or 5), subject selections, language preference, study goal, and optional fields such as MBTI type and motto
Chat history — your messages and the AI responses generated in your study sessions, including the subject and model used
Study activity — chapters studied, quiz attempts and scores, tool interactions (used to generate your activity heatmap and weak-topic analysis)
School association — the school you optionally link to your account for community features and the school pilot programme
Saved content — essay outlines and notes you choose to save
Payment status — whether you have an active Pro subscription. Payment card details are handled entirely by Stripe and are never stored on our servers.
Session data — cookies and session tokens required to keep you logged in

2. Why we collect it

To provide personalised AI tutoring aligned with the KSSM syllabus
To track your study progress and surface weak topics
To remember your preferences across devices and sessions
To process Pro subscription payments via Stripe
To send transactional emails (account confirmation, subscription receipts, pilot programme welcome)
To display school community stats and leaderboards (aggregated and anonymous)

We do not use your data for advertising and we do not sell, rent, or share your personal data with third parties for their own marketing purposes.

3. Where your data is stored

Your data is stored on the following infrastructure, all hosted on secure cloud platforms:

Supabase (PostgreSQL) — primary database for accounts, chat history, and activity data, hosted on AWS infrastructure
Upstash Redis — short-lived session cache for performance (e.g. premium status, language preference); does not store chat content
Vercel — hosting and serverless functions; processes requests but does not persistently store your personal data
Stripe — payment processing; governed by Stripe's Privacy Policy

4. Data retention

Active accounts — data is retained for as long as your account is active
Deleted accounts — all personal data is deleted within 30 days of a verified deletion request
Inactive accounts — accounts with no activity for 24 months may have their data deleted after a 30-day notice period
Chat history — retained until you delete individual chats or request full account deletion

5. Your rights under PDPA 2010

Under the Personal Data Protection Act 2010, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your account and associated data
Withdraw consent for data processing (which will require account closure)

To exercise any of these rights, email us at isaacyong0804@gmail.com with the subject line "Data Request". We will respond within 21 days.

6. How to delete your account

You can request account deletion at any time by emailing isaacyong0804@gmail.com with the subject line "Delete My Account". Include the email address registered to your account. All personal data will be permanently deleted within 30 days.

7. Minors

SPM Chat is intended for users aged 13 and above. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child under 13 has created an account, please contact us at isaacyong0804@gmail.com and we will delete the account promptly.

For school pilot programmes, students are enrolled at the discretion of their teacher or school administrator. By enrolling a class, the school confirms that appropriate parental or institutional consent has been obtained in accordance with their school's data governance policies.

8. Cookies

We use cookies solely for:

Keeping you logged in (authentication session)
Remembering your language preference
Attributing referral links (7-day cookie, deleted after sign-up)

We do not use advertising cookies or third-party tracking cookies.

9. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of SPM Chat after an update constitutes acceptance of the revised policy. For significant changes, we will notify you by email.

10. Contact

For any privacy-related questions or requests, contact us at:

SPM Chat
isaacyong0804@gmail.com