Privacy Policy

Effective 1 January 2026

Who we are

This policy is published by Axtraction AI Sdn Bhd (no. 202301042335), a company registered in Malaysia with its office at Level 27 Penthouse, Centrepoint North, Mid Valley City, Lingkaran Syed Putra, 59200 Kuala Lumpur. Our group also includes Axtraction AI Limited (no. 79826532), registered in Hong Kong SAR at Unit 2A, 17/F, Glenealy Tower, 1 Glenealy, Central.

Axtraction AI Sdn Bhd decides how the personal data described here is handled, except where your agreement is with Axtraction AI Limited. In that case the Hong Kong company decides, and the same standards apply.

We have appointed a data protection officer. You can reach them at privacy@axtraction.ai.

What this policy covers

Two groups of people: those who visit axtraction.ai, and those who contact us or work with us in a business capacity.

It does not cover personal data held inside a customer's deployment of our products. We handle that on the customer's instructions, and it is dealt with separately below.

The website

axtraction.ai is a static site. It sets no cookies. It runs no analytics, no tracking pixels, and no third-party scripts. There is nothing to sign up for and no page asks you to submit anything. Even our typeface is served from our own domain, so opening a page sends no request to any other company.

The site is hosted on Google Cloud and served through its content delivery network. As with any website, the hosting provider processes standard technical request data such as your IP address, the page requested, and your browser's user agent. That is what makes it possible to deliver the page and to keep the site available and secure. We do not use it to profile you and we do not combine it with anything else.

When you email us

Email is the only contact channel on this site. If you write to us, we receive whatever you choose to send: usually your name, your email address, the organisation you work for, and the content of your message.

Everything you send is voluntary. Nothing on this site asks you for anything, so you decide what to tell us.

We use it to answer you, and to keep a record of our dealings with you if a working relationship follows. Under Malaysian law we rely on your consent, given by choosing to write to us, and on the need to take steps at your request before entering into an agreement. Where the GDPR applies to a particular case, we rely on our legitimate interest in answering enquiries and in managing business relationships.

Sometimes your details reach us another way: you hand over a card at an event, a colleague introduces you, or a partner passes on a contact. We record the same kind of business details in that case, and if you ask us where we got them, we will tell you.

No automated system makes decisions about you based on what you send. A person reads it.

Please do not send sensitive material by email. It is not a secure channel. Tell us what you need to share and we can arrange a safer route.

Email we send you

If you are a business contact, we may write to you about our products and what we are building. To do that we use your name, work email address, job title, the organisation you work for, and our record of earlier conversations. We write only about Axtraction AI's own products and services, never on behalf of anyone else, and we do not pass your details to another company so that it can market to you.

You can stop it whenever you like, at no cost. Reply to any message and say so, or write to privacy@axtraction.ai. We act on it and we do not ask you to give a reason.

Who else handles it

We keep the number of companies that touch your data small, and each is bound by contract terms that limit what they may do with it.

• Google Cloud hosts this website and its content delivery network.
• Microsoft provides our company email, so a message you send us is stored in a Microsoft 365 mailbox.
• Attio, our customer relationship management system, holds business contact details and a record of our correspondence, so the team can pick up a conversation without asking you to repeat yourself.

These providers run infrastructure in more than one country, so your data may be handled outside Malaysia. Each is engaged on data protection terms that require them to handle it only on our instructions and to protect it wherever it sits. We do not sell personal data.

How long we keep it

Business contact details and correspondence stay with us while we have, or reasonably expect to have, a working relationship with you or the organisation you represent, and for up to seven years after we last hear from you. Government and enterprise relationships go quiet for long stretches and then pick up again, so a short clock would mean asking you to repeat a conversation we already had.

Seven years is not an arbitrary figure. It matches the period we are required to keep business records under Malaysian and Hong Kong tax and company law, and it outlasts the six-year window for bringing a contract claim in either place. Running contact records on the same clock gives us one retention rule to follow instead of several.

Technical request data handled by our hosting provider is short-lived, and we do not retain it for analysis. You can ask us to delete what we hold about you sooner than seven years. We will do that unless we are required to keep it, and we will say so if that is the case.

Data inside a customer deployment

When we deploy a product for a customer, that customer decides what personal data goes into the system and what it is used for. They are the data controller. We act as a data processor on their instructions, under the agreement we hold with them.

Every engagement is single-tenant, running where the customer chooses: their own cloud account, their own premises, or hosting we manage for them. We do not use one customer's data for another customer, and we do not use it for our own purposes.

Our products carry out automated processing. Where that output feeds a decision about a person, the customer decides how it is used and carries any impact assessment its regulator asks for. We give them the documentation about how the system works so they can complete one.

If you believe your personal data sits inside a system we run for a customer and you want to exercise a right over it, contact that organisation. They hold the relationship with you and they decide. If you come to us instead, we pass your request to them.

Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct it where it is wrong or out of date;
• delete it, or stop using it, where the law allows;
• stop sending you anything you did not ask for.

Depending on where you are, you may also be able to ask for your data in a portable form, object to processing we base on legitimate interests, or withdraw consent you gave earlier.

Write to privacy@axtraction.ai, or by post to the Data Protection Officer, Axtraction AI Sdn Bhd, Level 27 Penthouse, Centrepoint North, Mid Valley City, Lingkaran Syed Putra, 59200 Kuala Lumpur. We may need to confirm who you are before we act. Requests are answered inside the period the applicable law sets, and sooner where we can.

If our answer does not satisfy you, you can complain to a regulator: the Personal Data Protection Department (JPDP) in Malaysia, the Office of the Privacy Commissioner for Personal Data in Hong Kong SAR, or your national supervisory authority in the EU or the UK.

How we protect it

Axtraction AI is certified to ISO 27001:2022 for information security management. Traffic to this website is encrypted in transit. Access to our business systems is limited to the people who need it and is reviewed.

Children

Our products and this site are built for organisations, not for children. We do not knowingly collect personal data from children.

Changes to this policy

If we change this policy, the effective date at the top of this page changes with it. Where a change materially affects you, we will describe it here rather than quietly amend the text.